6.12.2-rc1 review
Subsystems (8)
Greg Kroah-Hartman
maintainerPATCH 247/826 drm/bridge: tc358767: Fix link properties discovery
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 2d343723c7e1f9f6d64f721f07cfdfc2993758d1 ]
When a display controller driver uses DRM_BRIDGE_ATTACH_NO_CONNECTOR, tc358767 will behave properly and skip the creation of the connector.
However, tc_get_display_props(), which is used to find out about the DP monitor and link, is only called from two places: .atomic_enable() and tc_connector_get_modes(). The latter is only used when tc358767 creates its own connector, i.e. when DRM_BRIDGE_ATTACH_NO_CONNECTOR is _not_ set.
Thus, the driver never finds out the link properties before get_edid() is called. With num_lanes of 0 and link_rate of 0 there are not many valid modes...
Fix this by adding tc_get_display_props() call at the beginning of get_edid(), so that we have up to date information before looking at the modes.
--- drivers/gpu/drm/bridge/tc358767.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/bridge/tc358767.c +7 -0
@@ -1714,6 +1714,13 @@ static const struct drm_edid *tc_edid_read(struct drm_bridge *bridge, struct drm_connector *connector) {struct tc_data *tc =bridge_to_tc (bridge); +int ret; + + ret =tc_get_display_props (tc); +if (ret <0 ) { +dev_err (tc->dev,"failed to read display props: %d\n" , ret); +return 0 ; + }return drm_edid_read_ddc (connector, &tc->aux.ddc); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 248/826 drm/panic: Select ZLIB_DEFLATE for DRM_PANIC_SCREEN_QR_CODE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <[email protected]>
[ Upstream commit 2ad84af4cff9121827d3dd35e293478bdb0b58bb ]
Under CONFIG_DRM_PANIC_SCREEN_QR_CODE=y, zlib is used:
ld.lld: error: undefined symbol: zlib_deflate_workspacesize >>> referenced by drm_panic.c
>>> drivers/gpu/drm/drm_panic.o:(drm_panic_qr_init) in archive vmlinux.a
Thus select CONFIG_ZLIB_DEFLATE.
--- drivers/gpu/drm/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/Kconfig +1 -0
@@ -152,6 +152,7 @@ config DRM_PANIC_SCREEN config DRM_PANIC_SCREEN_QR_CODE bool "Add a panic screen with a QR code" depends on DRM_PANIC && RUST + select ZLIB_DEFLATE help This option adds a QR code generator, and a panic screen with a QR code. The QR code will contain the last lines of kmsg and other debug
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 249/826 selftests/bpf: Fix msg_verify_data in test_sockmap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit ee9b352ce4650ffc0d8ca0ac373d7c009c7e561e ]
Function msg_verify_data should have context of bytes_cnt and k instead of assuming they are zero. Otherwise, test_sockmap with data integrity test will report some errors. I also fix the logic related to size and index j
1/ 6 sockmap::txmsg test passthrough:FAIL 2/ 6 sockmap::txmsg test redirect:FAIL 7/12 sockmap::txmsg test apply:FAIL 10/11 sockmap::txmsg test push_data:FAIL 11/17 sockmap::txmsg test pull-data:FAIL 12/ 9 sockmap::txmsg test pop-data:FAIL 13/ 1 sockmap::txmsg test push/pop data:FAIL
...
Pass: 24 Fail: 52
After applying this patch, some of the errors are solved, but for push, pull and pop, we may need more fixes to msg_verify_data, added a TODO
10/11 sockmap::txmsg test push_data:FAIL 11/17 sockmap::txmsg test pull-data:FAIL 12/ 9 sockmap::txmsg test pop-data:FAIL
...
Pass: 37 Fail: 15
Besides, added a custom errno EDATAINTEGRITY for msg_verify_data, we shall not ignore the error in txmsg_cork case.
--- tools/testing/selftests/bpf/test_sockmap.c | 30 ++++++++++++++-------- 1 file changed, 20 insertions(+), 10 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +20 -10
@@ -56,6 +56,8 @@ static void running_handler(int a);#define BPF_SOCKHASH_FILENAME "test_sockhash_kern.bpf.o"#define CG_PATH "/sockmap" +#define EDATAINTEGRITY 2001 +/* global sockets */ int s1, s2, c1, c2, p1, p2;int test_cnt;
@@ -510,23 +512,25 @@ static int msg_alloc_iov(struct msghdr *msg,return -ENOMEM ; } -static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz) +/* TODO: Add verification logic for push, pull and pop data */ +static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz, +unsigned char *k_p,int *bytes_cnt_p) { -int i, j =0 , bytes_cnt =0 ; -unsigned char k =0 ; +int i, j, bytes_cnt = *bytes_cnt_p; +unsigned char k = *k_p; -for (i =0 ; i < msg->msg_iovlen; i++) { +for (i =0 , j =0 ; i < msg->msg_iovlen && size; i++, j =0 ) {unsigned char *d = msg->msg_iov[i].iov_base;/* Special case test for skb ingress + ktls */ if (i ==0 && txmsg_ktls_skb) {if (msg->msg_iov[i].iov_len <4 ) -return -EIO ; +return -EDATAINTEGRITY ;if (memcmp (d,"PASS" ,4 ) !=0 ) {fprintf (stderr,"detected skb data error with skb ingress update @iov[%i]:%i \"%02x %02x %02x %02x\" != \"PASS\"\n" , i,0 , d[0 ], d[1 ], d[2 ], d[3 ]); -return -EIO ; +return -EDATAINTEGRITY ; } j =4 ;/* advance index past PASS header */ }
@@ -536,7 +540,7 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz)fprintf (stderr,"detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n" , i, j, d[j], k -1 , d[j+1 ], k); -return -EIO ; +return -EDATAINTEGRITY ; } bytes_cnt++;if (bytes_cnt == chunk_sz) {
@@ -546,6 +550,8 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz) size--; } } + *k_p = k; + *bytes_cnt_p = bytes_cnt;return 0 ; }
@@ -602,6 +608,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,float total_bytes, txmsg_pop_total;int fd_flags =O_NONBLOCK ;struct timeval timeout; +unsigned char k =0 ; +int bytes_cnt =0 ;fd_set w;fcntl (fd, fd_flags);
@@ -696,7 +704,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, iov_length * cnt :iov_length * iov_count; - errno =msg_verify_data (&msg, recv, chunk_sz); + errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt);if (errno) {perror ("data verify msg failed" ); goto out_errno;
@@ -704,7 +712,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,if (recvp) { errno =msg_verify_data (&msg_peek, recvp, - chunk_sz); + chunk_sz, + &k, + &bytes_cnt);if (errno) {perror ("data verify msg_peek failed" ); goto out_errno;
@@ -812,7 +822,7 @@ static int sendmsg_test(struct sockmap_options *opt) s.bytes_sent, sent_Bps, sent_Bps/giga, s.bytes_recvd, recvd_Bps, recvd_Bps/giga, peek_flag ? "(peek_msg)" : ""); -if (err && txmsg_cork) +if (err && err != -EDATAINTEGRITY && txmsg_cork) err =0 ;exit (err ?1 :0 ); }else if (rxpid ==-1 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 250/826 selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit b29e231d66303c12b7b8ac3ac2a057df06b161e8 ]
txmsg_redir in "Test pull + redirect" case of test_txmsg_pull should be 1 instead of 0.
--- tools/testing/selftests/bpf/test_sockmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_sockmap.c +1 -1
@@ -1606,7 +1606,7 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)test_send_large (opt, cgrp);/* Test pull + redirect */ - txmsg_redir =0 ; + txmsg_redir =1 ; txmsg_start =1 ; txmsg_end =2 ;test_send (opt, cgrp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 251/826 wifi: mwifiex: add missing locking for cfg80211 calls
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <[email protected]>
[ Upstream commit 0d7c2194f17c764df0354af13551cc6f92ef5a44 ]
cfg80211_rx_assoc_resp() and cfg80211_rx_mlme_mgmt() need to be called with the wiphy locked, so lock it before calling these functions.
--- drivers/net/wireless/marvell/mwifiex/cmdevt.c | 2 ++ drivers/net/wireless/marvell/mwifiex/util.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/net/wireless/marvell/mwifiex/cmdevt.c +2 -0
@@ -938,8 +938,10 @@ void mwifiex_process_assoc_resp(struct mwifiex_adapter *adapter) assoc_resp.links[0 ].bss = priv->req_bss; assoc_resp.buf = priv->assoc_rsp_buf; assoc_resp.len = priv->assoc_rsp_size; +wiphy_lock (priv->wdev.wiphy);cfg80211_rx_assoc_resp (priv->netdev, &assoc_resp); +wiphy_unlock (priv->wdev.wiphy); priv->assoc_rsp_size =0 ; } }
drivers/net/wireless/marvell/mwifiex/util.c +2 -0
@@ -494,7 +494,9 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, } } +wiphy_lock (priv->wdev.wiphy);cfg80211_rx_mlme_mgmt (priv->netdev, skb->data, pkt_len); +wiphy_unlock (priv->wdev.wiphy); } if (priv->adapter->host_mlme_enabled &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 252/826 wifi: wilc1000: Set MAC after operation mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 29dd3e48b9bd88bf65a1e760126fa18d1def7b30 ]
It seems it is necessary to set WILC MAC address after operation mode, otherwise the MAC address of the WILC MAC is reset back to what is in nvmem. This causes a failure to associate with AP after the WILC MAC address was overridden by userspace.
Test case:
"
ap$ cat << EOF > hostap.conf
interface=wlan0
ssid=ssid
hw_mode=g
channel=6
wpa=2
wpa_passphrase=pass
wpa_key_mgmt=WPA-PSK
EOF
ap$ hostapd -d hostap.conf
ap$ ifconfig wlan0 10.0.0.1
"
"
sta$ ifconfig wlan0 hw ether 00:11:22:33:44:55 sta$ wpa_supplicant -i wlan0 -c <(wpa_passphrase ssid pass) sta$ ifconfig wlan0 10.0.0.2
sta$ ping 10.0.0.1 # fails without this patch
"
AP still indicates SA with original MAC address from nvmem without this patch:
"
nl80211: RX frame da=ff:ff:ff:ff:ff:ff sa=60:01:23:45:67:89 bssid=ff:ff:ff:ff:ff:ff ...
^^^^^^^^^^^^^^^^^
"
--- drivers/net/wireless/microchip/wilc1000/netdev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/microchip/wilc1000/netdev.c +3 -3
@@ -608,6 +608,9 @@ static int wilc_mac_open(struct net_device *ndev)return ret; } +wilc_set_operation_mode (vif,wilc_get_vif_idx (vif), vif->iftype, + vif->idx); +netdev_dbg (ndev,"Mac address: %pM\n" , ndev->dev_addr); ret =wilc_set_mac_address (vif, ndev->dev_addr);if (ret) {
@@ -618,9 +621,6 @@ static int wilc_mac_open(struct net_device *ndev)return ret; } -wilc_set_operation_mode (vif,wilc_get_vif_idx (vif), vif->iftype, - vif->idx); - mgmt_regs.interface_stypes = vif->mgmt_reg_stypes;/* so we detect a change */ vif->mgmt_reg_stypes =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 253/826 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alper Nebi Yasak <[email protected]>
[ Upstream commit d241a139c2e9f8a479f25c75ebd5391e6a448500 ]
Replace one-element array with a flexible-array member in struct mwifiex_ie_types_wildcard_ssid_params to fix the following warning on a MT8173 Chromebook (mt8173-elm-hana):
[ 356.775250] ------------[ cut here ]------------ [ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) [ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]
The "(size 6)" above is exactly the length of the SSID of the network this device was connected to. The source of the warning looks like:
ssid_len = user_scan_in->ssid_list[i].ssid_len;
[...]
memcpy(wildcard_ssid_tlv->ssid,
user_scan_in->ssid_list[i].ssid, ssid_len);There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this struct, but it already didn't account for the size of the one-element array, so it doesn't need to be changed.
--- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/mwifiex/fw.h +1 -1
@@ -875,7 +875,7 @@ struct mwifiex_ietypes_chanstats {struct mwifiex_ie_types_wildcard_ssid_params {struct mwifiex_ie_types_header header;u8 max_ssid_length; -u8 ssid[1 ]; +u8 ssid[]; } __packed;#define TSF_DATA_SIZE 8
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 254/826 drm: fsl-dcu: enable PIXCLK on LS1021A
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Schiffer <[email protected]>
[ Upstream commit ffcde9e44d3e18fde3d18bfff8d9318935413bfd ]
The PIXCLK needs to be enabled in SCFG before accessing certain DCU registers, or the access will hang. For simplicity, the PIXCLK is enabled unconditionally, resulting in increased power consumption.
--- drivers/gpu/drm/fsl-dcu/Kconfig | 1 + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 +++++++++++++++ drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h | 3 +++ 3 files changed, 19 insertions(+)
drivers/gpu/drm/fsl-dcu/Kconfig +1 -0
@@ -8,6 +8,7 @@ config DRM_FSL_DCU select DRM_PANEL select REGMAP_MMIO select VIDEOMODE_HELPERS + select MFD_SYSCON if SOC_LS1021A help Choose this option if you have an Freescale DCU chipset. If M is selected the module will be called fsl-dcu-drm.
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c +15 -0
@@ -100,6 +100,7 @@ static void fsl_dcu_irq_uninstall(struct drm_device *dev)static int fsl_dcu_load (struct drm_device *dev,unsigned long flags) {struct fsl_dcu_drm_device *fsl_dev = dev->dev_private; +struct regmap *scfg;int ret; ret =fsl_dcu_drm_modeset_init (fsl_dev);
@@ -108,6 +109,20 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)return ret; } + scfg =syscon_regmap_lookup_by_compatible ("fsl,ls1021a-scfg" ); +if (PTR_ERR (scfg) != -ENODEV ) { +/* +* For simplicity, enable the PIXCLK unconditionally, +* resulting in increased power consumption. Disabling +* the clock in PM or on unload could be implemented as +* a future improvement. +*/ + ret =regmap_update_bits (scfg,SCFG_PIXCLKCR ,SCFG_PIXCLKCR_PXCEN , +SCFG_PIXCLKCR_PXCEN ); +if (ret <0 ) +return dev_err_probe (dev->dev, ret,"failed to enable pixclk\n" ); + } + ret =drm_vblank_init (dev, dev->mode_config.num_crtc);if (ret <0 ) {dev_err (dev->dev,"failed to initialize vblank\n" );
drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h +3 -0
@@ -160,6 +160,9 @@#define FSL_DCU_ARGB4444 12#define FSL_DCU_YUV422 14 +#define SCFG_PIXCLKCR 0x28 +#define SCFG_PIXCLKCR_PXCEN BIT(31) +#define VF610_LAYER_REG_NUM 9#define LS1021A_LAYER_REG_NUM 10
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 255/826 drm: panel: nv3052c: correct spi_device_id for RG35XX panel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Walklin <[email protected]>
[ Upstream commit 45608a3eb4902f32010a8328c0a01ccda4b38c9b ]
The Anbernic RG35XX devices use an SPI LCD panel from an unknown OEM, with an NV3052C driver chip.
As discussed previously, the integrating vendor and device name are preferred instead of the OEM serial. A previous patch corrected the device tree binding and of_device_id in the NV3052C driver, however the spi_device_id also needs correction.
Correct the spi_device_id for the RG35XX panel.
--- drivers/gpu/drm/panel/panel-newvision-nv3052c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-newvision-nv3052c.c +1 -1
@@ -917,7 +917,7 @@ static const struct nv3052c_panel_info wl_355608_a8_panel_info = {static const struct spi_device_id nv3052c_ids[] = { {"ltk035c5444t" , }, {"fs035vg158" , }, - {"wl-355608-a8" , }, + {"rg35xx-plus-panel" , }, {/* sentinel */ } };MODULE_DEVICE_TABLE (spi, nv3052c_ids);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 256/826 drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 768a272d5357269b17b4b06dd8647e21bdc0ca3c ]
On the SDM845 platform the DSPP_3 is used by the LM_5. Correct corresponding entries in the sdm845_lm array.
Patchwork: https://patchwork.freedesktop.org/patch/612584/
--- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h +1 -1
@@ -161,7 +161,6 @@ static const struct dpu_lm_cfg sdm845_lm[] = { .features = MIXER_SDM845_MASK, .sblk = &sdm845_lm_sblk, .pingpong = PINGPONG_NONE, - .dspp = DSPP_3, }, { .name = "lm_4", .id = LM_4, .base = 0x0, .len = 0x320,
@@ -175,6 +174,7 @@ static const struct dpu_lm_cfg sdm845_lm[] = { .sblk = &sdm845_lm_sblk, .lm_pair = LM_2, .pingpong = PINGPONG_3, + .dspp = DSPP_3, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 257/826 drm/msm/dpu: drop LM_3 / LM_4 on SDM845
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit d39271061d67c6fcbe8f361c532b493069232cf8 ]
On the SDM845 platform ther are no LM_3 and LM_4 blocks. Drop them from the SDM845 catalog.
Patchwork: https://patchwork.freedesktop.org/patch/612586/
--- .../gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 12 ------------ 1 file changed, 12 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h +0 -12
@@ -155,18 +155,6 @@ static const struct dpu_lm_cfg sdm845_lm[] = { .lm_pair = LM_5, .pingpong = PINGPONG_2, .dspp = DSPP_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x0, .len = 0x320, - .features = MIXER_SDM845_MASK, - .sblk = &sdm845_lm_sblk, - .pingpong = PINGPONG_NONE, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x0, .len = 0x320, - .features = MIXER_SDM845_MASK, - .sblk = &sdm845_lm_sblk, - .pingpong = PINGPONG_NONE, }, { .name = "lm_5", .id = LM_5, .base = 0x49000, .len = 0x320,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 258/826 drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit c59afe50773d5c972f6684f9bbd9a2ddb2fb92fa ]
On the MSM8998 platform ther are no LM_3 and LM_4 blocks. Drop them from the MSM8998 catalog.
Patchwork: https://patchwork.freedesktop.org/patch/612585/
--- .../gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h | 12 ------------ 1 file changed, 12 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h +0 -12
@@ -156,18 +156,6 @@ static const struct dpu_lm_cfg msm8998_lm[] = { .sblk = &msm8998_lm_sblk, .lm_pair = LM_5, .pingpong = PINGPONG_2, - }, { - .name = "lm_3", .id = LM_3, - .base = 0x47000, .len = 0x320, - .features = MIXER_MSM8998_MASK, - .sblk = &msm8998_lm_sblk, - .pingpong = PINGPONG_NONE, - }, { - .name = "lm_4", .id = LM_4, - .base = 0x48000, .len = 0x320, - .features = MIXER_MSM8998_MASK, - .sblk = &msm8998_lm_sblk, - .pingpong = PINGPONG_NONE, }, { .name = "lm_5", .id = LM_5, .base = 0x49000, .len = 0x320,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 259/826 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit 0fbc7a5027c6f7f2c785adae3dcec22b2f2b69b3 ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +4 -0
@@ -1837,6 +1837,10 @@ u16 otx2_get_max_mtu(struct otx2_nic *pfvf)if (!rc) { rsp = (struct nix_hw_info *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + rc =PTR_ERR (rsp); + goto out; + }/* HW counts VLAN insertion bytes (8 for double tag) * irrespective of whether SQE is requesting to insert VLAN
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 260/826 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- .../net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +10 -0
@@ -343,6 +343,11 @@ static void otx2_get_pauseparam(struct net_device *netdev,if (!otx2_sync_mbox_msg (&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { +mutex_unlock (&pfvf->mbox.lock); +return ; + } + pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; }
@@ -1072,6 +1077,11 @@ static int otx2_set_fecparam(struct net_device *netdev, rsp = (struct fec_mode *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + err =PTR_ERR (rsp); + goto end; + } +if (rsp->fec >=0 ) pfvf->linfo.fec = rsp->fec;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 261/826 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit bd3110bc102ab6292656b8118be819faa0de8dd0 ]
Adding error pointer check after calling otx2_mbox_get_rsp().
--- .../net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +10 -0
@@ -119,6 +119,8 @@ int otx2_alloc_mcam_entries(struct otx2_nic *pfvf, u16 count) rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) + goto exit;for (ent =0 ; ent < rsp->count; ent++) flow_cfg->flow_ent[ent + allocated] = rsp->entry_list[ent];
@@ -197,6 +199,10 @@ int otx2_mcam_entry_init(struct otx2_nic *pfvf) rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { +mutex_unlock (&pfvf->mbox.lock); +return PTR_ERR (rsp); + }if (rsp->count != req->count) { netdev_info(pfvf->netdev,
@@ -232,6 +238,10 @@ int otx2_mcam_entry_init(struct otx2_nic *pfvf) frsp = (struct npc_get_field_status_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &freq->hdr); +if (IS_ERR (frsp)) { +mutex_unlock (&pfvf->mbox.lock); +return PTR_ERR (frsp); + }if (frsp->enable) { pfvf->flags |=OTX2_FLAG_RX_VLAN_SUPPORT ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 262/826 octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit ac9183023b6a9c09467516abd8aab04f9a2f9564 ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c +5 -0
@@ -203,6 +203,11 @@ int cn10k_alloc_leaf_profile(struct otx2_nic *pfvf, u16 *leaf) rsp = (struct nix_bandprof_alloc_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + rc =PTR_ERR (rsp); + goto out; + } +if (!rsp->prof_count[BAND_PROF_LEAF_LAYER ]) { rc = -EIO ; goto out;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 263/826 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit f5b942e6c54b13246ee49d42dcfb71b7f29e3c64 ]
Add error pointer checks after calling otx2_mbox_get_rsp().
--- .../net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c +9 -0
@@ -28,6 +28,11 @@ static int otx2_dmacflt_do_add(struct otx2_nic *pf, const u8 *mac,if (!err) { rsp = (struct cgx_mac_addr_add_rsp *)otx2_mbox_get_rsp (&pf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { +mutex_unlock (&pf->mbox.lock); +return PTR_ERR (rsp); + } + *dmac_index = rsp->index; }
@@ -200,6 +205,10 @@ int otx2_dmacflt_update(struct otx2_nic *pf, u8 *mac, u32 bit_pos) rsp = (struct cgx_mac_addr_update_rsp *)otx2_mbox_get_rsp (&pf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + rc =PTR_ERR (rsp); + goto out; + } pf->flow_cfg->bmap_to_dmacindex[bit_pos] = rsp->index;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 264/826 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipendra Khadka <[email protected]>
[ Upstream commit 69297b0d3369488af259e3a7cf53d69157938ea1 ]
Add error pointer check after calling otx2_mbox_get_rsp().
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c +5 -0
@@ -315,6 +315,11 @@ int otx2_config_priority_flow_ctrl(struct otx2_nic *pfvf)if (!otx2_sync_mbox_msg (&pfvf->mbox)) { rsp = (struct cgx_pfc_rsp *)otx2_mbox_get_rsp (&pfvf->mbox.mbox,0 , &req->hdr); +if (IS_ERR (rsp)) { + err =PTR_ERR (rsp); + goto unlock; + } +if (req->rx_pause != rsp->rx_pause || req->tx_pause != rsp->tx_pause) {dev_warn (pfvf->dev,"Failed to config PFC\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 265/826 selftests/bpf: fix test_spin_lock_fail.cs global vars usage
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 1b2bfc29695d273492c3dd8512775261f3272686 ]
Global variables of special types (like struct bpf_spin_lock) make underlying ARRAY maps non-mmapable. To make this work with libbpf's mmaping logic, application is expected to declare such special variables as static, so libbpf doesn't even attempt to mmap() such ARRAYs.
test_spin_lock_fail.c didn't follow this rule, but given it relied on this test to trigger failures, this went unnoticed, as we never got to the step of mmap()'ing these ARRAY maps.
It is fragile and relies on specific sequence of libbpf steps, which are an internal implementation details.
Fix the test by marking lockA and lockB as static.
--- tools/testing/selftests/bpf/progs/test_spin_lock_fail.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/progs/test_spin_lock_fail.c +2 -2
@@ -28,8 +28,8 @@ struct { }, }; -SEC(".data.A") struct bpf_spin_lock lockA; -SEC(".data.B") struct bpf_spin_lock lockB; +static struct bpf_spin_lock lockA SEC(".data.A"); +static struct bpf_spin_lock lockB SEC(".data.B"); SEC("?tc")int lock_id_kptr_preserve (void *ctx)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 266/826 libbpf: move global data mmap()ing into bpf_object__load()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 137978f422516a128326df55c0ba23605f925e21 ]
Since BPF skeleton inception libbpf has been doing mmap()'ing of global data ARRAY maps in bpf_object__load_skeleton() API, which is used by code generated .skel.h files (i.e., by BPF skeletons only).
This is wrong because if BPF object is loaded through generic bpf_object__load() API, global data maps won't be re-mmap()'ed after load step, and memory pointers returned from bpf_map__initial_value() would be wrong and won't reflect the actual memory shared between BPF program and user space.
bpf_map__initial_value() return result is rarely used after load, so this went unnoticed for a really long time, until bpftrace project attempted to load BPF object through generic bpf_object__load() API and then used BPF subskeleton instantiated from such bpf_object. It turned out that .data/.rodata/.bss data updates through such subskeleton was "blackholed", all because libbpf wouldn't re-mmap() those maps during bpf_object__load() phase.
Long story short, this step should be done by libbpf regardless of BPF skeleton usage, right after BPF map is created in the kernel. This patch moves this functionality into bpf_object__populate_internal_map() to achieve this. And bpf_object__load_skeleton() is now simple and almost trivial, only propagating these mmap()'ed pointers into user-supplied skeleton structs.
We also do trivial adjustments to error reporting inside bpf_object__populate_internal_map() for consistency with the rest of libbpf's map-handling code.
--- tools/lib/bpf/libbpf.c | 83 ++++++++++++++++++++---------------------- 1 file changed, 40 insertions(+), 43 deletions(-)
tools/lib/bpf/libbpf.c +40 -43
@@ -5094,6 +5094,7 @@ bpf_object__populate_internal_map(struct bpf_object *obj, struct bpf_map *map)enum libbpf_map_type map_type = map->libbpf_type;char *cp, errmsg[STRERR_BUFSIZE ];int err, zero =0 ; +size_t mmap_sz;if (obj->gen_loader) { bpf_gen__map_update_elem(obj->gen_loader, map - obj->maps,
@@ -5107,8 +5108,8 @@ bpf_object__populate_internal_map(struct bpf_object *obj, struct bpf_map *map)if (err) { err = -errno; cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg)); -pr_warn ("Error setting initial map(%s) contents: %s\n" , - map->name, cp); +pr_warn ("map '%s': failed to set initial contents: %s\n" , +bpf_map__name (map), cp);return err; }
@@ -5118,11 +5119,43 @@ bpf_object__populate_internal_map(struct bpf_object *obj, struct bpf_map *map)if (err) { err = -errno; cp =libbpf_strerror_r (err, errmsg,sizeof (errmsg)); -pr_warn ("Error freezing map(%s) as read-only: %s\n" , - map->name, cp); +pr_warn ("map '%s': failed to freeze as read-only: %s\n" , +bpf_map__name (map), cp);return err; } } + +/* Remap anonymous mmap()-ed "map initialization image" as +* a BPF map-backed mmap()-ed memory, but preserving the same +* memory address. This will cause kernel to change process' +* page table to point to a different piece of kernel memory, +* but from userspace point of view memory address (and its +* contents, being identical at this point) will stay the +* same. This mapping will be released by bpf_object__close() +* as per normal clean up procedure. +*/ + mmap_sz =bpf_map_mmap_sz (map); +if (map->def.map_flags &BPF_F_MMAPABLE ) { +void *mmaped; +int prot; + +if (map->def.map_flags &BPF_F_RDONLY_PROG ) + prot =PROT_READ ; +else + prot =PROT_READ |PROT_WRITE ; + mmaped =mmap (map->mmaped, mmap_sz, prot,MAP_SHARED |MAP_FIXED , map->fd,0 ); +if (mmaped ==MAP_FAILED ) { + err = -errno; +pr_warn ("map '%s': failed to re-mmap() contents: %d\n" , +bpf_map__name (map), err); +return err; + } + map->mmaped = mmaped; + }else if (map->mmaped) { +munmap (map->mmaped, mmap_sz); + map->mmaped =NULL ; + } +return 0 ; }
@@ -5439,8 +5472,7 @@ bpf_object__create_maps(struct bpf_object *obj) err =bpf_object__populate_internal_map (obj, map);if (err <0 ) goto err_out; - } -if (map->def.type ==BPF_MAP_TYPE_ARENA ) { + }else if (map->def.type ==BPF_MAP_TYPE_ARENA ) { map->mmaped = mmap((void *)(long)map->map_extra, bpf_map_mmap_sz(map), PROT_READ | PROT_WRITE, map->map_extra ? MAP_SHARED | MAP_FIXED : MAP_SHARED,
@@ -13881,46 +13913,11 @@ int bpf_object__load_skeleton(struct bpf_object_skeleton *s)for (i =0 ; i < s->map_cnt; i++) {struct bpf_map_skeleton *map_skel = (void *)s->maps + i * s->map_skel_sz;struct bpf_map *map = *map_skel->map; -size_t mmap_sz =bpf_map_mmap_sz (map); -int prot, map_fd = map->fd; -void **mmaped = map_skel->mmaped; - -if (!mmaped) -continue ; - -if (!(map->def.map_flags &BPF_F_MMAPABLE )) { - *mmaped =NULL ; -continue ; - } -if (map->def.type ==BPF_MAP_TYPE_ARENA ) { - *mmaped = map->mmaped; +if (!map_skel->mmaped)continue ; - } - -if (map->def.map_flags &BPF_F_RDONLY_PROG ) - prot =PROT_READ ; -else - prot =PROT_READ |PROT_WRITE ; -/* Remap anonymous mmap()-ed "map initialization image" as -* a BPF map-backed mmap()-ed memory, but preserving the same -* memory address. This will cause kernel to change process' -* page table to point to a different piece of kernel memory, -* but from userspace point of view memory address (and its -* contents, being identical at this point) will stay the -* same. This mapping will be released by bpf_object__close() -* as per normal clean up procedure, so we don't need to worry -* about it from skeleton's clean up perspective. -*/ - *mmaped =mmap (map->mmaped, mmap_sz, prot,MAP_SHARED |MAP_FIXED , map_fd,0 ); -if (*mmaped ==MAP_FAILED ) { - err = -errno; - *mmaped =NULL ; -pr_warn ("failed to re-mmap() map '%s': %d\n" , -bpf_map__name (map), err); -return libbpf_err (err); - } + *map_skel->mmaped = map->mmaped; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 267/826 wifi: rtw89: rename rtw89_vif to rtw89_vif_link ahead for MLO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 2f7dae17c48cd1d5616f11d22b3de675db7ab40d ]
This is an intermediate version that is separated from subsequent major MLO changes, so some functions' namings are not really determined here. e.g. struct rtw89_vif_link *vif_to_rtwvif_safe(struct ieee80211_vif *vif)
No logic is changed.
Stable-dep-of: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning")
--- drivers/net/wireless/realtek/rtw89/cam.c | 109 +++-- drivers/net/wireless/realtek/rtw89/cam.h | 16 +- drivers/net/wireless/realtek/rtw89/chan.c | 162 +++---- drivers/net/wireless/realtek/rtw89/chan.h | 4 +- drivers/net/wireless/realtek/rtw89/coex.c | 33 +- drivers/net/wireless/realtek/rtw89/coex.h | 3 +- drivers/net/wireless/realtek/rtw89/core.c | 275 +++++------ drivers/net/wireless/realtek/rtw89/core.h | 72 +-- drivers/net/wireless/realtek/rtw89/debug.c | 17 +- drivers/net/wireless/realtek/rtw89/fw.c | 356 +++++++------- drivers/net/wireless/realtek/rtw89/fw.h | 78 +-- drivers/net/wireless/realtek/rtw89/mac.c | 446 +++++++++--------- drivers/net/wireless/realtek/rtw89/mac.h | 70 +-- drivers/net/wireless/realtek/rtw89/mac80211.c | 207 ++++---- drivers/net/wireless/realtek/rtw89/mac_be.c | 14 +- drivers/net/wireless/realtek/rtw89/phy.c | 74 +-- drivers/net/wireless/realtek/rtw89/phy.h | 2 +- drivers/net/wireless/realtek/rtw89/ps.c | 92 ++-- drivers/net/wireless/realtek/rtw89/ps.h | 10 +- drivers/net/wireless/realtek/rtw89/regd.c | 46 +- drivers/net/wireless/realtek/rtw89/rtw8851b.c | 13 +- drivers/net/wireless/realtek/rtw89/rtw8852a.c | 12 +- drivers/net/wireless/realtek/rtw89/rtw8852b.c | 13 +- .../net/wireless/realtek/rtw89/rtw8852bt.c | 13 +- drivers/net/wireless/realtek/rtw89/rtw8852c.c | 12 +- drivers/net/wireless/realtek/rtw89/rtw8922a.c | 10 +- drivers/net/wireless/realtek/rtw89/ser.c | 36 +- drivers/net/wireless/realtek/rtw89/util.h | 8 +- drivers/net/wireless/realtek/rtw89/wow.c | 125 ++--- drivers/net/wireless/realtek/rtw89/wow.h | 8 +- 30 files changed, 1200 insertions(+), 1136 deletions(-)
drivers/net/wireless/realtek/rtw89/cam.c +57 -52
@@ -218,7 +218,7 @@ static int rtw89_cam_detach_sec_cam(struct rtw89_dev *rtwdev, bool inform_fw) {struct rtw89_sta *rtwsta =sta_to_rtwsta_safe (sta); -struct rtw89_vif *rtwvif; +struct rtw89_vif_link *rtwvif_link;struct rtw89_addr_cam_entry *addr_cam;unsigned int i;int ret =0 ;
@@ -228,8 +228,8 @@ static int rtw89_cam_detach_sec_cam(struct rtw89_dev *rtwdev,return -EINVAL ; } - rtwvif = (struct rtw89_vif *)vif->drv_priv; - addr_cam =rtw89_get_addr_cam_of (rtwvif, rtwsta); + rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; + addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta);for_each_set_bit (i, addr_cam->sec_cam_map,RTW89_SEC_CAM_IN_ADDR_CAM ) {if (addr_cam->sec_ent[i] != sec_cam->sec_cam_idx)
@@ -239,11 +239,11 @@ static int rtw89_cam_detach_sec_cam(struct rtw89_dev *rtwdev, }if (inform_fw) { - ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif, rtwsta); + ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif_link, rtwsta);if (ret)rtw89_err (rtwdev,"failed to update dctl cam del key: %d\n" , ret); - ret =rtw89_fw_h2c_cam (rtwdev, rtwvif, rtwsta,NULL ); + ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta,NULL );if (ret)rtw89_err (rtwdev,"failed to update cam del key: %d\n" , ret); }
@@ -258,7 +258,7 @@ static int rtw89_cam_attach_sec_cam(struct rtw89_dev *rtwdev, struct rtw89_sec_cam_entry *sec_cam) {struct rtw89_sta *rtwsta =sta_to_rtwsta_safe (sta); -struct rtw89_vif *rtwvif; +struct rtw89_vif_link *rtwvif_link;struct rtw89_addr_cam_entry *addr_cam;u8 key_idx =0 ;int ret;
@@ -268,8 +268,8 @@ static int rtw89_cam_attach_sec_cam(struct rtw89_dev *rtwdev,return -EINVAL ; } - rtwvif = (struct rtw89_vif *)vif->drv_priv; - addr_cam =rtw89_get_addr_cam_of (rtwvif, rtwsta); + rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; + addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta);if (key->cipher ==WLAN_CIPHER_SUITE_WEP40 || key->cipher ==WLAN_CIPHER_SUITE_WEP104 )
@@ -285,13 +285,13 @@ static int rtw89_cam_attach_sec_cam(struct rtw89_dev *rtwdev, addr_cam->sec_ent_keyid[key_idx] = key->keyidx; addr_cam->sec_ent[key_idx] = sec_cam->sec_cam_idx;set_bit (key_idx, addr_cam->sec_cam_map); - ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif, rtwsta); + ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif_link, rtwsta);if (ret) {rtw89_err (rtwdev,"failed to update dctl cam sec entry: %d\n" , ret);return ret; } - ret =rtw89_fw_h2c_cam (rtwdev, rtwvif, rtwsta,NULL ); + ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta,NULL );if (ret) {rtw89_err (rtwdev,"failed to update addr cam sec entry: %d\n" , ret);
@@ -485,10 +485,10 @@ void rtw89_cam_deinit_bssid_cam(struct rtw89_dev *rtwdev,clear_bit (bssid_cam->bssid_cam_idx, cam_info->bssid_cam_map); } -void rtw89_cam_deinit (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif) +void rtw89_cam_deinit (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link) { -struct rtw89_addr_cam_entry *addr_cam = &rtwvif->addr_cam; -struct rtw89_bssid_cam_entry *bssid_cam = &rtwvif->bssid_cam; +struct rtw89_addr_cam_entry *addr_cam = &rtwvif_link->addr_cam; +struct rtw89_bssid_cam_entry *bssid_cam = &rtwvif_link->bssid_cam;rtw89_cam_deinit_addr_cam (rtwdev, addr_cam);rtw89_cam_deinit_bssid_cam (rtwdev, bssid_cam);
@@ -593,7 +593,7 @@ static int rtw89_cam_get_avail_bssid_cam(struct rtw89_dev *rtwdev, }int rtw89_cam_init_bssid_cam (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_bssid_cam_entry *bssid_cam,const u8 *bssid) {
@@ -613,7 +613,7 @@ int rtw89_cam_init_bssid_cam(struct rtw89_dev *rtwdev, } bssid_cam->bssid_cam_idx = bssid_cam_idx; - bssid_cam->phy_idx = rtwvif->phy_idx; + bssid_cam->phy_idx = rtwvif_link->phy_idx; bssid_cam->len =BSSID_CAM_ENT_SIZE ; bssid_cam->offset =0 ; bssid_cam->valid = true;
@@ -622,20 +622,21 @@ int rtw89_cam_init_bssid_cam(struct rtw89_dev *rtwdev,return 0 ; } -void rtw89_cam_bssid_changed (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif) +void rtw89_cam_bssid_changed (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link) { -struct rtw89_bssid_cam_entry *bssid_cam = &rtwvif->bssid_cam; +struct rtw89_bssid_cam_entry *bssid_cam = &rtwvif_link->bssid_cam; -ether_addr_copy (bssid_cam->bssid, rtwvif->bssid); +ether_addr_copy (bssid_cam->bssid, rtwvif_link->bssid); } -int rtw89_cam_init (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif) +int rtw89_cam_init (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link) { -struct rtw89_addr_cam_entry *addr_cam = &rtwvif->addr_cam; -struct rtw89_bssid_cam_entry *bssid_cam = &rtwvif->bssid_cam; +struct rtw89_addr_cam_entry *addr_cam = &rtwvif_link->addr_cam; +struct rtw89_bssid_cam_entry *bssid_cam = &rtwvif_link->bssid_cam;int ret; - ret =rtw89_cam_init_bssid_cam (rtwdev, rtwvif, bssid_cam, rtwvif->bssid); + ret =rtw89_cam_init_bssid_cam (rtwdev, rtwvif_link, bssid_cam, + rtwvif_link->bssid);if (ret) {rtw89_err (rtwdev,"failed to init bssid cam\n" );return ret;
@@ -651,11 +652,12 @@ int rtw89_cam_init(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif) }int rtw89_cam_fill_bssid_cam_info (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,u8 *cmd) { -struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif); -struct rtw89_bssid_cam_entry *bssid_cam =rtw89_get_bssid_cam_of (rtwvif, rtwsta); +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link); +struct rtw89_bssid_cam_entry *bssid_cam =rtw89_get_bssid_cam_of (rtwvif_link, + rtwsta);u8 bss_color = vif->bss_conf.he_bss_color.color;u8 bss_mask;
@@ -694,19 +696,20 @@ static u8 rtw89_cam_addr_hash(u8 start, const u8 *addr) }void rtw89_cam_fill_addr_cam_info (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,const u8 *scan_mac_addr,u8 *cmd) { -struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif); -struct rtw89_addr_cam_entry *addr_cam =rtw89_get_addr_cam_of (rtwvif, rtwsta); +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link); +struct rtw89_addr_cam_entry *addr_cam = +rtw89_get_addr_cam_of (rtwvif_link, rtwsta);struct ieee80211_sta *sta =rtwsta_to_sta_safe (rtwsta); -const u8 *sma = scan_mac_addr ? scan_mac_addr : rtwvif->mac_addr; +const u8 *sma = scan_mac_addr ? scan_mac_addr : rtwvif_link->mac_addr;u8 sma_hash, tma_hash, addr_msk_start;u8 sma_start =0 ;u8 tma_start =0 ; -u8 *tma = sta ? sta->addr : rtwvif->bssid; +u8 *tma = sta ? sta->addr : rtwvif_link->bssid;if (addr_cam->addr_mask !=0 ) { addr_msk_start =__ffs (addr_cam->addr_mask);
@@ -723,10 +726,10 @@ void rtw89_cam_fill_addr_cam_info(struct rtw89_dev *rtwdev,FWCMD_SET_ADDR_LEN (cmd, addr_cam->len);FWCMD_SET_ADDR_VALID (cmd, addr_cam->valid); -FWCMD_SET_ADDR_NET_TYPE (cmd, rtwvif->net_type); -FWCMD_SET_ADDR_BCN_HIT_COND (cmd, rtwvif->bcn_hit_cond); -FWCMD_SET_ADDR_HIT_RULE (cmd, rtwvif->hit_rule); -FWCMD_SET_ADDR_BB_SEL (cmd, rtwvif->phy_idx); +FWCMD_SET_ADDR_NET_TYPE (cmd, rtwvif_link->net_type); +FWCMD_SET_ADDR_BCN_HIT_COND (cmd, rtwvif_link->bcn_hit_cond); +FWCMD_SET_ADDR_HIT_RULE (cmd, rtwvif_link->hit_rule); +FWCMD_SET_ADDR_BB_SEL (cmd, rtwvif_link->phy_idx);FWCMD_SET_ADDR_ADDR_MASK (cmd, addr_cam->addr_mask);FWCMD_SET_ADDR_MASK_SEL (cmd, addr_cam->mask_sel);FWCMD_SET_ADDR_SMA_HASH (cmd, sma_hash);
@@ -748,20 +751,20 @@ void rtw89_cam_fill_addr_cam_info(struct rtw89_dev *rtwdev,FWCMD_SET_ADDR_TMA4 (cmd, tma[4 ]);FWCMD_SET_ADDR_TMA5 (cmd, tma[5 ]); -FWCMD_SET_ADDR_PORT_INT (cmd, rtwvif->port); -FWCMD_SET_ADDR_TSF_SYNC (cmd, rtwvif->port); -FWCMD_SET_ADDR_TF_TRS (cmd, rtwvif->trigger); -FWCMD_SET_ADDR_LSIG_TXOP (cmd, rtwvif->lsig_txop); -FWCMD_SET_ADDR_TGT_IND (cmd, rtwvif->tgt_ind); -FWCMD_SET_ADDR_FRM_TGT_IND (cmd, rtwvif->frm_tgt_ind); -FWCMD_SET_ADDR_MACID (cmd, rtwsta ? rtwsta->mac_id : rtwvif->mac_id); -if (rtwvif->net_type ==RTW89_NET_TYPE_INFRA ) +FWCMD_SET_ADDR_PORT_INT (cmd, rtwvif_link->port); +FWCMD_SET_ADDR_TSF_SYNC (cmd, rtwvif_link->port); +FWCMD_SET_ADDR_TF_TRS (cmd, rtwvif_link->trigger); +FWCMD_SET_ADDR_LSIG_TXOP (cmd, rtwvif_link->lsig_txop); +FWCMD_SET_ADDR_TGT_IND (cmd, rtwvif_link->tgt_ind); +FWCMD_SET_ADDR_FRM_TGT_IND (cmd, rtwvif_link->frm_tgt_ind); +FWCMD_SET_ADDR_MACID (cmd, rtwsta ? rtwsta->mac_id : rtwvif_link->mac_id); +if (rtwvif_link->net_type ==RTW89_NET_TYPE_INFRA )FWCMD_SET_ADDR_AID12 (cmd, vif->cfg.aid &0xfff ); -else if (rtwvif->net_type ==RTW89_NET_TYPE_AP_MODE ) +else if (rtwvif_link->net_type ==RTW89_NET_TYPE_AP_MODE )FWCMD_SET_ADDR_AID12 (cmd, sta ? sta->aid &0xfff :0 ); -FWCMD_SET_ADDR_WOL_PATTERN (cmd, rtwvif->wowlan_pattern); -FWCMD_SET_ADDR_WOL_UC (cmd, rtwvif->wowlan_uc); -FWCMD_SET_ADDR_WOL_MAGIC (cmd, rtwvif->wowlan_magic); +FWCMD_SET_ADDR_WOL_PATTERN (cmd, rtwvif_link->wowlan_pattern); +FWCMD_SET_ADDR_WOL_UC (cmd, rtwvif_link->wowlan_uc); +FWCMD_SET_ADDR_WOL_MAGIC (cmd, rtwvif_link->wowlan_magic);FWCMD_SET_ADDR_WAPI (cmd, addr_cam->wapi);FWCMD_SET_ADDR_SEC_ENT_MODE (cmd, addr_cam->sec_ent_mode);FWCMD_SET_ADDR_SEC_ENT0_KEYID (cmd, addr_cam->sec_ent_keyid[0 ]);
@@ -783,15 +786,16 @@ void rtw89_cam_fill_addr_cam_info(struct rtw89_dev *rtwdev, }void rtw89_cam_fill_dctl_sec_cam_info_v1 (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,struct rtw89_h2c_dctlinfo_ud_v1 *h2c) { -struct rtw89_addr_cam_entry *addr_cam =rtw89_get_addr_cam_of (rtwvif, rtwsta); +struct rtw89_addr_cam_entry *addr_cam = +rtw89_get_addr_cam_of (rtwvif_link, rtwsta);struct rtw89_wow_param *rtw_wow = &rtwdev->wow;u8 *ptk_tx_iv = rtw_wow->key_info.ptk_tx_iv; - h2c->c0 =le32_encode_bits (rtwsta ? rtwsta->mac_id : rtwvif->mac_id, + h2c->c0 =le32_encode_bits (rtwsta ? rtwsta->mac_id : rtwvif_link->mac_id,DCTLINFO_V1_C0_MACID ) |le32_encode_bits (1 ,DCTLINFO_V1_C0_OP );
@@ -862,15 +866,16 @@ void rtw89_cam_fill_dctl_sec_cam_info_v1(struct rtw89_dev *rtwdev, }void rtw89_cam_fill_dctl_sec_cam_info_v2 (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,struct rtw89_h2c_dctlinfo_ud_v2 *h2c) { -struct rtw89_addr_cam_entry *addr_cam =rtw89_get_addr_cam_of (rtwvif, rtwsta); +struct rtw89_addr_cam_entry *addr_cam = +rtw89_get_addr_cam_of (rtwvif_link, rtwsta);struct rtw89_wow_param *rtw_wow = &rtwdev->wow;u8 *ptk_tx_iv = rtw_wow->key_info.ptk_tx_iv; - h2c->c0 =le32_encode_bits (rtwsta ? rtwsta->mac_id : rtwvif->mac_id, + h2c->c0 =le32_encode_bits (rtwsta ? rtwsta->mac_id : rtwvif_link->mac_id,DCTLINFO_V2_C0_MACID ) |le32_encode_bits (1 ,DCTLINFO_V2_C0_OP );
drivers/net/wireless/realtek/rtw89/cam.h +8 -8
@@ -526,33 +526,33 @@ struct rtw89_h2c_dctlinfo_ud_v2 {#define DCTLINFO_V2_W12_MLD_TA_BSSID_H_V1 GENMASK(15, 0)#define DCTLINFO_V2_W12_ALL GENMASK(15, 0) -int rtw89_cam_init (struct rtw89_dev *rtwdev,struct rtw89_vif *vif); -void rtw89_cam_deinit (struct rtw89_dev *rtwdev,struct rtw89_vif *vif); +int rtw89_cam_init (struct rtw89_dev *rtwdev,struct rtw89_vif_link *vif); +void rtw89_cam_deinit (struct rtw89_dev *rtwdev,struct rtw89_vif_link *vif);int rtw89_cam_init_addr_cam (struct rtw89_dev *rtwdev,struct rtw89_addr_cam_entry *addr_cam,const struct rtw89_bssid_cam_entry *bssid_cam);void rtw89_cam_deinit_addr_cam (struct rtw89_dev *rtwdev,struct rtw89_addr_cam_entry *addr_cam);int rtw89_cam_init_bssid_cam (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_bssid_cam_entry *bssid_cam,const u8 *bssid);void rtw89_cam_deinit_bssid_cam (struct rtw89_dev *rtwdev,struct rtw89_bssid_cam_entry *bssid_cam);void rtw89_cam_fill_addr_cam_info (struct rtw89_dev *rtwdev, -struct rtw89_vif *vif, +struct rtw89_vif_link *vif,struct rtw89_sta *rtwsta,const u8 *scan_mac_addr,u8 *cmd);void rtw89_cam_fill_dctl_sec_cam_info_v1 (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,struct rtw89_h2c_dctlinfo_ud_v1 *h2c);void rtw89_cam_fill_dctl_sec_cam_info_v2 (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,struct rtw89_h2c_dctlinfo_ud_v2 *h2c);int rtw89_cam_fill_bssid_cam_info (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,u8 *cmd); int rtw89_cam_sec_key_add(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,
@@ -564,6 +564,6 @@ int rtw89_cam_sec_key_del(struct rtw89_dev *rtwdev,struct ieee80211_key_conf *key, bool inform_fw);void rtw89_cam_bssid_changed (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif); +struct rtw89_vif_link *rtwvif_link);void rtw89_cam_reset_keys (struct rtw89_dev *rtwdev);#endif
drivers/net/wireless/realtek/rtw89/chan.c +81 -81
445 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/chan.h +2 -2
@@ -106,10 +106,10 @@ void rtw89_chanctx_ops_change(struct rtw89_dev *rtwdev,struct ieee80211_chanctx_conf *ctx, u32 changed);int rtw89_chanctx_ops_assign_vif (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct ieee80211_chanctx_conf *ctx);void rtw89_chanctx_ops_unassign_vif (struct rtw89_dev *rtwdev, -struct rtw89_vif *rtwvif, +struct rtw89_vif_link *rtwvif_link,struct ieee80211_chanctx_conf *ctx);#endif
drivers/net/wireless/realtek/rtw89/coex.c +17 -16
@@ -4995,12 +4995,12 @@ static void rtw89_tx_time_iter(void *data, struct ieee80211_sta *sta)struct rtw89_txtime_data *iter_data = (struct rtw89_txtime_data *)data;struct rtw89_dev *rtwdev = iter_data->rtwdev; -struct rtw89_vif *rtwvif = rtwsta->rtwvif; +struct rtw89_vif_link *rtwvif_link = rtwsta->rtwvif_link;struct rtw89_btc *btc = &rtwdev->btc;struct rtw89_btc_cx *cx = &btc->cx;struct rtw89_btc_wl_info *wl = &cx->wl;struct rtw89_btc_wl_link_info *plink =NULL ; -u8 port = rtwvif->port; +u8 port = rtwvif_link->port;u32 tx_time = iter_data->tx_time;u8 tx_retry = iter_data->tx_retry;u16 enable = iter_data->enable;
@@ -7481,12 +7481,13 @@ static void _update_bt_info(struct rtw89_dev *rtwdev, u8 *buf, u32 len)_run_coex (rtwdev,BTC_RSN_UPDATE_BT_INFO ); } -void rtw89_btc_ntfy_role_info (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif, +void rtw89_btc_ntfy_role_info (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,enum btc_role_state state) {const struct rtw89_chan *chan =rtw89_chan_get (rtwdev, - rtwvif->chanctx_idx); -struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif); + rtwvif_link->chanctx_idx); +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);struct ieee80211_sta *sta =rtwsta_to_sta (rtwsta);struct rtw89_btc *btc = &rtwdev->btc;const struct rtw89_btc_ver *ver = btc->ver;
@@ -7499,7 +7500,7 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvifrtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], role is STA=%d\n" , vif->type ==NL80211_IFTYPE_STATION ); -rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], port=%d\n" , rtwvif->port); +rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], port=%d\n" , rtwvif_link->port);rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], band=%d ch=%d bw=%d\n" , chan->band_type, chan->channel, chan->band_width); rtw89_debug(rtwdev, RTW89_DBG_BTC, "[BTC], associated=%d\n",
@@ -7527,15 +7528,15 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif r.mode = mode; } -if (rtwvif->wifi_role >=RTW89_WIFI_ROLE_MLME_MAX ) +if (rtwvif_link->wifi_role >=RTW89_WIFI_ROLE_MLME_MAX )return ;rtw89_debug (rtwdev,RTW89_DBG_BTC , -"[BTC], wifi_role=%d\n" , rtwvif->wifi_role); +"[BTC], wifi_role=%d\n" , rtwvif_link->wifi_role); - r.role = rtwvif->wifi_role; - r.phy = rtwvif->phy_idx; - r.pid = rtwvif->port; + r.role = rtwvif_link->wifi_role; + r.phy = rtwvif_link->phy_idx; + r.pid = rtwvif_link->port; r.active = true; r.connected =MLME_LINKED ; r.bcn_period = vif->bss_conf.beacon_int;
@@ -7547,7 +7548,7 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif r.chdef.center_ch = chan->channel; r.chdef.bw = chan->band_width; r.chdef.chan = chan->primary_channel; -ether_addr_copy (r.mac_addr, rtwvif->mac_addr); +ether_addr_copy (r.mac_addr, rtwvif_link->mac_addr);if (rtwsta && vif->type ==NL80211_IFTYPE_STATION ) r.mac_id = rtwsta->mac_id;
@@ -7793,14 +7794,14 @@ static void rtw89_btc_ntfy_wl_sta_iter(void *data, struct ieee80211_sta *sta)struct rtw89_btc_wl_link_info *link_info =NULL ;struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv;struct rtw89_traffic_stats *link_info_t =NULL ; -struct rtw89_vif *rtwvif = rtwsta->rtwvif; -struct rtw89_traffic_stats *stats = &rtwvif->stats; +struct rtw89_vif_link *rtwvif_link = rtwsta->rtwvif_link; +struct rtw89_traffic_stats *stats = &rtwvif_link->stats;const struct rtw89_chip_info *chip = rtwdev->chip;struct rtw89_btc_wl_role_info *r;struct rtw89_btc_wl_role_info_v1 *r1;u32 last_tx_rate, last_rx_rate;u16 last_tx_lvl, last_rx_lvl; -u8 port = rtwvif->port; +u8 port = rtwvif_link->port;u8 rssi;u8 busy =0 ;u8 dir =0 ;
@@ -7812,7 +7813,7 @@ static void rtw89_btc_ntfy_wl_sta_iter(void *data, struct ieee80211_sta *sta)rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], rssi=%d\n" , rssi); link_info = &wl->link_info[port]; - link_info->stat.traffic = rtwvif->stats; + link_info->stat.traffic = rtwvif_link->stats; link_info_t = &link_info->stat.traffic;if (link_info->connected ==MLME_NO_LINK ) {
drivers/net/wireless/realtek/rtw89/coex.h +2 -1
@@ -271,7 +271,8 @@ void rtw89_btc_ntfy_eapol_packet_work(struct work_struct *work);void rtw89_btc_ntfy_arp_packet_work (struct work_struct *work);void rtw89_btc_ntfy_dhcp_packet_work (struct work_struct *work);void rtw89_btc_ntfy_icmp_packet_work (struct work_struct *work); -void rtw89_btc_ntfy_role_info (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif, +void rtw89_btc_ntfy_role_info (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link,struct rtw89_sta *rtwsta,enum btc_role_state state);void rtw89_btc_ntfy_radio_state (struct rtw89_dev *rtwdev,enum btc_rfctrl rf_state); void rtw89_btc_ntfy_wl_rfk(struct rtw89_dev *rtwdev, u8 phy_map,
drivers/net/wireless/realtek/rtw89/core.c +140 -135
725 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/core.h +36 -36
218 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/debug.c +9 -8
@@ -3740,21 +3740,22 @@ static void rtw89_dump_pkt_offload(struct seq_file *m, struct list_head *pkt_lisstatic void rtw89_vif_ids_get_iter (void *data,u8 *mac,struct ieee80211_vif *vif) { -struct rtw89_vif *rtwvif = (struct rtw89_vif *)vif->drv_priv; -struct rtw89_dev *rtwdev = rtwvif->rtwdev; +struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; +struct rtw89_dev *rtwdev = rtwvif_link->rtwdev;struct seq_file *m = (struct seq_file *)data; -struct rtw89_bssid_cam_entry *bssid_cam = &rtwvif->bssid_cam; +struct rtw89_bssid_cam_entry *bssid_cam = &rtwvif_link->bssid_cam; -seq_printf (m,"VIF [%d] %pM\n" , rtwvif->mac_id, rtwvif->mac_addr); +seq_printf (m,"VIF [%d] %pM\n" , rtwvif_link->mac_id, rtwvif_link->mac_addr);seq_printf (m,"\tbssid_cam_idx=%u\n" , bssid_cam->bssid_cam_idx); -rtw89_dump_addr_cam (m, rtwdev, &rtwvif->addr_cam); -rtw89_dump_pkt_offload (m, &rtwvif->general_pkt_list,"\tpkt_ofld[GENERAL]: " ); +rtw89_dump_addr_cam (m, rtwdev, &rtwvif_link->addr_cam); +rtw89_dump_pkt_offload (m, &rtwvif_link->general_pkt_list, +"\tpkt_ofld[GENERAL]: " ); }static void rtw89_dump_ba_cam (struct seq_file *m,struct rtw89_sta *rtwsta) { -struct rtw89_vif *rtwvif = rtwsta->rtwvif; -struct rtw89_dev *rtwdev = rtwvif->rtwdev; +struct rtw89_vif_link *rtwvif_link = rtwsta->rtwvif_link; +struct rtw89_dev *rtwdev = rtwvif_link->rtwdev;struct rtw89_ba_cam_entry *entry;bool first = true;
drivers/net/wireless/realtek/rtw89/fw.c +181 -175
1,077 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/fw.h +40 -38
101 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac.c +230 -216
446 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac.h +39 -31
70 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac80211.c +104 -103
207 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac_be.c +7 -7
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/phy.c +37 -37
74 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/phy.h +1 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/ps.c +48 -44
92 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/ps.h +5 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/regd.c +23 -23
46 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/rtw8851b.c +8 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/rtw8852a.c +7 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/rtw8852b.c +8 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/rtw8852bt.c +8 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/rtw8852c.c +7 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/rtw8922a.c +6 -4
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/ser.c +18 -18
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/util.h +4 -4
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/wow.c +63 -62
125 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/wow.h +4 -4
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Signature · 1 line
2.43.0
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 268/826 wifi: rtw89: rename rtw89_sta to rtw89_sta_link ahead for MLO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 9ee282193440527a20c9b40d47db8abaa73ecd49 ]
This is an intermediate version that is separated from subsequent major MLO changes, so some functions' namings are not really determined here. e.g. struct rtw89_sta_link *sta_to_rtwsta_safe(struct ieee80211_sta *sta)
No logic is changed.
Stable-dep-of: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning")
--- drivers/net/wireless/realtek/rtw89/cam.c | 43 ++-- drivers/net/wireless/realtek/rtw89/cam.h | 8 +- drivers/net/wireless/realtek/rtw89/chan.c | 6 +- drivers/net/wireless/realtek/rtw89/coex.c | 57 +++--- drivers/net/wireless/realtek/rtw89/coex.h | 3 +- drivers/net/wireless/realtek/rtw89/core.c | 193 +++++++++--------- drivers/net/wireless/realtek/rtw89/core.h | 48 ++--- drivers/net/wireless/realtek/rtw89/debug.c | 50 ++--- drivers/net/wireless/realtek/rtw89/fw.c | 102 ++++----- drivers/net/wireless/realtek/rtw89/fw.h | 36 ++-- drivers/net/wireless/realtek/rtw89/mac.c | 60 +++--- drivers/net/wireless/realtek/rtw89/mac.h | 8 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 39 ++-- drivers/net/wireless/realtek/rtw89/phy.c | 80 ++++---- drivers/net/wireless/realtek/rtw89/ser.c | 10 +- drivers/net/wireless/realtek/rtw89/wow.c | 20 +- 16 files changed, 392 insertions(+), 371 deletions(-)
drivers/net/wireless/realtek/rtw89/cam.c +23 -20
@@ -217,7 +217,7 @@ static int rtw89_cam_detach_sec_cam(struct rtw89_dev *rtwdev, const struct rtw89_sec_cam_entry *sec_cam, bool inform_fw) { -struct rtw89_sta *rtwsta =sta_to_rtwsta_safe (sta); +struct rtw89_sta_link *rtwsta_link =sta_to_rtwsta_safe (sta);struct rtw89_vif_link *rtwvif_link;struct rtw89_addr_cam_entry *addr_cam;unsigned int i;
@@ -229,7 +229,7 @@ static int rtw89_cam_detach_sec_cam(struct rtw89_dev *rtwdev, } rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; - addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta); + addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link);for_each_set_bit (i, addr_cam->sec_cam_map,RTW89_SEC_CAM_IN_ADDR_CAM ) {if (addr_cam->sec_ent[i] != sec_cam->sec_cam_idx)
@@ -239,11 +239,11 @@ static int rtw89_cam_detach_sec_cam(struct rtw89_dev *rtwdev, }if (inform_fw) { - ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif_link, rtwsta); + ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif_link, rtwsta_link);if (ret)rtw89_err (rtwdev,"failed to update dctl cam del key: %d\n" , ret); - ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta,NULL ); + ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta_link,NULL );if (ret)rtw89_err (rtwdev,"failed to update cam del key: %d\n" , ret); }
@@ -257,7 +257,7 @@ static int rtw89_cam_attach_sec_cam(struct rtw89_dev *rtwdev,struct ieee80211_key_conf *key, struct rtw89_sec_cam_entry *sec_cam) { - struct rtw89_sta *rtwsta = sta_to_rtwsta_safe(sta); + struct rtw89_sta_link *rtwsta_link = sta_to_rtwsta_safe(sta);struct rtw89_vif_link *rtwvif_link;struct rtw89_addr_cam_entry *addr_cam;u8 key_idx =0 ;
@@ -269,7 +269,7 @@ static int rtw89_cam_attach_sec_cam(struct rtw89_dev *rtwdev, } rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; - addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta); + addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link);if (key->cipher ==WLAN_CIPHER_SUITE_WEP40 || key->cipher ==WLAN_CIPHER_SUITE_WEP104 )
@@ -285,13 +285,13 @@ static int rtw89_cam_attach_sec_cam(struct rtw89_dev *rtwdev, addr_cam->sec_ent_keyid[key_idx] = key->keyidx; addr_cam->sec_ent[key_idx] = sec_cam->sec_cam_idx;set_bit (key_idx, addr_cam->sec_cam_map); - ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif_link, rtwsta); + ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif_link, rtwsta_link);if (ret) {rtw89_err (rtwdev,"failed to update dctl cam sec entry: %d\n" , ret);return ret; } - ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta,NULL ); + ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta_link,NULL );if (ret) {rtw89_err (rtwdev,"failed to update addr cam sec entry: %d\n" , ret);
@@ -653,11 +653,11 @@ int rtw89_cam_init(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link)int rtw89_cam_fill_bssid_cam_info (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta,u8 *cmd) +struct rtw89_sta_link *rtwsta_link,u8 *cmd) {struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);struct rtw89_bssid_cam_entry *bssid_cam =rtw89_get_bssid_cam_of (rtwvif_link, - rtwsta); + rtwsta_link);u8 bss_color = vif->bss_conf.he_bss_color.color;u8 bss_mask;
@@ -697,14 +697,14 @@ static u8 rtw89_cam_addr_hash(u8 start, const u8 *addr)void rtw89_cam_fill_addr_cam_info (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta, +struct rtw89_sta_link *rtwsta_link,const u8 *scan_mac_addr,u8 *cmd) {struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);struct rtw89_addr_cam_entry *addr_cam = -rtw89_get_addr_cam_of (rtwvif_link, rtwsta); -struct ieee80211_sta *sta =rtwsta_to_sta_safe (rtwsta); +rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link); +struct ieee80211_sta *sta =rtwsta_to_sta_safe (rtwsta_link);const u8 *sma = scan_mac_addr ? scan_mac_addr : rtwvif_link->mac_addr;u8 sma_hash, tma_hash, addr_msk_start;u8 sma_start =0 ;
@@ -757,7 +757,8 @@ void rtw89_cam_fill_addr_cam_info(struct rtw89_dev *rtwdev,FWCMD_SET_ADDR_LSIG_TXOP (cmd, rtwvif_link->lsig_txop);FWCMD_SET_ADDR_TGT_IND (cmd, rtwvif_link->tgt_ind);FWCMD_SET_ADDR_FRM_TGT_IND (cmd, rtwvif_link->frm_tgt_ind); -FWCMD_SET_ADDR_MACID (cmd, rtwsta ? rtwsta->mac_id : rtwvif_link->mac_id); +FWCMD_SET_ADDR_MACID (cmd, rtwsta_link ? rtwsta_link->mac_id : + rtwvif_link->mac_id);if (rtwvif_link->net_type ==RTW89_NET_TYPE_INFRA )FWCMD_SET_ADDR_AID12 (cmd, vif->cfg.aid &0xfff );else if (rtwvif_link->net_type ==RTW89_NET_TYPE_AP_MODE )
@@ -787,15 +788,16 @@ void rtw89_cam_fill_addr_cam_info(struct rtw89_dev *rtwdev,void rtw89_cam_fill_dctl_sec_cam_info_v1 (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta, +struct rtw89_sta_link *rtwsta_link,struct rtw89_h2c_dctlinfo_ud_v1 *h2c) {struct rtw89_addr_cam_entry *addr_cam = -rtw89_get_addr_cam_of (rtwvif_link, rtwsta); +rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link);struct rtw89_wow_param *rtw_wow = &rtwdev->wow;u8 *ptk_tx_iv = rtw_wow->key_info.ptk_tx_iv; - h2c->c0 =le32_encode_bits (rtwsta ? rtwsta->mac_id : rtwvif_link->mac_id, + h2c->c0 =le32_encode_bits (rtwsta_link ? rtwsta_link->mac_id : + rtwvif_link->mac_id,DCTLINFO_V1_C0_MACID ) |le32_encode_bits (1 ,DCTLINFO_V1_C0_OP );
@@ -867,15 +869,16 @@ void rtw89_cam_fill_dctl_sec_cam_info_v1(struct rtw89_dev *rtwdev,void rtw89_cam_fill_dctl_sec_cam_info_v2 (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta, +struct rtw89_sta_link *rtwsta_link,struct rtw89_h2c_dctlinfo_ud_v2 *h2c) {struct rtw89_addr_cam_entry *addr_cam = -rtw89_get_addr_cam_of (rtwvif_link, rtwsta); +rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link);struct rtw89_wow_param *rtw_wow = &rtwdev->wow;u8 *ptk_tx_iv = rtw_wow->key_info.ptk_tx_iv; - h2c->c0 =le32_encode_bits (rtwsta ? rtwsta->mac_id : rtwvif_link->mac_id, + h2c->c0 =le32_encode_bits (rtwsta_link ? rtwsta_link->mac_id : + rtwvif_link->mac_id,DCTLINFO_V2_C0_MACID ) |le32_encode_bits (1 ,DCTLINFO_V2_C0_OP );
drivers/net/wireless/realtek/rtw89/cam.h +4 -4
@@ -541,19 +541,19 @@ void rtw89_cam_deinit_bssid_cam(struct rtw89_dev *rtwdev, struct rtw89_bssid_cam_entry *bssid_cam);void rtw89_cam_fill_addr_cam_info (struct rtw89_dev *rtwdev,struct rtw89_vif_link *vif, -struct rtw89_sta *rtwsta, +struct rtw89_sta_link *rtwsta_link,const u8 *scan_mac_addr,u8 *cmd);void rtw89_cam_fill_dctl_sec_cam_info_v1 (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta, +struct rtw89_sta_link *rtwsta_link,struct rtw89_h2c_dctlinfo_ud_v1 *h2c);void rtw89_cam_fill_dctl_sec_cam_info_v2 (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta, +struct rtw89_sta_link *rtwsta_link,struct rtw89_h2c_dctlinfo_ud_v2 *h2c);int rtw89_cam_fill_bssid_cam_info (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta,u8 *cmd); +struct rtw89_sta_link *rtwsta_link,u8 *cmd); int rtw89_cam_sec_key_add(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, struct ieee80211_sta *sta,
drivers/net/wireless/realtek/rtw89/chan.c +3 -3
@@ -522,15 +522,15 @@ u32 rtw89_mcc_role_fw_macid_bitmap_to_u32(struct rtw89_mcc_role *mcc_role)static void rtw89_mcc_role_macid_sta_iter (void *data,struct ieee80211_sta *sta) { -struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; -struct rtw89_vif_link *rtwvif_link = rtwsta->rtwvif_link; +struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct rtw89_vif_link *rtwvif_link = rtwsta_link->rtwvif_link;struct rtw89_mcc_role *mcc_role = data;struct rtw89_vif_link *target = mcc_role->rtwvif_link;if (rtwvif_link != target)return ; -rtw89_mcc_role_fw_macid_bitmap_set_bit (mcc_role, rtwsta->mac_id); +rtw89_mcc_role_fw_macid_bitmap_set_bit (mcc_role, rtwsta_link->mac_id); } static void rtw89_mcc_fill_role_macid_bitmap(struct rtw89_dev *rtwdev,
drivers/net/wireless/realtek/rtw89/coex.c +29 -28
147 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/coex.h +2 -1
@@ -273,7 +273,8 @@ void rtw89_btc_ntfy_dhcp_packet_work(struct work_struct *work);void rtw89_btc_ntfy_icmp_packet_work (struct work_struct *work);void rtw89_btc_ntfy_role_info (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta,enum btc_role_state state); +struct rtw89_sta_link *rtwsta_link, +enum btc_role_state state);void rtw89_btc_ntfy_radio_state (struct rtw89_dev *rtwdev,enum btc_rfctrl rf_state); void rtw89_btc_ntfy_wl_rfk(struct rtw89_dev *rtwdev, u8 phy_map, enum btc_wl_rfk_type type,
drivers/net/wireless/realtek/rtw89/core.c +100 -93
518 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/core.h +25 -23
121 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/debug.c +25 -25
115 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/fw.c +53 -49
299 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/fw.h +18 -18
@@ -4405,13 +4405,13 @@ void rtw89_h2c_pkt_set_hdr(struct rtw89_dev *rtwdev, struct sk_buff *skb, bool rack, bool dack, u32 len);int rtw89_fw_h2c_default_cmac_tbl (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta); +struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_default_cmac_tbl_g7 (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta); +struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_default_dmac_tbl_v2 (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta); +struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_assoc_cmac_tbl (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif,struct ieee80211_sta *sta);
@@ -4422,29 +4422,29 @@ int rtw89_fw_h2c_ampdu_cmac_tbl_g7(struct rtw89_dev *rtwdev,struct ieee80211_vif *vif, struct ieee80211_sta *sta);int rtw89_fw_h2c_txtime_cmac_tbl (struct rtw89_dev *rtwdev, -struct rtw89_sta *rtwsta); +struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_txpath_cmac_tbl (struct rtw89_dev *rtwdev, -struct rtw89_sta *rtwsta); +struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_update_beacon (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link);int rtw89_fw_h2c_update_beacon_be (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link);int rtw89_fw_h2c_cam (struct rtw89_dev *rtwdev,struct rtw89_vif_link *vif, -struct rtw89_sta *rtwsta,const u8 *scan_mac_addr); +struct rtw89_sta_link *rtwsta_link,const u8 *scan_mac_addr);int rtw89_fw_h2c_dctl_sec_cam_v1 (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta); +struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_dctl_sec_cam_v2 (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta); +struct rtw89_sta_link *rtwsta_link);void rtw89_fw_c2h_irqsafe (struct rtw89_dev *rtwdev,struct sk_buff *c2h);void rtw89_fw_c2h_work (struct work_struct *work);int rtw89_fw_h2c_role_maintain (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta, +struct rtw89_sta_link *rtwsta_link,enum rtw89_upd_mode upd_mode);int rtw89_fw_h2c_join_info (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta,bool dis_conn); +struct rtw89_sta_link *rtwsta_link,bool dis_conn);int rtw89_fw_h2c_notify_dbcc (struct rtw89_dev *rtwdev,bool en);int rtw89_fw_h2c_macid_pause (struct rtw89_dev *rtwdev,u8 sh,u8 grp,bool pause);
@@ -4514,9 +4514,9 @@ void rtw89_fw_release_general_pkt_list_vif(struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, bool notify_fw);void rtw89_fw_release_general_pkt_list (struct rtw89_dev *rtwdev,bool notify_fw); -int rtw89_fw_h2c_ba_cam (struct rtw89_dev *rtwdev,struct rtw89_sta *rtwsta, +int rtw89_fw_h2c_ba_cam (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link,bool valid,struct ieee80211_ampdu_params *params); -int rtw89_fw_h2c_ba_cam_v1 (struct rtw89_dev *rtwdev,struct rtw89_sta *rtwsta, +int rtw89_fw_h2c_ba_cam_v1 (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link,bool valid,struct ieee80211_ampdu_params *params);void rtw89_fw_h2c_init_dynamic_ba_cam_v0_ext (struct rtw89_dev *rtwdev); int rtw89_fw_h2c_init_ba_cam_users(struct rtw89_dev *rtwdev, u8 users,
@@ -4624,21 +4624,21 @@ static inline void rtw89_fw_h2c_init_ba_cam(struct rtw89_dev *rtwdev)static inline int rtw89_chip_h2c_default_cmac_tbl (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta) +struct rtw89_sta_link *rtwsta_link) {const struct rtw89_chip_info *chip = rtwdev->chip; -return chip->ops->h2c_default_cmac_tbl (rtwdev, rtwvif_link, rtwsta); +return chip->ops->h2c_default_cmac_tbl (rtwdev, rtwvif_link, rtwsta_link); }static inline int rtw89_chip_h2c_default_dmac_tbl (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, -struct rtw89_sta *rtwsta) +struct rtw89_sta_link *rtwsta_link) {const struct rtw89_chip_info *chip = rtwdev->chip;if (chip->ops->h2c_default_dmac_tbl) -return chip->ops->h2c_default_dmac_tbl (rtwdev, rtwvif_link, rtwsta); +return chip->ops->h2c_default_dmac_tbl (rtwdev, rtwvif_link, rtwsta_link);return 0 ; }
@@ -4673,12 +4673,12 @@ static inline int rtw89_chip_h2c_ampdu_cmac_tbl(struct rtw89_dev *rtwdev, }static inline -int rtw89_chip_h2c_ba_cam (struct rtw89_dev *rtwdev,struct rtw89_sta *rtwsta, +int rtw89_chip_h2c_ba_cam (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link,bool valid,struct ieee80211_ampdu_params *params) {const struct rtw89_chip_info *chip = rtwdev->chip; -return chip->ops->h2c_ba_cam (rtwdev, rtwsta, valid, params); +return chip->ops->h2c_ba_cam (rtwdev, rtwsta_link, valid, params); }/* must consider compatibility; don't insert new in the mid */
drivers/net/wireless/realtek/rtw89/mac.c +30 -30
146 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac.h +4 -4
@@ -1384,15 +1384,15 @@ static inline bool rtw89_mac_get_power_state(struct rtw89_dev *rtwdev)return !!val; } -int rtw89_mac_set_tx_time (struct rtw89_dev *rtwdev,struct rtw89_sta *rtwsta, +int rtw89_mac_set_tx_time (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link,bool resume,u32 tx_time); -int rtw89_mac_get_tx_time (struct rtw89_dev *rtwdev,struct rtw89_sta *rtwsta, +int rtw89_mac_get_tx_time (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link,u32 *tx_time);int rtw89_mac_set_tx_retry_limit (struct rtw89_dev *rtwdev, -struct rtw89_sta *rtwsta, +struct rtw89_sta_link *rtwsta_link,bool resume,u8 tx_retry);int rtw89_mac_get_tx_retry_limit (struct rtw89_dev *rtwdev, -struct rtw89_sta *rtwsta,u8 *tx_retry); +struct rtw89_sta_link *rtwsta_link,u8 *tx_retry);enum rtw89_mac_xtal_si_offset {XTAL0 =0x0 ,
drivers/net/wireless/realtek/rtw89/mac80211.c +20 -19
@@ -29,10 +29,11 @@ static void rtw89_ops_tx(struct ieee80211_hw *hw,int ret, qsel;if (rtwvif_link->offchan && !(flags &IEEE80211_TX_CTL_TX_OFFCHAN ) && sta) { -struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; +struct rtw89_sta_link *rtwsta_link = + (struct rtw89_sta_link *)sta->drv_priv;rtw89_debug (rtwdev,RTW89_DBG_TXRX ,"ops_tx during offchan\n" ); -skb_queue_tail (&rtwsta->roc_queue, skb); +skb_queue_tail (&rtwsta_link->roc_queue, skb);return ; }
@@ -548,8 +549,8 @@ static int rtw89_ops_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta, bool set) {struct rtw89_dev *rtwdev = hw->priv; -struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; -struct rtw89_vif_link *rtwvif_link = rtwsta->rtwvif_link; +struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct rtw89_vif_link *rtwvif_link = rtwsta_link->rtwvif_link;ieee80211_queue_work (rtwdev->hw, &rtwvif_link->update_beacon_work);
@@ -668,7 +669,7 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw, {struct rtw89_dev *rtwdev = hw->priv;struct ieee80211_sta *sta = params->sta; -struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; +struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv;u16 tid = params->tid;struct ieee80211_txq *txq = sta->txq[tid];struct rtw89_txq *rtwtxq = (struct rtw89_txq *)txq->drv_priv;
@@ -681,7 +682,7 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT :mutex_lock (&rtwdev->mutex);clear_bit (RTW89_TXQ_F_AMPDU , &rtwtxq->flags); -clear_bit (tid, rtwsta->ampdu_map); +clear_bit (tid, rtwsta_link->ampdu_map);rtw89_chip_h2c_ampdu_cmac_tbl (rtwdev, vif, sta);mutex_unlock (&rtwdev->mutex);ieee80211_stop_tx_ba_cb_irqsafe (vif, sta->addr, tid);
@@ -689,21 +690,21 @@ static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,case IEEE80211_AMPDU_TX_OPERATIONAL :mutex_lock (&rtwdev->mutex);set_bit (RTW89_TXQ_F_AMPDU , &rtwtxq->flags); - rtwsta->ampdu_params[tid].agg_num = params->buf_size; - rtwsta->ampdu_params[tid].amsdu = params->amsdu; -set_bit (tid, rtwsta->ampdu_map); + rtwsta_link->ampdu_params[tid].agg_num = params->buf_size; + rtwsta_link->ampdu_params[tid].amsdu = params->amsdu; +set_bit (tid, rtwsta_link->ampdu_map);rtw89_leave_ps_mode (rtwdev);rtw89_chip_h2c_ampdu_cmac_tbl (rtwdev, vif, sta);mutex_unlock (&rtwdev->mutex);break ;case IEEE80211_AMPDU_RX_START :mutex_lock (&rtwdev->mutex); -rtw89_chip_h2c_ba_cam (rtwdev, rtwsta, true, params); +rtw89_chip_h2c_ba_cam (rtwdev, rtwsta_link, true, params);mutex_unlock (&rtwdev->mutex);break ;case IEEE80211_AMPDU_RX_STOP :mutex_lock (&rtwdev->mutex); -rtw89_chip_h2c_ba_cam (rtwdev, rtwsta, false, params); +rtw89_chip_h2c_ba_cam (rtwdev, rtwsta_link, false, params);mutex_unlock (&rtwdev->mutex);break ;default :
@@ -732,9 +733,9 @@ static void rtw89_ops_sta_statistics(struct ieee80211_hw *hw,struct ieee80211_sta *sta, struct station_info *sinfo) { - struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; + struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; - sinfo->txrate = rtwsta->ra_report.txrate; + sinfo->txrate = rtwsta_link->ra_report.txrate; sinfo->filled |=BIT_ULL (NL80211_STA_INFO_TX_BITRATE ); }
@@ -778,14 +779,14 @@ struct rtw89_iter_bitrate_mask_data {static void rtw89_ra_mask_info_update_iter (void *data,struct ieee80211_sta *sta) {struct rtw89_iter_bitrate_mask_data *br_data = data; -struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; -struct ieee80211_vif *vif =rtwvif_to_vif (rtwsta->rtwvif_link); +struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif (rtwsta_link->rtwvif_link);if (vif != br_data->vif || vif->p2p)return ; - rtwsta->use_cfg_mask = true; - rtwsta->mask = *br_data->mask; + rtwsta_link->use_cfg_mask = true; + rtwsta_link->mask = *br_data->mask;rtw89_phy_ra_update_sta (br_data->rtwdev, sta,IEEE80211_RC_SUPP_RATES_CHANGED ); }
@@ -1054,8 +1055,8 @@ static int rtw89_ops_cancel_remain_on_channel(struct ieee80211_hw *hw,static void rtw89_set_tid_config_iter (void *data,struct ieee80211_sta *sta) {struct cfg80211_tid_config *tid_config = data; -struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; -struct rtw89_dev *rtwdev = rtwsta->rtwvif_link->rtwdev; +struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct rtw89_dev *rtwdev = rtwsta_link->rtwvif_link->rtwdev;rtw89_core_set_tid_config (rtwdev, sta, tid_config); }
drivers/net/wireless/realtek/rtw89/phy.c +41 -39
205 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/ser.c +5 -5
@@ -309,19 +309,19 @@ static void ser_reset_vif(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvistatic void ser_sta_deinit_cam_iter (void *data,struct ieee80211_sta *sta) {struct rtw89_vif_link *target_rtwvif = (struct rtw89_vif_link *)data; -struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; -struct rtw89_vif_link *rtwvif_link = rtwsta->rtwvif_link; +struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct rtw89_vif_link *rtwvif_link = rtwsta_link->rtwvif_link;struct rtw89_dev *rtwdev = rtwvif_link->rtwdev;if (rtwvif_link != target_rtwvif)return ;if (rtwvif_link->net_type ==RTW89_NET_TYPE_AP_MODE || sta->tdls) -rtw89_cam_deinit_addr_cam (rtwdev, &rtwsta->addr_cam); +rtw89_cam_deinit_addr_cam (rtwdev, &rtwsta_link->addr_cam);if (sta->tdls) -rtw89_cam_deinit_bssid_cam (rtwdev, &rtwsta->bssid_cam); +rtw89_cam_deinit_bssid_cam (rtwdev, &rtwsta_link->bssid_cam); -INIT_LIST_HEAD (&rtwsta->ba_cam_list); +INIT_LIST_HEAD (&rtwsta_link->ba_cam_list); }static void ser_deinit_cam (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link)
drivers/net/wireless/realtek/rtw89/wow.c +10 -10
@@ -1123,12 +1123,12 @@ static int rtw89_wow_cfg_wake(struct rtw89_dev *rtwdev, bool wow)struct ieee80211_vif *wow_vif = rtw_wow->wow_vif;struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)wow_vif->drv_priv;struct ieee80211_sta *wow_sta; -struct rtw89_sta *rtwsta =NULL ; +struct rtw89_sta_link *rtwsta_link =NULL ;int ret; wow_sta =ieee80211_find_sta (wow_vif, rtwvif_link->bssid);if (wow_sta) - rtwsta = (struct rtw89_sta *)wow_sta->drv_priv; + rtwsta_link = (struct rtw89_sta_link *)wow_sta->drv_priv;if (wow) {if (rtw_wow->pattern_cnt)
@@ -1147,7 +1147,7 @@ static int rtw89_wow_cfg_wake(struct rtw89_dev *rtwdev, bool wow) }if (wow) { - ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif_link, rtwsta); + ret =rtw89_chip_h2c_dctl_sec_cam (rtwdev, rtwvif_link, rtwsta_link);if (ret) {rtw89_err (rtwdev,"failed to update dctl cam sec entry: %d\n" , ret);
@@ -1155,7 +1155,7 @@ static int rtw89_wow_cfg_wake(struct rtw89_dev *rtwdev, bool wow) } } - ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta,NULL ); + ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta_link,NULL );if (ret) {rtw89_warn (rtwdev,"failed to send h2c cam\n" );return ret;
@@ -1198,7 +1198,7 @@ static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)bool include_bb = !!chip->bbmcu_nr;bool disable_intr_for_dlfw = false;struct ieee80211_sta *wow_sta; -struct rtw89_sta *rtwsta =NULL ; +struct rtw89_sta_link *rtwsta_link =NULL ;bool is_conn = true;int ret;
@@ -1207,7 +1207,7 @@ static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow) wow_sta =ieee80211_find_sta (wow_vif, rtwvif_link->bssid);if (wow_sta) - rtwsta = (struct rtw89_sta *)wow_sta->drv_priv; + rtwsta_link = (struct rtw89_sta_link *)wow_sta->drv_priv;else is_conn = false;
@@ -1225,7 +1225,7 @@ static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)rtw89_phy_init_rf_reg (rtwdev, true); - ret =rtw89_fw_h2c_role_maintain (rtwdev, rtwvif_link, rtwsta, + ret =rtw89_fw_h2c_role_maintain (rtwdev, rtwvif_link, rtwsta_link,RTW89_ROLE_FW_RESTORE );if (ret) {rtw89_warn (rtwdev,"failed to send h2c role maintain\n" );
@@ -1241,20 +1241,20 @@ static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)if (!is_conn)rtw89_cam_reset_keys (rtwdev); - ret =rtw89_fw_h2c_join_info (rtwdev, rtwvif_link, rtwsta, !is_conn); + ret =rtw89_fw_h2c_join_info (rtwdev, rtwvif_link, rtwsta_link, !is_conn);if (ret) {rtw89_warn (rtwdev,"failed to send h2c join info\n" );return ret; } - ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta,NULL ); + ret =rtw89_fw_h2c_cam (rtwdev, rtwvif_link, rtwsta_link,NULL );if (ret) {rtw89_warn (rtwdev,"failed to send h2c cam\n" );return ret; }if (is_conn) { - ret =rtw89_fw_h2c_general_pkt (rtwdev, rtwvif_link, rtwsta->mac_id); + ret =rtw89_fw_h2c_general_pkt (rtwdev, rtwvif_link, rtwsta_link->mac_id);if (ret) {rtw89_warn (rtwdev,"failed to send h2c general packet\n" );return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 269/826 wifi: rtw89: read bss_conf corresponding to the link
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 89bac818bbd2ccced29d4b888ba1a4cf3e1ede4e ]
Tweak code to not always access vif->bss_conf directly. Instead, according to link_id, read target bss_conf from vif->link_conf[].
For now, rtwvif_link->link_id keeps 0. When driver starts to support MLO, the link_id will be assigned.
Stable-dep-of: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning")
--- drivers/net/wireless/realtek/rtw89/cam.c | 13 ++- drivers/net/wireless/realtek/rtw89/chan.c | 22 ++++- drivers/net/wireless/realtek/rtw89/coex.c | 17 +++- drivers/net/wireless/realtek/rtw89/core.c | 98 +++++++++++++++---- drivers/net/wireless/realtek/rtw89/core.h | 52 +++++++--- drivers/net/wireless/realtek/rtw89/fw.c | 96 ++++++++++++------ drivers/net/wireless/realtek/rtw89/fw.h | 4 +- drivers/net/wireless/realtek/rtw89/mac.c | 66 ++++++++++--- drivers/net/wireless/realtek/rtw89/mac80211.c | 24 ++++- drivers/net/wireless/realtek/rtw89/phy.c | 13 ++- drivers/net/wireless/realtek/rtw89/ps.c | 24 +++-- drivers/net/wireless/realtek/rtw89/ps.h | 4 +- drivers/net/wireless/realtek/rtw89/regd.c | 19 +++- drivers/net/wireless/realtek/rtw89/wow.c | 12 ++- 14 files changed, 355 insertions(+), 109 deletions(-)
drivers/net/wireless/realtek/rtw89/cam.c +10 -3
@@ -655,17 +655,24 @@ int rtw89_cam_fill_bssid_cam_info(struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, struct rtw89_sta_link *rtwsta_link, u8 *cmd) { - struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif_link); struct rtw89_bssid_cam_entry *bssid_cam = rtw89_get_bssid_cam_of(rtwvif_link, rtwsta_link); -u8 bss_color = vif->bss_conf.he_bss_color.color; +struct ieee80211_bss_conf *bss_conf; +u8 bss_color;u8 bss_mask; -if (vif->bss_conf.nontransmitted) +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, false); + bss_color = bss_conf->he_bss_color.color; + +if (bss_conf->nontransmitted) bss_mask =RTW89_BSSID_MATCH_5_BYTES ;else bss_mask =RTW89_BSSID_MATCH_ALL ; +rcu_read_unlock (); +FWCMD_SET_ADDR_BSSID_IDX (cmd, bssid_cam->bssid_cam_idx);FWCMD_SET_ADDR_BSSID_OFFSET (cmd, bssid_cam->offset);FWCMD_SET_ADDR_BSSID_LEN (cmd, bssid_cam->len);
drivers/net/wireless/realtek/rtw89/chan.c +18 -4
@@ -564,8 +564,9 @@ static void rtw89_mcc_fill_role_policy(struct rtw89_dev *rtwdev,static void rtw89_mcc_fill_role_limit (struct rtw89_dev *rtwdev,struct rtw89_mcc_role *mcc_role) { -struct ieee80211_vif *vif =rtwvif_to_vif (mcc_role->rtwvif_link); +struct rtw89_vif_link *rtwvif_link = mcc_role->rtwvif_link;struct ieee80211_p2p_noa_desc *noa_desc; +struct ieee80211_bss_conf *bss_conf;u32 bcn_intvl_us =ieee80211_tu_to_usec (mcc_role->beacon_interval);u32 max_toa_us, max_tob_us, max_dur_us;u32 start_time, interval, duration;
@@ -576,13 +577,18 @@ static void rtw89_mcc_fill_role_limit(struct rtw89_dev *rtwdev,if (!mcc_role->is_go && !mcc_role->is_gc)return ; +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, true); +/* find the first periodic NoA */ for (i =0 ; i <RTW89_P2P_MAX_NOA_NUM ; i++) { - noa_desc = &vif->bss_conf.p2p_noa_attr.desc[i]; + noa_desc = &bss_conf->p2p_noa_attr.desc[i];if (noa_desc->count ==255 ) goto fill; } +rcu_read_unlock ();return ; fill:
@@ -590,6 +596,8 @@ static void rtw89_mcc_fill_role_limit(struct rtw89_dev *rtwdev, interval =le32_to_cpu (noa_desc->interval); duration =le32_to_cpu (noa_desc->duration); +rcu_read_unlock (); +if (interval != bcn_intvl_us) { rtw89_debug(rtwdev, RTW89_DBG_CHAN, "MCC role limit: mismatch interval: %d vs. %d\n",
@@ -635,12 +643,18 @@ static int rtw89_mcc_fill_role(struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, struct rtw89_mcc_role *role) { - struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif_link); + struct ieee80211_bss_conf *bss_conf;const struct rtw89_chan *chan;memset (role,0 ,sizeof (*role)); role->rtwvif_link = rtwvif_link; - role->beacon_interval = vif->bss_conf.beacon_int; + +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, true); + role->beacon_interval = bss_conf->beacon_int; + +rcu_read_unlock ();if (!role->beacon_interval) { rtw89_warn(rtwdev,
drivers/net/wireless/realtek/rtw89/coex.c +13 -4
@@ -7490,6 +7490,7 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, rtwvif_link->chanctx_idx);struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);struct ieee80211_sta *sta =rtwsta_to_sta (rtwsta_link); +struct ieee80211_bss_conf *bss_conf;struct rtw89_btc *btc = &rtwdev->btc;const struct rtw89_btc_ver *ver = btc->ver;struct rtw89_btc_wl_info *wl = &btc->cx.wl;
@@ -7497,6 +7498,10 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev,struct rtw89_btc_wl_link_info *wlinfo =NULL ;u8 mode =0 , rlink_id, link_mode_ori, pta_req_mac_ori, wa_type; +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, false); +rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], state=%d\n" , state); rtw89_debug(rtwdev, RTW89_DBG_BTC, "[BTC], role is STA=%d\n",
@@ -7508,7 +7513,7 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, state == BTC_ROLE_MSTS_STA_CONN_END);rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], bcn_period=%d dtim_period=%d\n" , - vif->bss_conf.beacon_int, vif->bss_conf.dtim_period); + bss_conf->beacon_int, bss_conf->dtim_period);if (rtwsta_link) { rtw89_debug(rtwdev, RTW89_DBG_BTC, "[BTC], STA mac_id=%d\n",
@@ -7529,8 +7534,10 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, r.mode = mode; } -if (rtwvif_link->wifi_role >=RTW89_WIFI_ROLE_MLME_MAX ) +if (rtwvif_link->wifi_role >=RTW89_WIFI_ROLE_MLME_MAX ) { +rcu_read_unlock ();return ; + }rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], wifi_role=%d\n" , rtwvif_link->wifi_role);
@@ -7540,8 +7547,8 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, r.pid = rtwvif_link->port; r.active = true; r.connected =MLME_LINKED ; - r.bcn_period = vif->bss_conf.beacon_int; - r.dtim_period = vif->bss_conf.dtim_period; + r.bcn_period = bss_conf->beacon_int; + r.dtim_period = bss_conf->dtim_period; r.band = chan->band_type; r.ch = chan->channel; r.bw = chan->band_width;
@@ -7551,6 +7558,8 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, r.chdef.chan = chan->primary_channel;ether_addr_copy (r.mac_addr, rtwvif_link->mac_addr); +rcu_read_unlock (); +if (rtwsta_link && vif->type ==NL80211_IFTYPE_STATION ) r.mac_id = rtwsta_link->mac_id;
drivers/net/wireless/realtek/rtw89/core.c +81 -17
209 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/core.h +37 -15
82 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/fw.c +66 -30
209 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/fw.h +3 -1
@@ -4553,7 +4553,9 @@ int rtw89_pno_scan_add_chan_list_be(struct rtw89_dev *rtwdev,int rtw89_fw_h2c_trigger_cpu_exception (struct rtw89_dev *rtwdev);int rtw89_fw_h2c_pkt_drop (struct rtw89_dev *rtwdev,const struct rtw89_pkt_drop_params *params); -int rtw89_fw_h2c_p2p_act (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif, +int rtw89_fw_h2c_p2p_act (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct ieee80211_bss_conf *bss_conf,struct ieee80211_p2p_noa_desc *desc,u8 act,u8 noa_id); int rtw89_fw_h2c_tsf32_toggle(struct rtw89_dev *rtwdev,
drivers/net/wireless/realtek/rtw89/mac.c +55 -11
128 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac80211.c +19 -5
@@ -111,6 +111,7 @@ static int rtw89_ops_add_interface(struct ieee80211_hw *hw, {struct rtw89_dev *rtwdev = hw->priv;struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; +struct ieee80211_bss_conf *bss_conf;int ret =0 ; rtw89_debug(rtwdev, RTW89_DBG_STATE, "add vif %pM type %d, p2p %d\n",
@@ -151,7 +152,14 @@ static int rtw89_ops_add_interface(struct ieee80211_hw *hw, rtwvif_link->chanctx_assigned = false; rtwvif_link->hit_rule =0 ; rtwvif_link->reg_6ghz_power =RTW89_REG_6GHZ_POWER_DFLT ; -ether_addr_copy (rtwvif_link->mac_addr, vif->addr); + +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, true); +ether_addr_copy (rtwvif_link->mac_addr, bss_conf->addr); + +rcu_read_unlock (); +INIT_LIST_HEAD (&rtwvif_link->general_pkt_list); ret =rtw89_mac_add_vif (rtwdev, rtwvif_link);
@@ -314,13 +322,19 @@ static const u8 ac_to_fw_idx[IEEE80211_NUM_ACS] = {static u8 rtw89_aifsn_to_aifs (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link,u8 aifsn) { -struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);const struct rtw89_chan *chan =rtw89_chan_get (rtwdev, rtwvif_link->chanctx_idx); +struct ieee80211_bss_conf *bss_conf;u8 slot_time;u8 sifs; - slot_time = vif->bss_conf.use_short_slot ?9 :20 ; +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, true); + slot_time = bss_conf->use_short_slot ?9 :20 ; + +rcu_read_unlock (); + sifs = chan->band_type ==RTW89_BAND_2G ?10 :16 ;return aifsn * slot_time + sifs;
@@ -486,7 +500,7 @@ static void rtw89_ops_link_info_changed(struct ieee80211_hw *hw,rtw89_mac_bf_set_gid_table (rtwdev, vif, conf);if (changed &BSS_CHANGED_P2P_PS ) -rtw89_core_update_p2p_ps (rtwdev, vif); +rtw89_core_update_p2p_ps (rtwdev, rtwvif_link, conf);if (changed &BSS_CHANGED_CQM )rtw89_fw_h2c_set_bcn_fltr_cfg (rtwdev, vif, true);
@@ -516,7 +530,7 @@ static int rtw89_ops_start_ap(struct ieee80211_hw *hw,if (rtwdev->scanning)rtw89_hw_scan_abort (rtwdev, rtwdev->scan_info.scanning_vif); -ether_addr_copy (rtwvif_link->bssid, vif->bss_conf.bssid); +ether_addr_copy (rtwvif_link->bssid, link_conf->bssid);rtw89_cam_bssid_changed (rtwdev, rtwvif_link);rtw89_mac_port_update (rtwdev, rtwvif_link);rtw89_chip_h2c_assoc_cmac_tbl (rtwdev, vif,NULL );
drivers/net/wireless/realtek/rtw89/phy.c +11 -2
@@ -6006,15 +6006,24 @@ void rtw89_phy_dm_init(struct rtw89_dev *rtwdev)void rtw89_phy_set_bss_color (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif) { +struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv;const struct rtw89_chip_info *chip = rtwdev->chip;const struct rtw89_reg_def *bss_clr_vld = &chip->bss_clr_vld;enum rtw89_phy_idx phy_idx =RTW89_PHY_0 ; +struct ieee80211_bss_conf *bss_conf;u8 bss_color; -if (!vif->bss_conf.he_support || !vif->cfg.assoc) +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, true); +if (!bss_conf->he_support || !vif->cfg.assoc) { +rcu_read_unlock ();return ; + } + + bss_color = bss_conf->he_bss_color.color; - bss_color = vif->bss_conf.he_bss_color.color; +rcu_read_unlock ();rtw89_phy_write32_idx (rtwdev, bss_clr_vld->addr, bss_clr_vld->mask,0x1 , phy_idx);
drivers/net/wireless/realtek/rtw89/ps.c +14 -10
@@ -214,9 +214,9 @@ static void rtw89_tsf32_toggle(struct rtw89_dev *rtwdev, }static void rtw89_p2p_disable_all_noa (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif) +struct rtw89_vif_link *rtwvif_link, +struct ieee80211_bss_conf *bss_conf) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv;enum rtw89_p2pps_action act;u8 noa_id;
@@ -229,20 +229,21 @@ static void rtw89_p2p_disable_all_noa(struct rtw89_dev *rtwdev,else act =RTW89_P2P_ACT_REMOVE ;rtw89_tsf32_toggle (rtwdev, rtwvif_link, act); -rtw89_fw_h2c_p2p_act (rtwdev, vif,NULL , act, noa_id); +rtw89_fw_h2c_p2p_act (rtwdev, rtwvif_link, bss_conf, +NULL , act, noa_id); } }static void rtw89_p2p_update_noa (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif) +struct rtw89_vif_link *rtwvif_link, +struct ieee80211_bss_conf *bss_conf) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv;struct ieee80211_p2p_noa_desc *desc;enum rtw89_p2pps_action act;u8 noa_id;for (noa_id =0 ; noa_id <RTW89_P2P_MAX_NOA_NUM ; noa_id++) { - desc = &vif->bss_conf.p2p_noa_attr.desc[noa_id]; + desc = &bss_conf->p2p_noa_attr.desc[noa_id];if (!desc->count || !desc->duration)break ;
@@ -251,15 +252,18 @@ static void rtw89_p2p_update_noa(struct rtw89_dev *rtwdev,else act =RTW89_P2P_ACT_UPDATE ;rtw89_tsf32_toggle (rtwdev, rtwvif_link, act); -rtw89_fw_h2c_p2p_act (rtwdev, vif, desc, act, noa_id); +rtw89_fw_h2c_p2p_act (rtwdev, rtwvif_link, bss_conf, + desc, act, noa_id); } rtwvif_link->last_noa_nr = noa_id; } -void rtw89_process_p2p_ps (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif) +void rtw89_process_p2p_ps (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct ieee80211_bss_conf *bss_conf) { -rtw89_p2p_disable_all_noa (rtwdev, vif); -rtw89_p2p_update_noa (rtwdev, vif); +rtw89_p2p_disable_all_noa (rtwdev, rtwvif_link, bss_conf); +rtw89_p2p_update_noa (rtwdev, rtwvif_link, bss_conf); }void rtw89_recalc_lps (struct rtw89_dev *rtwdev)
drivers/net/wireless/realtek/rtw89/ps.h +3 -1
@@ -14,7 +14,9 @@ void rtw89_leave_ps_mode(struct rtw89_dev *rtwdev);void rtw89_enter_ips (struct rtw89_dev *rtwdev);void rtw89_leave_ips (struct rtw89_dev *rtwdev);void rtw89_set_coex_ctrl_lps (struct rtw89_dev *rtwdev,bool btc_ctrl); -void rtw89_process_p2p_ps (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif); +void rtw89_process_p2p_ps (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct ieee80211_bss_conf *bss_conf);void rtw89_recalc_lps (struct rtw89_dev *rtwdev);void rtw89_p2p_noa_renew (struct rtw89_vif_link *rtwvif_link); void rtw89_p2p_noa_append(struct rtw89_vif_link *rtwvif_link,
drivers/net/wireless/realtek/rtw89/regd.c +15 -4
@@ -834,16 +834,21 @@ static int rtw89_reg_6ghz_tpe_recalc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link, bool active, unsigned int *changed) { - struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif_link); -struct ieee80211_bss_conf *bss_conf = &vif->bss_conf; struct rtw89_reg_6ghz_tpe *tpe = &rtwvif_link->reg_6ghz_tpe; +struct ieee80211_bss_conf *bss_conf;memset (tpe,0 ,sizeof (*tpe));if (!active || rtwvif_link->reg_6ghz_power !=RTW89_REG_6GHZ_POWER_STD ) goto bottom; +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, true);rtw89_calculate_tpe (rtwdev, tpe, &bss_conf->tpe); + +rcu_read_unlock (); +if (!tpe->valid) goto bottom;
@@ -911,10 +916,14 @@ static int rtw89_reg_6ghz_power_recalc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link, bool active, unsigned int *changed) { - struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif_link); + struct ieee80211_bss_conf *bss_conf; + +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, true);if (active) { -switch (vif->bss_conf.power_type) { +switch (bss_conf->power_type) {case IEEE80211_REG_VLP_AP : rtwvif_link->reg_6ghz_power =RTW89_REG_6GHZ_POWER_VLP ;break ;
@@ -932,6 +941,8 @@ static int rtw89_reg_6ghz_power_recalc(struct rtw89_dev *rtwdev, rtwvif_link->reg_6ghz_power =RTW89_REG_6GHZ_POWER_DFLT ; } +rcu_read_unlock (); + *changed +=__rtw89_reg_6ghz_power_recalc (rtwdev);return 0 ; }
drivers/net/wireless/realtek/rtw89/wow.c +10 -2
@@ -633,10 +633,12 @@ static struct ieee80211_key_conf *rtw89_wow_gtk_rekey(struct rtw89_dev *rtwdev,static void rtw89_wow_update_key_info (struct rtw89_dev *rtwdev,bool rx_ready) {struct ieee80211_vif *wow_vif = rtwdev->wow.wow_vif; +struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)wow_vif->drv_priv;struct rtw89_wow_param *rtw_wow = &rtwdev->wow;struct rtw89_wow_aoac_report *aoac_rpt = &rtw_wow->aoac_rpt;struct rtw89_set_key_info_iter_data data = {.error = false, .rx_ready = rx_ready}; +struct ieee80211_bss_conf *bss_conf;struct ieee80211_key_conf *key;rcu_read_lock ();
@@ -669,9 +671,15 @@ static void rtw89_wow_update_key_info(struct rtw89_dev *rtwdev, bool rx_ready)return ;rtw89_rx_pn_set_pmf (rtwdev, key, aoac_rpt->igtk_ipn); -ieee80211_gtk_rekey_notify (wow_vif, wow_vif->bss_conf.bssid, + +rcu_read_lock (); + + bss_conf =rtw89_vif_rcu_dereference_link (rtwvif_link, true); +ieee80211_gtk_rekey_notify (wow_vif, bss_conf->bssid, aoac_rpt->eapol_key_replay_count, -GFP_KERNEL ); +GFP_ATOMIC ); + +rcu_read_unlock (); }static void rtw89_wow_leave_deep_ps (struct rtw89_dev *rtwdev)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 270/826 wifi: rtw89: read link_sta corresponding to the link
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 04911c0fe874bb44e8ee0f5896a5a10c37a14cf2 ]
Tweak code to not always access sta->deflink directly. Instead, according to link_id, read target link_sta from sta->link[].
For now, rtwsta_link->link_id keeps 0. When driver starts to support MLO, the link_id will be assigned.
Stable-dep-of: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning")
--- drivers/net/wireless/realtek/rtw89/cam.c | 14 +- drivers/net/wireless/realtek/rtw89/coex.c | 16 +- drivers/net/wireless/realtek/rtw89/core.c | 53 ++++++- drivers/net/wireless/realtek/rtw89/core.h | 43 +++++- drivers/net/wireless/realtek/rtw89/debug.c | 21 ++- drivers/net/wireless/realtek/rtw89/fw.c | 97 +++++++----- drivers/net/wireless/realtek/rtw89/mac.c | 61 ++++++-- drivers/net/wireless/realtek/rtw89/mac_be.c | 45 ++++-- drivers/net/wireless/realtek/rtw89/phy.c | 154 ++++++++++++-------- 9 files changed, 362 insertions(+), 142 deletions(-)
drivers/net/wireless/realtek/rtw89/cam.c +13 -1
@@ -712,11 +712,21 @@ void rtw89_cam_fill_addr_cam_info(struct rtw89_dev *rtwdev,struct rtw89_addr_cam_entry *addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link);struct ieee80211_sta *sta =rtwsta_to_sta_safe (rtwsta_link); +struct ieee80211_link_sta *link_sta;const u8 *sma = scan_mac_addr ? scan_mac_addr : rtwvif_link->mac_addr;u8 sma_hash, tma_hash, addr_msk_start;u8 sma_start =0 ;u8 tma_start =0 ; -u8 *tma = sta ? sta->addr : rtwvif_link->bssid; +const u8 *tma; + +rcu_read_lock (); + +if (sta) { + link_sta =rtw89_sta_rcu_dereference_link (rtwsta_link, true); + tma = link_sta->addr; + }else { + tma = rtwvif_link->bssid; + }if (addr_cam->addr_mask !=0 ) { addr_msk_start =__ffs (addr_cam->addr_mask);
@@ -791,6 +801,8 @@ void rtw89_cam_fill_addr_cam_info(struct rtw89_dev *rtwdev,FWCMD_SET_ADDR_SEC_ENT4 (cmd, addr_cam->sec_ent[4 ]);FWCMD_SET_ADDR_SEC_ENT5 (cmd, addr_cam->sec_ent[5 ]);FWCMD_SET_ADDR_SEC_ENT6 (cmd, addr_cam->sec_ent[6 ]); + +rcu_read_unlock (); } void rtw89_cam_fill_dctl_sec_cam_info_v1(struct rtw89_dev *rtwdev,
drivers/net/wireless/realtek/rtw89/coex.c +9 -7
@@ -7489,8 +7489,8 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev,const struct rtw89_chan *chan =rtw89_chan_get (rtwdev, rtwvif_link->chanctx_idx);struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link); -struct ieee80211_sta *sta =rtwsta_to_sta (rtwsta_link);struct ieee80211_bss_conf *bss_conf; +struct ieee80211_link_sta *link_sta;struct rtw89_btc *btc = &rtwdev->btc;const struct rtw89_btc_ver *ver = btc->ver;struct rtw89_btc_wl_info *wl = &btc->cx.wl;
@@ -7516,19 +7516,21 @@ void rtw89_btc_ntfy_role_info(struct rtw89_dev *rtwdev, bss_conf->beacon_int, bss_conf->dtim_period);if (rtwsta_link) { + link_sta =rtw89_sta_rcu_dereference_link (rtwsta_link, false); +rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], STA mac_id=%d\n" , rtwsta_link->mac_id);rtw89_debug (rtwdev,RTW89_DBG_BTC ,"[BTC], STA support HE=%d VHT=%d HT=%d\n" , - sta->deflink.he_cap.has_he, - sta->deflink.vht_cap.vht_supported, - sta->deflink.ht_cap.ht_supported); -if (sta->deflink.he_cap.has_he) + link_sta->he_cap.has_he, + link_sta->vht_cap.vht_supported, + link_sta->ht_cap.ht_supported); +if (link_sta->he_cap.has_he) mode |=BIT (BTC_WL_MODE_HE ); -if (sta->deflink.vht_cap.vht_supported) +if (link_sta->vht_cap.vht_supported) mode |=BIT (BTC_WL_MODE_VHT ); -if (sta->deflink.ht_cap.ht_supported) +if (link_sta->ht_cap.ht_supported) mode |=BIT (BTC_WL_MODE_HT ); r.mode = mode;
drivers/net/wireless/realtek/rtw89/core.c +47 -6
113 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/core.h +38 -5
63 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/debug.c +19 -2
@@ -3526,11 +3526,20 @@ static void rtw89_sta_info_get_iter(void *data, struct ieee80211_sta *sta)struct rtw89_hal *hal = &rtwdev->hal;u8 ant_num = hal->ant_diversity ?2 : rtwdev->chip->rf_path_num;bool ant_asterisk = hal->tx_path_diversity || hal->ant_diversity; +struct ieee80211_link_sta *link_sta;u8 evm_min, evm_max, evm_1ss; +u16 max_rc_amsdu_len;u8 rssi;u8 snr;int i; +rcu_read_lock (); + + link_sta =rtw89_sta_rcu_dereference_link (rtwsta_link, true); + max_rc_amsdu_len = link_sta->agg.max_rc_amsdu_len; + +rcu_read_unlock (); +seq_printf (m,"TX rate [%d]: " , rtwsta_link->mac_id);if (rate->flags &RATE_INFO_FLAGS_MCS )
@@ -3553,7 +3562,7 @@ static void rtw89_sta_info_get_iter(void *data, struct ieee80211_sta *sta)seq_printf (m," BW:%u" ,rtw89_rate_info_bw_to_mhz (rate->bw));seq_printf (m,"\t(hw_rate=0x%x)" , rtwsta_link->ra_report.hw_rate);seq_printf (m,"\t==> agg_wait=%d (%d)\n" , rtwsta_link->max_agg_wait, - sta->deflink.agg.max_rc_amsdu_len); + max_rc_amsdu_len);seq_printf (m,"RX rate [%d]: " , rtwsta_link->mac_id);
@@ -3777,9 +3786,17 @@ static void rtw89_sta_ids_get_iter(void *data, struct ieee80211_sta *sta)struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv;struct rtw89_dev *rtwdev = rtwsta_link->rtwdev;struct seq_file *m = (struct seq_file *)data; +struct ieee80211_link_sta *link_sta; + +rcu_read_lock (); -seq_printf (m,"STA [%d] %pM %s\n" , rtwsta_link->mac_id, sta->addr, + link_sta =rtw89_sta_rcu_dereference_link (rtwsta_link, true); + +seq_printf (m,"STA [%d] %pM %s\n" , rtwsta_link->mac_id, link_sta->addr, sta->tdls ?"(TDLS)" :"" ); + +rcu_read_unlock (); +rtw89_dump_addr_cam (m, rtwdev, &rtwsta_link->addr_cam);rtw89_dump_ba_cam (m, rtwsta_link); }
drivers/net/wireless/realtek/rtw89/fw.c +59 -38
223 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac.c +48 -13
136 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac_be.c +35 -10
103 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/phy.c +94 -60
309 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 271/826 wifi: rtw89: refactor VIF related func ahead for MLO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 26d460e13f84426fa7dd2c0c369676034c206161 ]
Refactor VIF related functions, e.g. add/remove/assoc/mapping to separate most link stuffs into sub-functions for MLO reuse.
Stable-dep-of: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning")
--- drivers/net/wireless/realtek/rtw89/core.c | 10 +- drivers/net/wireless/realtek/rtw89/core.h | 4 +- drivers/net/wireless/realtek/rtw89/mac.c | 28 +--- drivers/net/wireless/realtek/rtw89/mac.h | 2 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 137 ++++++++++++------ drivers/net/wireless/realtek/rtw89/phy.c | 5 +- drivers/net/wireless/realtek/rtw89/phy.h | 3 +- drivers/net/wireless/realtek/rtw89/wow.c | 4 +- 8 files changed, 112 insertions(+), 81 deletions(-)
drivers/net/wireless/realtek/rtw89/core.c +5 -5
@@ -3466,9 +3466,9 @@ int rtw89_core_release_sta_ba_entry(struct rtw89_dev *rtwdev, case NL80211_IFTYPE_ ## _type: \ rtwvif_link->wifi_role = RTW89_WIFI_ROLE_ ## _type; \ break -void rtw89_vif_type_mapping(struct ieee80211_vif *vif, bool assoc) +void rtw89_vif_type_mapping(struct rtw89_vif_link *rtwvif_link, bool assoc) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; +const struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);const struct ieee80211_bss_conf *bss_conf;switch (vif->type) {
@@ -3638,7 +3638,7 @@ int rtw89_core_sta_disconnect(struct rtw89_dev *rtwdev,rtw89_cam_deinit_bssid_cam (rtwdev, &rtwsta_link->bssid_cam);if (vif->type ==NL80211_IFTYPE_STATION && !sta->tdls) { -rtw89_vif_type_mapping (vif, false); +rtw89_vif_type_mapping (rtwvif_link, false);rtw89_fw_release_general_pkt_list_vif (rtwdev, rtwvif_link, true); }
@@ -4785,9 +4785,9 @@ int rtw89_chip_info_setup(struct rtw89_dev *rtwdev)EXPORT_SYMBOL (rtw89_chip_info_setup);void rtw89_chip_cfg_txpwr_ul_tb_offset (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif) +struct rtw89_vif_link *rtwvif_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);const struct rtw89_chip_info *chip = rtwdev->chip;struct ieee80211_bss_conf *bss_conf;
drivers/net/wireless/realtek/rtw89/core.h +2 -2
@@ -6702,10 +6702,10 @@ int rtw89_core_acquire_sta_ba_entry(struct rtw89_dev *rtwdev,int rtw89_core_release_sta_ba_entry (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link,u8 tid,u8 *cam_idx); -void rtw89_vif_type_mapping (struct ieee80211_vif *vif,bool assoc); +void rtw89_vif_type_mapping (struct rtw89_vif_link *rtwvif_link,bool assoc);int rtw89_chip_info_setup (struct rtw89_dev *rtwdev);void rtw89_chip_cfg_txpwr_ul_tb_offset (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif); +struct rtw89_vif_link *rtwvif_link);bool rtw89_ra_report_to_bitrate (struct rtw89_dev *rtwdev,u8 rpt_rate,u16 *bitrate);int rtw89_regd_setup (struct rtw89_dev *rtwdev); int rtw89_regd_init(struct rtw89_dev *rtwdev,
drivers/net/wireless/realtek/rtw89/mac.c +4 -24
@@ -4697,9 +4697,9 @@ static void rtw89_mac_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy, }void rtw89_mac_set_he_obss_narrow_bw_ru (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif) +struct rtw89_vif_link *rtwvif_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif_safe (rtwvif_link);const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;struct ieee80211_hw *hw = rtwdev->hw;struct ieee80211_bss_conf *bss_conf;
@@ -4742,32 +4742,12 @@ void rtw89_mac_stop_ap(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_lint rtw89_mac_add_vif (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link) { -int ret; - - rtwvif_link->mac_id =rtw89_acquire_mac_id (rtwdev); -if (rtwvif_link->mac_id ==RTW89_MAX_MAC_ID_NUM ) -return -ENOSPC ; - - ret =rtw89_mac_vif_init (rtwdev, rtwvif_link); -if (ret) - goto release_mac_id; - -return 0 ; - -release_mac_id: -rtw89_release_mac_id (rtwdev, rtwvif_link->mac_id); - -return ret; +return rtw89_mac_vif_init (rtwdev, rtwvif_link); }int rtw89_mac_remove_vif (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link) { -int ret; - - ret =rtw89_mac_vif_deinit (rtwdev, rtwvif_link); -rtw89_release_mac_id (rtwdev, rtwvif_link->mac_id); - -return ret; +return rtw89_mac_vif_deinit (rtwdev, rtwvif_link); } static void
drivers/net/wireless/realtek/rtw89/mac.h +1 -1
@@ -1158,7 +1158,7 @@ int rtw89_mac_port_get_tsf(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvvoid rtw89_mac_port_cfg_rx_sync (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link,bool en);void rtw89_mac_set_he_obss_narrow_bw_ru (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif); +struct rtw89_vif_link *rtwvif_link);void rtw89_mac_stop_ap (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link);void rtw89_mac_enable_beacon_for_ap_vifs (struct rtw89_dev *rtwdev,bool en);int rtw89_mac_remove_vif (struct rtw89_dev *rtwdev,struct rtw89_vif_link *vif);
drivers/net/wireless/realtek/rtw89/mac80211.c +93 -44
206 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/phy.c +3 -2
@@ -6038,9 +6038,10 @@ void rtw89_phy_dm_init(struct rtw89_dev *rtwdev)rtw89_chip_cfg_txrx_path (rtwdev); } -void rtw89_phy_set_bss_color (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif) +void rtw89_phy_set_bss_color (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);const struct rtw89_chip_info *chip = rtwdev->chip;const struct rtw89_reg_def *bss_clr_vld = &chip->bss_clr_vld;enum rtw89_phy_idx phy_idx =RTW89_PHY_0 ;
drivers/net/wireless/realtek/rtw89/phy.h +2 -1
@@ -953,7 +953,8 @@ void rtw89_phy_antdiv_parse(struct rtw89_dev *rtwdev, struct rtw89_rx_phy_ppdu *phy_ppdu);void rtw89_phy_antdiv_track (struct rtw89_dev *rtwdev);void rtw89_phy_antdiv_work (struct work_struct *work); -void rtw89_phy_set_bss_color (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif); +void rtw89_phy_set_bss_color (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link);void rtw89_phy_tssi_ctrl_set_bandedge_cfg (struct rtw89_dev *rtwdev,enum rtw89_mac_idx mac_idx,enum rtw89_tssi_bandedge_cfg bandedge_cfg);
drivers/net/wireless/realtek/rtw89/wow.c +2 -2
@@ -1268,8 +1268,8 @@ static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)return ret; }rtw89_phy_ra_assoc (rtwdev, wow_sta); -rtw89_phy_set_bss_color (rtwdev, wow_vif); -rtw89_chip_cfg_txpwr_ul_tb_offset (rtwdev, wow_vif); +rtw89_phy_set_bss_color (rtwdev, rtwvif_link); +rtw89_chip_cfg_txpwr_ul_tb_offset (rtwdev, rtwvif_link); }if (chip_gen ==RTW89_CHIP_BE )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 272/826 wifi: rtw89: refactor STA related func ahead for MLO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 72e9457c1954dc39a7059bd6d6346b60a24aa55e ]
Refactor STA related functions, e.g. add/assoc/disassoc/disconnect/remove to separate most link stuffs into sub-functions for MLO reuse.
Stable-dep-of: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning")
--- drivers/net/wireless/realtek/rtw89/core.c | 112 +++++-------- drivers/net/wireless/realtek/rtw89/core.h | 40 +++-- drivers/net/wireless/realtek/rtw89/fw.c | 17 +- drivers/net/wireless/realtek/rtw89/fw.h | 16 +- drivers/net/wireless/realtek/rtw89/mac.c | 42 +++-- drivers/net/wireless/realtek/rtw89/mac.h | 20 ++- drivers/net/wireless/realtek/rtw89/mac80211.c | 152 ++++++++++++++++-- drivers/net/wireless/realtek/rtw89/mac_be.c | 22 +-- drivers/net/wireless/realtek/rtw89/phy.c | 3 +- drivers/net/wireless/realtek/rtw89/phy.h | 2 +- drivers/net/wireless/realtek/rtw89/wow.c | 7 +- 11 files changed, 261 insertions(+), 172 deletions(-)
drivers/net/wireless/realtek/rtw89/core.c +39 -73
@@ -2746,8 +2746,8 @@ static void rtw89_core_ba_work(struct work_struct *work)spin_unlock_bh (&rtwdev->ba_lock); } -static void rtw89_core_free_sta_pending_ba (struct rtw89_dev *rtwdev, -struct ieee80211_sta *sta) +void rtw89_core_free_sta_pending_ba (struct rtw89_dev *rtwdev, +struct ieee80211_sta *sta) {struct rtw89_txq *rtwtxq, *tmp;
@@ -2761,8 +2761,8 @@ static void rtw89_core_free_sta_pending_ba(struct rtw89_dev *rtwdev,spin_unlock_bh (&rtwdev->ba_lock); } -static void rtw89_core_free_sta_pending_forbid_ba (struct rtw89_dev *rtwdev, -struct ieee80211_sta *sta) +void rtw89_core_free_sta_pending_forbid_ba (struct rtw89_dev *rtwdev, +struct ieee80211_sta *sta) {struct rtw89_txq *rtwtxq, *tmp;
@@ -2778,8 +2778,8 @@ static void rtw89_core_free_sta_pending_forbid_ba(struct rtw89_dev *rtwdev,spin_unlock_bh (&rtwdev->ba_lock); } -static void rtw89_core_free_sta_pending_roc_tx (struct rtw89_dev *rtwdev, -struct ieee80211_sta *sta) +void rtw89_core_free_sta_pending_roc_tx (struct rtw89_dev *rtwdev, +struct ieee80211_sta *sta) {struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv;struct sk_buff *skb, *tmp;
@@ -3525,26 +3525,19 @@ void rtw89_vif_type_mapping(struct rtw89_vif_link *rtwvif_link, bool assoc) } } -int rtw89_core_sta_add (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +int rtw89_core_sta_link_add (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link); +struct ieee80211_sta *sta =rtwsta_to_sta (rtwsta_link);struct rtw89_hal *hal = &rtwdev->hal;u8 ant_num = hal->ant_diversity ?2 : rtwdev->chip->rf_path_num;int i;int ret; - rtwsta_link->rtwdev = rtwdev; - rtwsta_link->rtwvif_link = rtwvif_link; rtwsta_link->prev_rssi =0 ;INIT_LIST_HEAD (&rtwsta_link->ba_cam_list); -skb_queue_head_init (&rtwsta_link->roc_queue); - -for (i =0 ; i <ARRAY_SIZE (sta->txq); i++) -rtw89_core_txq_init (rtwdev, sta->txq[i]); -ewma_rssi_init (&rtwsta_link->avg_rssi);ewma_snr_init (&rtwsta_link->avg_snr);ewma_evm_init (&rtwsta_link->evm_1ss);
@@ -3555,9 +3548,6 @@ int rtw89_core_sta_add(struct rtw89_dev *rtwdev, }if (vif->type ==NL80211_IFTYPE_STATION && !sta->tdls) { -/* for station mode, assign the mac_id from itself */ - rtwsta_link->mac_id = rtwvif_link->mac_id; -/* must do rtw89_reg_6ghz_recalc() before rfk channel */ ret =rtw89_reg_6ghz_recalc (rtwdev, rtwvif_link, true);if (ret)
@@ -3567,13 +3557,8 @@ int rtw89_core_sta_add(struct rtw89_dev *rtwdev, BTC_ROLE_MSTS_STA_CONN_START);rtw89_chip_rfk_channel (rtwdev, rtwvif_link); }else if (vif->type ==NL80211_IFTYPE_AP || sta->tdls) { - rtwsta_link->mac_id =rtw89_acquire_mac_id (rtwdev); -if (rtwsta_link->mac_id ==RTW89_MAX_MAC_ID_NUM ) -return -ENOSPC ; - ret =rtw89_mac_set_macid_pause (rtwdev, rtwsta_link->mac_id, false);if (ret) { -rtw89_release_mac_id (rtwdev, rtwsta_link->mac_id);rtw89_warn (rtwdev,"failed to send h2c macid pause\n" );return ret; }
@@ -3581,7 +3566,6 @@ int rtw89_core_sta_add(struct rtw89_dev *rtwdev, ret =rtw89_fw_h2c_role_maintain (rtwdev, rtwvif_link, rtwsta_link,RTW89_ROLE_CREATE );if (ret) { -rtw89_release_mac_id (rtwdev, rtwsta_link->mac_id);rtw89_warn (rtwdev,"failed to send h2c role info\n" );return ret; }
@@ -3593,44 +3577,33 @@ int rtw89_core_sta_add(struct rtw89_dev *rtwdev, ret =rtw89_chip_h2c_default_dmac_tbl (rtwdev, rtwvif_link, rtwsta_link);if (ret)return ret; - -rtw89_queue_chanctx_change (rtwdev,RTW89_CHANCTX_REMOTE_STA_CHANGE ); }return 0 ; } -int rtw89_core_sta_disassoc (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +int rtw89_core_sta_link_disassoc (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);if (vif->type ==NL80211_IFTYPE_STATION ) -rtw89_fw_h2c_set_bcn_fltr_cfg (rtwdev, vif, false); - - rtwdev->total_sta_assoc--; -if (sta->tdls) - rtwvif_link->tdls_peer--; - rtwsta_link->disassoc = true; +rtw89_fw_h2c_set_bcn_fltr_cfg (rtwdev, rtwvif_link, false);return 0 ; } -int rtw89_core_sta_disconnect (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +int rtw89_core_sta_link_disconnect (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link); +struct ieee80211_sta *sta =rtwsta_to_sta (rtwsta_link);int ret; -rtw89_mac_bf_monitor_calc (rtwdev, sta, true); -rtw89_mac_bf_disassoc (rtwdev, vif, sta); -rtw89_core_free_sta_pending_ba (rtwdev, sta); -rtw89_core_free_sta_pending_forbid_ba (rtwdev, sta); -rtw89_core_free_sta_pending_roc_tx (rtwdev, sta); +rtw89_mac_bf_monitor_calc (rtwdev, rtwsta_link, true); +rtw89_mac_bf_disassoc (rtwdev, rtwvif_link, rtwsta_link);if (vif->type ==NL80211_IFTYPE_AP || sta->tdls)rtw89_cam_deinit_addr_cam (rtwdev, &rtwsta_link->addr_cam);
@@ -3642,7 +3615,7 @@ int rtw89_core_sta_disconnect(struct rtw89_dev *rtwdev,rtw89_fw_release_general_pkt_list_vif (rtwdev, rtwvif_link, true); } - ret =rtw89_chip_h2c_assoc_cmac_tbl (rtwdev, vif, sta); + ret =rtw89_chip_h2c_assoc_cmac_tbl (rtwdev, rtwvif_link, rtwsta_link);if (ret) {rtw89_warn (rtwdev,"failed to send h2c cmac table\n" );return ret;
@@ -3664,12 +3637,12 @@ int rtw89_core_sta_disconnect(struct rtw89_dev *rtwdev,return ret; } -int rtw89_core_sta_assoc (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +int rtw89_core_sta_link_assoc (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link); +struct ieee80211_sta *sta =rtwsta_to_sta (rtwsta_link);struct rtw89_bssid_cam_entry *bssid_cam =rtw89_get_bssid_cam_of (rtwvif_link, rtwsta_link); const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
@@ -3701,7 +3674,7 @@ int rtw89_core_sta_assoc(struct rtw89_dev *rtwdev, } } - ret =rtw89_chip_h2c_assoc_cmac_tbl (rtwdev, vif, sta); + ret =rtw89_chip_h2c_assoc_cmac_tbl (rtwdev, rtwvif_link, rtwsta_link);if (ret) {rtw89_warn (rtwdev,"failed to send h2c cmac table\n" );return ret;
@@ -3720,12 +3693,9 @@ int rtw89_core_sta_assoc(struct rtw89_dev *rtwdev,return ret; } - rtwdev->total_sta_assoc++; -if (sta->tdls) - rtwvif_link->tdls_peer++; -rtw89_phy_ra_assoc (rtwdev, sta); -rtw89_mac_bf_assoc (rtwdev, vif, sta); -rtw89_mac_bf_monitor_calc (rtwdev, sta, false); +rtw89_phy_ra_assoc (rtwdev, rtwsta_link); +rtw89_mac_bf_assoc (rtwdev, rtwvif_link, rtwsta_link); +rtw89_mac_bf_monitor_calc (rtwdev, rtwsta_link, false);if (vif->type ==NL80211_IFTYPE_STATION && !sta->tdls) {struct ieee80211_bss_conf *bss_conf;
@@ -3750,18 +3720,18 @@ int rtw89_core_sta_assoc(struct rtw89_dev *rtwdev,return ret; } -rtw89_fw_h2c_set_bcn_fltr_cfg (rtwdev, vif, true); +rtw89_fw_h2c_set_bcn_fltr_cfg (rtwdev, rtwvif_link, true); }return ret; } -int rtw89_core_sta_remove (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +int rtw89_core_sta_link_remove (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv; +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link); +struct ieee80211_sta *sta =rtwsta_to_sta (rtwsta_link);int ret;if (vif->type ==NL80211_IFTYPE_STATION && !sta->tdls) {
@@ -3769,16 +3739,12 @@ int rtw89_core_sta_remove(struct rtw89_dev *rtwdev,rtw89_btc_ntfy_role_info (rtwdev, rtwvif_link, rtwsta_link,BTC_ROLE_MSTS_STA_DIS_CONN ); }else if (vif->type ==NL80211_IFTYPE_AP || sta->tdls) { -rtw89_release_mac_id (rtwdev, rtwsta_link->mac_id); - ret =rtw89_fw_h2c_role_maintain (rtwdev, rtwvif_link, rtwsta_link,RTW89_ROLE_REMOVE );if (ret) {rtw89_warn (rtwdev,"failed to send h2c role info\n" );return ret; } - -rtw89_queue_chanctx_change (rtwdev,RTW89_CHANCTX_REMOTE_STA_CHANGE ); }return 0 ;
drivers/net/wireless/realtek/rtw89/core.h +23 -17
@@ -3656,8 +3656,8 @@ struct rtw89_chip_ops {struct rtw89_vif_link *rtwvif_link, struct rtw89_sta_link *rtwsta_link);int (*h2c_assoc_cmac_tbl)(struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta); +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link);int (*h2c_ampdu_cmac_tbl)(struct rtw89_dev *rtwdev,struct ieee80211_vif *vif,struct ieee80211_sta *sta);
@@ -6656,21 +6656,21 @@ void rtw89_core_napi_start(struct rtw89_dev *rtwdev);void rtw89_core_napi_stop (struct rtw89_dev *rtwdev);int rtw89_core_napi_init (struct rtw89_dev *rtwdev);void rtw89_core_napi_deinit (struct rtw89_dev *rtwdev); -int rtw89_core_sta_add (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta); -int rtw89_core_sta_assoc (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta); -int rtw89_core_sta_disassoc (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta); -int rtw89_core_sta_disconnect (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta); -int rtw89_core_sta_remove (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta); +int rtw89_core_sta_link_add (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link); +int rtw89_core_sta_link_assoc (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link); +int rtw89_core_sta_link_disassoc (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link); +int rtw89_core_sta_link_disconnect (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link); +int rtw89_core_sta_link_remove (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link);void rtw89_core_set_tid_config (struct rtw89_dev *rtwdev,struct ieee80211_sta *sta,struct cfg80211_tid_config *tid_config);
@@ -6702,6 +6702,12 @@ int rtw89_core_acquire_sta_ba_entry(struct rtw89_dev *rtwdev,int rtw89_core_release_sta_ba_entry (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link,u8 tid,u8 *cam_idx); +void rtw89_core_free_sta_pending_ba (struct rtw89_dev *rtwdev, +struct ieee80211_sta *sta); +void rtw89_core_free_sta_pending_forbid_ba (struct rtw89_dev *rtwdev, +struct ieee80211_sta *sta); +void rtw89_core_free_sta_pending_roc_tx (struct rtw89_dev *rtwdev, +struct ieee80211_sta *sta);void rtw89_vif_type_mapping (struct rtw89_vif_link *rtwvif_link,bool assoc);int rtw89_chip_info_setup (struct rtw89_dev *rtwdev); void rtw89_chip_cfg_txpwr_ul_tb_offset(struct rtw89_dev *rtwdev,
drivers/net/wireless/realtek/rtw89/fw.c +7 -10
@@ -2831,12 +2831,11 @@ static void __get_sta_he_pkt_padding(struct rtw89_dev *rtwdev, }int rtw89_fw_h2c_assoc_cmac_tbl (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);const struct rtw89_chip_info *chip = rtwdev->chip; -struct rtw89_sta_link *rtwsta_link =sta_to_rtwsta_safe (sta); -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv;const struct rtw89_chan *chan =rtw89_chan_get (rtwdev, rtwvif_link->chanctx_idx);struct ieee80211_link_sta *link_sta;
@@ -2979,11 +2978,10 @@ static void __get_sta_eht_pkt_padding(struct rtw89_dev *rtwdev, }int rtw89_fw_h2c_assoc_cmac_tbl_g7 (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link =sta_to_rtwsta_safe (sta); +struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);const struct rtw89_chan *chan =rtw89_chan_get (rtwdev, rtwvif_link->chanctx_idx);u8 mac_id = rtwsta_link ? rtwsta_link->mac_id : rtwvif_link->mac_id;struct rtw89_h2c_cctlinfo_ud_g7 *h2c;
@@ -3788,10 +3786,9 @@ int rtw89_fw_h2c_set_ofld_cfg(struct rtw89_dev *rtwdev) }int rtw89_fw_h2c_set_bcn_fltr_cfg (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, +struct rtw89_vif_link *rtwvif_link,bool connect) { -struct rtw89_vif_link *rtwvif_link =vif_to_rtwvif_safe (vif);struct ieee80211_bss_conf *bss_conf;s32 thold =RTW89_DEFAULT_CQM_THOLD ;u32 hyst =RTW89_DEFAULT_CQM_HYST ;
drivers/net/wireless/realtek/rtw89/fw.h +8 -8
@@ -4413,11 +4413,11 @@ int rtw89_fw_h2c_default_dmac_tbl_v2(struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link, struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_assoc_cmac_tbl (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta); +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_assoc_cmac_tbl_g7 (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta); +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link);int rtw89_fw_h2c_ampdu_cmac_tbl_g7 (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif,struct ieee80211_sta *sta);
@@ -4452,7 +4452,7 @@ int rtw89_fw_h2c_set_edca(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvi u8 ac, u32 val);int rtw89_fw_h2c_set_ofld_cfg (struct rtw89_dev *rtwdev);int rtw89_fw_h2c_set_bcn_fltr_cfg (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, +struct rtw89_vif_link *rtwvif_link,bool connect);int rtw89_fw_h2c_rssi_offload (struct rtw89_dev *rtwdev,struct rtw89_rx_phy_ppdu *phy_ppdu);
@@ -4654,12 +4654,12 @@ static inline int rtw89_chip_h2c_update_beacon(struct rtw89_dev *rtwdev, }static inline int rtw89_chip_h2c_assoc_cmac_tbl (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) {const struct rtw89_chip_info *chip = rtwdev->chip; -return chip->ops->h2c_assoc_cmac_tbl (rtwdev, vif, sta); +return chip->ops->h2c_assoc_cmac_tbl (rtwdev, rtwvif_link, rtwsta_link); } static inline int rtw89_chip_h2c_ampdu_cmac_tbl(struct rtw89_dev *rtwdev,
drivers/net/wireless/realtek/rtw89/mac.c +18 -24
104 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac.h +12 -8
@@ -951,8 +951,9 @@ struct rtw89_mac_gen_def {void (*dmac_func_pre_en)(struct rtw89_dev *rtwdev);void (*dle_func_en)(struct rtw89_dev *rtwdev,bool enable);void (*dle_clk_en)(struct rtw89_dev *rtwdev,bool enable); -void (*bf_assoc)(struct rtw89_dev *rtwdev,struct ieee80211_vif *vif, -struct ieee80211_sta *sta); +void (*bf_assoc)(struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link); int (*typ_fltr_opt)(struct rtw89_dev *rtwdev, enum rtw89_machdr_frame_type type,
@@ -1259,21 +1260,24 @@ void rtw89_mac_power_mode_change(struct rtw89_dev *rtwdev, bool enter);void rtw89_mac_notify_wake (struct rtw89_dev *rtwdev);static inline -void rtw89_mac_bf_assoc (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +void rtw89_mac_bf_assoc (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) {const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;if (mac->bf_assoc) - mac->bf_assoc (rtwdev, vif, sta); + mac->bf_assoc (rtwdev, rtwvif_link, rtwsta_link); } -void rtw89_mac_bf_disassoc (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif, -struct ieee80211_sta *sta); +void rtw89_mac_bf_disassoc (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link);void rtw89_mac_bf_set_gid_table (struct rtw89_dev *rtwdev,struct ieee80211_vif *vif,struct ieee80211_bss_conf *conf);void rtw89_mac_bf_monitor_calc (struct rtw89_dev *rtwdev, -struct ieee80211_sta *sta,bool disconnect); +struct rtw89_sta_link *rtwsta_link, +bool disconnect);void _rtw89_mac_bf_monitor_track (struct rtw89_dev *rtwdev);void rtw89_mac_bfee_ctrl (struct rtw89_dev *rtwdev,u8 mac_idx,bool en);int rtw89_mac_vif_init (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link);
drivers/net/wireless/realtek/rtw89/mac80211.c +140 -12
206 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac_be.c +8 -14
@@ -2091,11 +2091,9 @@ static int rtw89_mac_init_bfee_be(struct rtw89_dev *rtwdev, u8 mac_idx) }static int rtw89_mac_set_csi_para_reg_be (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv;u8 nc =1 , nr =3 , ng =0 , cb =1 , cs =1 , ldpc_en =1 , stbc_en =1 ;struct ieee80211_link_sta *link_sta;u8 mac_idx = rtwvif_link->mac_idx;
@@ -2162,11 +2160,9 @@ static int rtw89_mac_set_csi_para_reg_be(struct rtw89_dev *rtwdev, }static int rtw89_mac_csi_rrsc_be (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv;u32 rrsc =BIT (RTW89_MAC_BF_RRSC_6M ) |BIT (RTW89_MAC_BF_RRSC_24M );struct ieee80211_link_sta *link_sta;u8 mac_idx = rtwvif_link->mac_idx;
@@ -2210,11 +2206,9 @@ static int rtw89_mac_csi_rrsc_be(struct rtw89_dev *rtwdev, }static void rtw89_mac_bf_assoc_be (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta) +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link) { -struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv;struct ieee80211_link_sta *link_sta;bool has_beamformer_cap;
@@ -2229,8 +2223,8 @@ static void rtw89_mac_bf_assoc_be(struct rtw89_dev *rtwdev,rtw89_debug (rtwdev,RTW89_DBG_BF ,"initialize bfee for new association\n" );rtw89_mac_init_bfee_be (rtwdev, rtwvif_link->mac_idx); -rtw89_mac_set_csi_para_reg_be (rtwdev, vif, sta); -rtw89_mac_csi_rrsc_be (rtwdev, vif, sta); +rtw89_mac_set_csi_para_reg_be (rtwdev, rtwvif_link, rtwsta_link); +rtw89_mac_csi_rrsc_be (rtwdev, rtwvif_link, rtwsta_link); } }
drivers/net/wireless/realtek/rtw89/phy.c +1 -2
@@ -637,9 +637,8 @@ void rtw89_phy_ra_update(struct rtw89_dev *rtwdev) rtwdev); } -void rtw89_phy_ra_assoc (struct rtw89_dev *rtwdev,struct ieee80211_sta *sta) +void rtw89_phy_ra_assoc (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link) { -struct rtw89_sta_link *rtwsta_link = (struct rtw89_sta_link *)sta->drv_priv;struct rtw89_vif_link *rtwvif_link = rtwsta_link->rtwvif_link;struct ieee80211_vif *vif =rtwvif_to_vif (rtwvif_link);struct rtw89_ra_info *ra = &rtwsta_link->ra;
drivers/net/wireless/realtek/rtw89/phy.h +1 -1
@@ -892,7 +892,7 @@ void rtw89_phy_set_txpwr_limit_ru(struct rtw89_dev *rtwdev, phy->set_txpwr_limit_ru (rtwdev, chan, phy_idx); } -void rtw89_phy_ra_assoc (struct rtw89_dev *rtwdev,struct ieee80211_sta *sta); +void rtw89_phy_ra_assoc (struct rtw89_dev *rtwdev,struct rtw89_sta_link *rtwsta_link);void rtw89_phy_ra_update (struct rtw89_dev *rtwdev);void rtw89_phy_ra_update_sta (struct rtw89_dev *rtwdev,struct ieee80211_sta *sta,u32 changed);
drivers/net/wireless/realtek/rtw89/wow.c +4 -3
@@ -1240,7 +1240,7 @@ static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)return ret; } - ret =rtw89_chip_h2c_assoc_cmac_tbl (rtwdev, wow_vif, wow_sta); + ret =rtw89_chip_h2c_assoc_cmac_tbl (rtwdev, rtwvif_link, rtwsta_link);if (ret) {rtw89_warn (rtwdev,"failed to send h2c assoc cmac tbl\n" );return ret;
@@ -1267,7 +1267,7 @@ static int rtw89_wow_swap_fw(struct rtw89_dev *rtwdev, bool wow)rtw89_warn (rtwdev,"failed to send h2c general packet\n" );return ret; } -rtw89_phy_ra_assoc (rtwdev, wow_sta); +rtw89_phy_ra_assoc (rtwdev, rtwsta_link);rtw89_phy_set_bss_color (rtwdev, rtwvif_link);rtw89_chip_cfg_txpwr_ul_tb_offset (rtwdev, rtwvif_link); }
@@ -1374,13 +1374,14 @@ static int rtw89_wow_disable_trx_post(struct rtw89_dev *rtwdev) {struct rtw89_wow_param *rtw_wow = &rtwdev->wow;struct ieee80211_vif *vif = rtw_wow->wow_vif; +struct rtw89_vif_link *rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv;int ret; ret =rtw89_mac_cfg_ppdu_status (rtwdev,RTW89_MAC_0 , true);if (ret)rtw89_err (rtwdev,"cfg ppdu status\n" ); -rtw89_fw_h2c_set_bcn_fltr_cfg (rtwdev, vif, true); +rtw89_fw_h2c_set_bcn_fltr_cfg (rtwdev, rtwvif_link, true);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 273/826 wifi: rtw89: tweak driver architecture for impending MLO support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit aad0394e7a02fe933159be79d9d4595d2ad089dd ]
The drv_priv hooked to mac80211 become as below.
(drv_priv) (instance-0)
+---------------+ +-----------+ +----------------+
| ieee80211_vif | <---> | rtw89_vif | -------> | rtw89_vif_link |
+---------------+ +-----------+ | +----------------+
|
| (instance-1)
| +----------------+
+---> | rtw89_vif_link |
+----------------+ (drv_priv) (instance-0)
+---------------+ +-----------+ +----------------+
| ieee80211_sta | <---> | rtw89_sta | -------> | rtw89_sta_link |
+---------------+ +-----------+ | +----------------+
|
| (instance-1)
| +----------------+
+---> | rtw89_sta_link |
+----------------+The relation bewteen mac80211 link_id and our link instance is like below.
|\
(link_id) | \
0 -------- | |
1 -------- | | ------ instance-0 (link_id: X) -> work on HW band 0
2 -------- | |
... | | ------ instance-1 (link_id: Y) -> work on HW band 1
14 -------- | |
| /
|/ N.B. For cases of non-MLD connection, we set our link instance-0 active with link_id 0. So, our code flow can be compatible between non-MLD connection and MLD connection.
Based on above, we tweak entire driver architecture first. But, we don't dynamically enable multiple links here. That will be handled separately. Most of the things changed here are changing flows to iterate all active links and read bss_conf/link_sta data according to target link. And, for cases of scan, ROC, WOW, we use instance-0 to deal with the request.
There are some things listed below, which work for now but need to extend before multiple active links.
1. tx path
select suitable link instance among multiple active links
2. rx path
determine rx link by PPDU instead of always link instance-0
3. CAM
apply MLD pairwise key to any active links dynamically
Besides, PS code cannot easily work along with tweaking architecture. With supporting MLO flag (currently false), we disable PS first and will fix it by another commit in the following.
Stable-dep-of: f16c40acd319 ("wifi: rtw89: Fix TX fail with A2DP after scanning")
--- drivers/net/wireless/realtek/rtw89/cam.c | 126 ++++- drivers/net/wireless/realtek/rtw89/chan.c | 77 ++- drivers/net/wireless/realtek/rtw89/coex.c | 54 +- drivers/net/wireless/realtek/rtw89/core.c | 504 +++++++++++++----- drivers/net/wireless/realtek/rtw89/core.h | 240 +++++++-- drivers/net/wireless/realtek/rtw89/debug.c | 85 ++- drivers/net/wireless/realtek/rtw89/fw.c | 147 ++--- drivers/net/wireless/realtek/rtw89/fw.h | 72 ++- drivers/net/wireless/realtek/rtw89/mac.c | 137 +++-- drivers/net/wireless/realtek/rtw89/mac.h | 2 +- drivers/net/wireless/realtek/rtw89/mac80211.c | 423 +++++++++++---- drivers/net/wireless/realtek/rtw89/phy.c | 134 +++-- drivers/net/wireless/realtek/rtw89/ps.c | 33 +- drivers/net/wireless/realtek/rtw89/regd.c | 40 +- drivers/net/wireless/realtek/rtw89/ser.c | 63 ++- drivers/net/wireless/realtek/rtw89/util.h | 8 +- drivers/net/wireless/realtek/rtw89/wow.c | 99 ++-- drivers/net/wireless/realtek/rtw89/wow.h | 6 +- 18 files changed, 1615 insertions(+), 635 deletions(-)
drivers/net/wireless/realtek/rtw89/cam.c +98 -28
@@ -211,24 +211,16 @@ static int rtw89_cam_get_addr_cam_key_idx(struct rtw89_addr_cam_entry *addr_cam,return 0 ; } -static int rtw89_cam_detach_sec_cam (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta, -const struct rtw89_sec_cam_entry *sec_cam, -bool inform_fw) +static int __rtw89_cam_detach_sec_cam (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link, +const struct rtw89_sec_cam_entry *sec_cam, +bool inform_fw) { -struct rtw89_sta_link *rtwsta_link =sta_to_rtwsta_safe (sta); -struct rtw89_vif_link *rtwvif_link;struct rtw89_addr_cam_entry *addr_cam;unsigned int i;int ret =0 ; -if (!vif) { -rtw89_err (rtwdev,"No iface for deleting sec cam\n" ); -return -EINVAL ; - } - - rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link);for_each_set_bit (i, addr_cam->sec_cam_map,RTW89_SEC_CAM_IN_ADDR_CAM ) {
@@ -251,24 +243,16 @@ static int rtw89_cam_detach_sec_cam(struct rtw89_dev *rtwdev,return ret; } -static int rtw89_cam_attach_sec_cam (struct rtw89_dev *rtwdev, -struct ieee80211_vif *vif, -struct ieee80211_sta *sta, -struct ieee80211_key_conf *key, -struct rtw89_sec_cam_entry *sec_cam) +static int __rtw89_cam_attach_sec_cam (struct rtw89_dev *rtwdev, +struct rtw89_vif_link *rtwvif_link, +struct rtw89_sta_link *rtwsta_link, +struct ieee80211_key_conf *key, +struct rtw89_sec_cam_entry *sec_cam) { -struct rtw89_sta_link *rtwsta_link =sta_to_rtwsta_safe (sta); -struct rtw89_vif_link *rtwvif_link;struct rtw89_addr_cam_entry *addr_cam;u8 key_idx =0 ;int ret; -if (!vif) { -rtw89_err (rtwdev,"No iface for adding sec cam\n" ); -return -EINVAL ; - } - - rtwvif_link = (struct rtw89_vif_link *)vif->drv_priv; addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link); if (key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
@@ -302,6 +286,92 @@ static int rtw89_cam_attach_sec_cam(struct rtw89_dev *rtwdev,return 0 ; } +static int rtw89_cam_detach_sec_cam (struct rtw89_dev *rtwdev, +struct ieee80211_vif *vif, +struct ieee80211_sta *sta, +const struct rtw89_sec_cam_entry *sec_cam, +bool inform_fw) +{ +struct rtw89_sta *rtwsta =sta_to_rtwsta_safe (sta); +struct rtw89_sta_link *rtwsta_link; +struct rtw89_vif_link *rtwvif_link; +struct rtw89_vif *rtwvif; +unsigned int link_id; +int ret; + +if (!vif) { +rtw89_err (rtwdev,"No iface for deleting sec cam\n" ); +return -EINVAL ; + } + + rtwvif =vif_to_rtwvif (vif); + +rtw89_vif_for_each_link (rtwvif, rtwvif_link, link_id) { + rtwsta_link = rtwsta ? rtwsta->links[link_id] :NULL ; +if (rtwsta && !rtwsta_link) +continue ; + + ret =__rtw89_cam_detach_sec_cam (rtwdev, rtwvif_link, rtwsta_link, + sec_cam, inform_fw); +if (ret) +return ret; + } + +return 0 ; +} + +static int rtw89_cam_attach_sec_cam (struct rtw89_dev *rtwdev, +struct ieee80211_vif *vif, +struct ieee80211_sta *sta, +struct ieee80211_key_conf *key, +struct rtw89_sec_cam_entry *sec_cam) +{ +struct rtw89_sta *rtwsta =sta_to_rtwsta_safe (sta); +struct rtw89_sta_link *rtwsta_link; +struct rtw89_vif_link *rtwvif_link; +struct rtw89_vif *rtwvif; +unsigned int link_id; +int key_link_id; +int ret; + +if (!vif) { +rtw89_err (rtwdev,"No iface for adding sec cam\n" ); +return -EINVAL ; + } + + rtwvif =vif_to_rtwvif (vif); + + key_link_id =ieee80211_vif_is_mld (vif) ? key->link_id :0 ; +if (key_link_id >=0 ) { + rtwvif_link = rtwvif->links[key_link_id]; + rtwsta_link = rtwsta ? rtwsta->links[key_link_id] :NULL ; + +if (!rtwvif_link || (rtwsta && !rtwsta_link)) { +rtw89_err (rtwdev,"No drv link for adding sec cam\n" ); +return -ENOLINK ; + } + +return __rtw89_cam_attach_sec_cam (rtwdev, rtwvif_link, + rtwsta_link, key, sec_cam); + } + +/* key_link_id < 0: MLD pairwise key */ +if (!rtwsta) { +rtw89_err (rtwdev,"No sta for adding MLD pairwise sec cam\n" ); +return -EINVAL ; + } + +rtw89_sta_for_each_link (rtwsta, rtwsta_link, link_id) { + rtwvif_link = rtwsta_link->rtwvif_link; + ret =__rtw89_cam_attach_sec_cam (rtwdev, rtwvif_link, + rtwsta_link, key, sec_cam); +if (ret) +return ret; + } + +return 0 ; +} + static int rtw89_cam_sec_key_install(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif, struct ieee80211_sta *sta,
@@ -708,10 +778,10 @@ void rtw89_cam_fill_addr_cam_info(struct rtw89_dev *rtwdev,const u8 *scan_mac_addr, u8 *cmd) { - struct ieee80211_vif *vif = rtwvif_to_vif(rtwvif_link); + struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);struct rtw89_addr_cam_entry *addr_cam =rtw89_get_addr_cam_of (rtwvif_link, rtwsta_link); -struct ieee80211_sta *sta =rtwsta_to_sta_safe (rtwsta_link); +struct ieee80211_sta *sta =rtwsta_link_to_sta_safe (rtwsta_link);struct ieee80211_link_sta *link_sta;const u8 *sma = scan_mac_addr ? scan_mac_addr : rtwvif_link->mac_addr;u8 sma_hash, tma_hash, addr_msk_start;
drivers/net/wireless/realtek/rtw89/chan.c +58 -19
137 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/coex.c +41 -13
100 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/core.c +372 -132
910 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/core.h +194 -46
421 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/debug.c +60 -25
158 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/fw.c +85 -62
387 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/fw.h +57 -15
112 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac.c +92 -45
271 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/mac.h +1 -1
@@ -1466,7 +1466,7 @@ int rtw89_mac_read_xtal_si(struct rtw89_dev *rtwdev, u8 offset, u8 *val)return mac->read_xtal_si (rtwdev, offset, val); } -void rtw89_mac_pkt_drop_vif (struct rtw89_dev *rtwdev,struct rtw89_vif_link *rtwvif_link); +void rtw89_mac_pkt_drop_vif (struct rtw89_dev *rtwdev,struct rtw89_vif *rtwvif);int rtw89_mac_resize_ple_rx_quota (struct rtw89_dev *rtwdev,bool wow);int rtw89_mac_ptk_drop_by_band_and_wait (struct rtw89_dev *rtwdev,enum rtw89_mac_idx band);
drivers/net/wireless/realtek/rtw89/mac80211.c +310 -113
334 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/phy.c +99 -35
134 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/ps.c +24 -9
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/regd.c +24 -16
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/ser.c +40 -23
63 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/util.h +4 -4
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw89/wow.c +54 -45
99 lines not on this page · raw message
drivers/net/wireless/realtek/rtw89/wow.h +2 -4
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Signature · 1 line
2.43.0
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 274/826 wifi: rtw89: Fix TX fail with A2DP after scanning
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Po-Hao Huang <[email protected]>
[ Upstream commit f16c40acd31901ad0ba2554b60e0e2b0c7b59cde ]
There might be some racing between BT and WiFi after scan. Since one of the TX related register will be modified by both FW and rtw89_set_channel() in driver, which could cause Tx fail. Reorder the calling sequence to only notify coexistence mechanism after rtw89_set_channel() is called, so that there are no concurrent operations.
--- drivers/net/wireless/realtek/rtw89/fw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/fw.c +2 -2
@@ -6648,6 +6648,8 @@ void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev,if (!rtwvif_link)return ; +rtw89_chanctx_proceed (rtwdev); + rtwvif = rtwvif_link->rtwvif; rtw89_write32_mask(rtwdev,
@@ -6667,8 +6669,6 @@ void rtw89_hw_scan_complete(struct rtw89_dev *rtwdev, scan_info->last_chan_idx =0 ; scan_info->scanning_vif =NULL ; scan_info->abort = false; - -rtw89_chanctx_proceed (rtwdev); } void rtw89_hw_scan_abort(struct rtw89_dev *rtwdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 275/826 wifi: rtw89: unlock on error path in rtw89_ops_unassign_vif_chanctx()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit ac4f4e5a203927e555107db6e781e85f241720e1 ]
We need to call mutex_unlock() on this error path.
--- drivers/net/wireless/realtek/rtw89/mac80211.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/realtek/rtw89/mac80211.c +1 -0
@@ -1373,6 +1373,7 @@ static void rtw89_ops_unassign_vif_chanctx(struct ieee80211_hw *hw, rtwvif_link = rtwvif->links[link_conf->link_id];if (unlikely (!rtwvif_link)) { +mutex_unlock (&rtwdev->mutex);rtw89_err (rtwdev,"%s: rtwvif link (link_id %u) is not active\n" , __func__, link_conf->link_id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 276/826 drm/panfrost: Remove unused id_mask from struct panfrost_model
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Price <[email protected]>
[ Upstream commit 581d1f8248550f2b67847e6d84f29fbe3751ea0a ]
The id_mask field of struct panfrost_model has never been used.
--- drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/panfrost/panfrost_gpu.c +0 -1
@@ -177,7 +177,6 @@ static void panfrost_gpu_init_quirks(struct panfrost_device *pfdev)struct panfrost_model {const char *name;u32 id; -u32 id_mask;u64 features;u64 issues;struct {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 277/826 bpf, arm64: Remove garbage frame for struct_ops trampoline
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 87cb58aebdf7005661a07e9fd5a900f924d48c75 ]
The callsite layout for arm64 fentry is:
mov x9, lr
nop
When a bpf prog is attached, the nop instruction is patched to a call to bpf trampoline:
mov x9, lr
bl <bpf trampoline>
So two return addresses are passed to bpf trampoline: the return address for the traced function/prog, stored in x9, and the return address for the bpf trampoline itself, stored in lr. To obtain a full and accurate call stack, the bpf trampoline constructs two fake function frames using x9 and lr.
However, struct_ops progs are invoked directly as function callbacks, meaning that x9 is not set as it is in the fentry callsite. In this case, the frame constructed using x9 is garbage. The following stack trace for struct_ops, captured by perf sampling, illustrates this issue, where tcp_ack+0x404 is a garbage frame:
ffffffc0801a04b4 bpf_prog_50992e55a0f655a9_bpf_cubic_cong_avoid+0x98 (bpf_prog_50992e55a0f655a9_bpf_cubic_cong_avoid) ffffffc0801a228c [unknown] ([kernel.kallsyms]) // bpf trampolineffffffd08d362590 tcp_ack+0x798 ([kernel.kallsyms]) // caller for bpf trampolineffffffd08d3621fc tcp_ack+0x404 ([kernel.kallsyms]) // garbage frameffffffd08d36452c tcp_rcv_established+0x4ac ([kernel.kallsyms])ffffffd08d375c58 tcp_v4_do_rcv+0x1f0 ([kernel.kallsyms])ffffffd08d378630 tcp_v4_rcv+0xeb8 ([kernel.kallsyms])
To fix it, construct only one frame using lr for struct_ops.
The above stack trace also indicates that there is no kernel symbol for struct_ops bpf trampoline. This will be addressed in a follow-up patch.
--- arch/arm64/net/bpf_jit_comp.c | 47 +++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 16 deletions(-)
arch/arm64/net/bpf_jit_comp.c +31 -16
@@ -2094,6 +2094,12 @@ static void restore_args(struct jit_ctx *ctx, int args_off, int nregs) } } +static bool is_struct_ops_tramp (const struct bpf_tramp_links *fentry_links) +{ +return fentry_links->nr_links ==1 && + fentry_links->links[0 ]->link.type ==BPF_LINK_TYPE_STRUCT_OPS ; +} +/* Based on the x86's implementation of arch_prepare_bpf_trampoline(). * * bpf prog and function entry before bpf trampoline hooked:
@@ -2123,6 +2129,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN ];bool save_ret;__le32 **branches =NULL ; +bool is_struct_ops =is_struct_ops_tramp (fentry);/* trampoline stack layout: * [ parent ip ]
@@ -2191,11 +2198,14 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,*/ emit_bti (A64_BTI_JC , ctx); -/* frame for parent function */ -emit (A64_PUSH (A64_FP ,A64_R (9 ),A64_SP ), ctx); -emit (A64_MOV (1 ,A64_FP ,A64_SP ), ctx); +/* x9 is not set for struct_ops */ +if (!is_struct_ops) { +/* frame for parent function */ +emit (A64_PUSH (A64_FP ,A64_R (9 ),A64_SP ), ctx); +emit (A64_MOV (1 ,A64_FP ,A64_SP ), ctx); + } -/* frame for patched function */ +/* frame for patched function for tracing, or caller for struct_ops */ emit (A64_PUSH (A64_FP ,A64_LR ,A64_SP ), ctx);emit (A64_MOV (1 ,A64_FP ,A64_SP ), ctx);
@@ -2289,19 +2299,24 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,/* reset SP */ emit (A64_MOV (1 ,A64_SP ,A64_FP ), ctx); -/* pop frames */ -emit (A64_POP (A64_FP ,A64_LR ,A64_SP ), ctx); -emit (A64_POP (A64_FP ,A64_R (9 ),A64_SP ), ctx); - -if (flags &BPF_TRAMP_F_SKIP_FRAME ) { -/* skip patched function, return to parent */ -emit (A64_MOV (1 ,A64_LR ,A64_R (9 )), ctx); -emit (A64_RET (A64_R (9 )), ctx); +if (is_struct_ops) { +emit (A64_POP (A64_FP ,A64_LR ,A64_SP ), ctx); +emit (A64_RET (A64_LR ), ctx); }else { -/* return to patched function */ -emit (A64_MOV (1 ,A64_R (10 ),A64_LR ), ctx); -emit (A64_MOV (1 ,A64_LR ,A64_R (9 )), ctx); -emit (A64_RET (A64_R (10 )), ctx); +/* pop frames */ +emit (A64_POP (A64_FP ,A64_LR ,A64_SP ), ctx); +emit (A64_POP (A64_FP ,A64_R (9 ),A64_SP ), ctx); + +if (flags &BPF_TRAMP_F_SKIP_FRAME ) { +/* skip patched function, return to parent */ +emit (A64_MOV (1 ,A64_LR ,A64_R (9 )), ctx); +emit (A64_RET (A64_R (9 )), ctx); + }else { +/* return to patched function */ +emit (A64_MOV (1 ,A64_R (10 ),A64_LR ), ctx); +emit (A64_MOV (1 ,A64_LR ,A64_R (9 )), ctx); +emit (A64_RET (A64_R (10 )), ctx); + } }kfree (branches);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 278/826 drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 394679f322649d06fea3c646ba65f5a0887f52c3 ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
Patchwork: https://patchwork.freedesktop.org/patch/614075/
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +1 -3
@@ -1522,15 +1522,13 @@ static int a6xx_gmu_get_irq(struct a6xx_gmu *gmu, struct platform_device *pdev, irq =platform_get_irq_byname (pdev, name); - ret =request_irq (irq, handler,IRQF_TRIGGER_HIGH , name, gmu); + ret =request_irq (irq, handler,IRQF_TRIGGER_HIGH |IRQF_NO_AUTOEN , name, gmu);if (ret) {DRM_DEV_ERROR (&pdev->dev,"Unable to get interrupt %s %d\n" , name, ret);return ret; } -disable_irq (irq); -return irq; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 279/826 drm/msm/gpu: Check the status of registration to PM QoS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Luba <[email protected]>
[ Upstream commit 8f32ddd87e499ba6d2dc74ce30b6932baf1e1fc3 ]
There is a need to check the returned value of the registration function. In case of returned error, print that and stop the init process.
Patchwork: https://patchwork.freedesktop.org/patch/620336/
--- drivers/gpu/drm/msm/msm_gpu_devfreq.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/msm_gpu_devfreq.c +7 -2
@@ -140,6 +140,7 @@ void msm_devfreq_init(struct msm_gpu *gpu) {struct msm_gpu_devfreq *df = &gpu->devfreq;struct msm_drm_private *priv = gpu->dev->dev_private; +int ret;/* We need target support to do devfreq */ if (!gpu->funcs->gpu_busy)
@@ -156,8 +157,12 @@ void msm_devfreq_init(struct msm_gpu *gpu)mutex_init (&df->lock); -dev_pm_qos_add_request (&gpu->pdev->dev, &df->boost_freq, -DEV_PM_QOS_MIN_FREQUENCY ,0 ); + ret =dev_pm_qos_add_request (&gpu->pdev->dev, &df->boost_freq, +DEV_PM_QOS_MIN_FREQUENCY ,0 ); +if (ret <0 ) { +DRM_DEV_ERROR (&gpu->pdev->dev,"Couldn't initialize QoS\n" ); +return ; + } msm_devfreq_profile.initial_freq = gpu->fast_rate;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 280/826 drm/xe/hdcp: Fix gsc structure check in fw check status
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Kandpal <[email protected]>
[ Upstream commit 182a32bcc223203c57761889fac7fa2dbb34684b ]
Fix the condition for gsc structure validity in gsc_cs_status_check(). It needs to be an OR and not an AND condition
--- drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/display/xe_hdcp_gsc.c +1 -1
@@ -42,7 +42,7 @@ bool intel_hdcp_gsc_check_status(struct xe_device *xe)struct xe_gsc *gsc = >->uc.gsc;bool ret = true; -if (!gsc && !xe_uc_fw_is_enabled (&gsc->fw)) { +if (!gsc || !xe_uc_fw_is_enabled (&gsc->fw)) {drm_dbg_kms (&xe->drm,"GSC Components not ready for HDCP2.x\n" );return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 281/826 drm/etnaviv: Request pages from DMA32 zone on addressing_limited
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit 13c96ac9a3f0f1c7ba1ff0656ea508e7fa065e7e ]
Remove __GFP_HIGHMEM when requesting a page from DMA32 zone, and since all vivante GPUs in the system will share the same DMA constraints, move the check of whether to get a page from DMA32 to etnaviv_bind().
--- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 ++++++++++ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 8 -------- 2 files changed, 10 insertions(+), 8 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_drv.c +10 -0
@@ -538,6 +538,16 @@ static int etnaviv_bind(struct device *dev) priv->num_gpus =0 ; priv->shm_gfp_mask =GFP_HIGHUSER | __GFP_RETRY_MAYFAIL | __GFP_NOWARN; +/* +* If the GPU is part of a system with DMA addressing limitations, +* request pages for our SHM backend buffers from the DMA32 zone to +* hopefully avoid performance killing SWIOTLB bounce buffering. +*/ +if (dma_addressing_limited (dev)) { + priv->shm_gfp_mask |=GFP_DMA32 ; + priv->shm_gfp_mask &= ~__GFP_HIGHMEM; + } + priv->cmdbuf_suballoc =etnaviv_cmdbuf_suballoc_new (drm->dev);if (IS_ERR (priv->cmdbuf_suballoc)) {dev_err (drm->dev,"Failed to create cmdbuf suballocator\n" );
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +0 -8
@@ -839,14 +839,6 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)if (ret) goto fail; -/* -* If the GPU is part of a system with DMA addressing limitations, -* request pages for our SHM backend buffers from the DMA32 zone to -* hopefully avoid performance killing SWIOTLB bounce buffering. -*/ -if (dma_addressing_limited (gpu->dev)) - priv->shm_gfp_mask |=GFP_DMA32 ; -/* Create buffer: */ ret =etnaviv_cmdbuf_init (priv->cmdbuf_suballoc, &gpu->buffer,PAGE_SIZE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 282/826 drm/etnaviv: hold GPU lock across perfmon sampling
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
[ Upstream commit 37dc4737447a7667f8e9ec790dac251da057eb27 ]
The perfmon sampling mutates shared GPU state (e.g. VIVS_HI_CLOCK_CONTROL to select the pipe for the perf counter reads). To avoid clashing with other functions mutating the same state (e.g. etnaviv_gpu_update_clock) the perfmon sampling needs to hold the GPU lock.
--- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_gpu.c +14 -6
@@ -1322,6 +1322,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu, {u32 val; +mutex_lock (&gpu->lock); +/* disable clock gating */ val =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ;
@@ -1333,6 +1335,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu,gpu_write (gpu,VIVS_HI_CLOCK_CONTROL , val);sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_PRE ); + +mutex_unlock (&gpu->lock); } static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
@@ -1342,13 +1346,9 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,unsigned int i;u32 val; -sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_POST ); - -for (i =0 ; i < submit->nr_pmrs; i++) { -const struct etnaviv_perfmon_request *pmr = submit->pmrs + i; +mutex_lock (&gpu->lock); - *pmr->bo_vma = pmr->sequence; - } +sync_point_perfmon_sample (gpu, event,ETNA_PM_PROCESS_POST );/* disable debug register */ val =gpu_read (gpu,VIVS_HI_CLOCK_CONTROL );
@@ -1359,6 +1359,14 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu, val =gpu_read_power (gpu,VIVS_PM_POWER_CONTROLS ); val |=VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING ;gpu_write_power (gpu,VIVS_PM_POWER_CONTROLS , val); + +mutex_unlock (&gpu->lock); + +for (i =0 ; i < submit->nr_pmrs; i++) { +const struct etnaviv_perfmon_request *pmr = submit->pmrs + i; + + *pmr->bo_vma = pmr->sequence; + } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 283/826 drm/amd/display: Increase idle worker HPD detection time
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Li <[email protected]>
[ Upstream commit 60612f75992d96955fb7154468c58d5d168cf1ab ]
[Why]
Idle worker thread waits HPD_DETECTION_TIME for HPD processing complete. Some displays require longer time for that.
[How]
Increase HPD_DETECTION_TIME to 100ms.
Stable-dep-of: a88b19b13fb4 ("drm/amd/display: Reduce HPD Detection Interval for IPS")
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +1 -1
@@ -36,7 +36,7 @@#include "amdgpu_dm_debugfs.h" #define HPD_DETECTION_PERIOD_uS 5000000 -#define HPD_DETECTION_TIME_uS 1000 +#define HPD_DETECTION_TIME_uS 100000void amdgpu_dm_crtc_handle_vblank (struct amdgpu_crtc *acrtc) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 284/826 drm/amd/display: Reduce HPD Detection Interval for IPS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <[email protected]>
[ Upstream commit a88b19b13fb41a3fa03ec67b5f57cc267fbfb160 ]
Fix DP Compliance test 4.2.1.3, 4.2.2.8, 4.3.1.12, 4.3.1.13 when IPS enabled.
Original HPD detection interval is set to 5s which violates DP compliance.
Reduce the interval parameter, such that link training can be finished within 5 seconds.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +1 -1
@@ -35,7 +35,7 @@#include "amdgpu_dm_trace.h" #include "amdgpu_dm_debugfs.h" -#define HPD_DETECTION_PERIOD_uS 5000000 +#define HPD_DETECTION_PERIOD_uS 2000000#define HPD_DETECTION_TIME_uS 100000void amdgpu_dm_crtc_handle_vblank (struct amdgpu_crtc *acrtc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 285/826 drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
[ Upstream commit a2f599046c671d6b46d93aed95b37241ce4504cf ]
When the call to gf100_grctx_generate() fails, unlock gr->fecs.mutex before returning the error.
Fixes smatch warning:
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480 gf100_gr_chan_new() warn: inconsistent returns '&gr->fecs.mutex'.
--- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +1 -0
@@ -443,6 +443,7 @@ gf100_gr_chan_new(struct nvkm_gr *base, struct nvkm_chan *fifoch, ret =gf100_grctx_generate (gr, chan, fifoch->inst);if (ret) {nvkm_error (&base->engine.subdev,"failed to construct context\n" ); +mutex_unlock (&gr->fecs.mutex);return ret; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 286/826 drm: zynqmp_kms: Unplug DRM device before removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 2e07c88914fc5289c21820b1aa94f058feb38197 ]
Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver's internals.
--- drivers/gpu/drm/xlnx/zynqmp_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xlnx/zynqmp_kms.c +1 -1
@@ -536,7 +536,7 @@ void zynqmp_dpsub_drm_cleanup(struct zynqmp_dpsub *dpsub) {struct drm_device *drm = &dpsub->drm->dev; -drm_dev_unregister (drm); +drm_dev_unplug (drm);drm_atomic_helper_shutdown (drm);drm_encoder_cleanup (&dpsub->drm->encoder);drm_kms_helper_poll_fini (drm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 287/826 drm: xlnx: zynqmp_disp: layer may be null while releasing
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Dirkwinkel <[email protected]>
[ Upstream commit 223842c7702b52846b1c5aef8aca7474ec1fd29b ]
layer->info can be null if we have an error on the first layer in zynqmp_disp_create_layers
--- drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/xlnx/zynqmp_disp.c +3 -0
@@ -1200,6 +1200,9 @@ static void zynqmp_disp_layer_release_dma(struct zynqmp_disp *disp, {unsigned int i; +if (!layer->info) +return ; +for (i =0 ; i < layer->info->num_channels; i++) {struct zynqmp_disp_layer_dma *dma = &layer->dmas[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 288/826 wifi: wfx: Fix error handling in wfx_core_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 3b88a9876779b55478a4dde867e73f7a100ffa23 ]
The wfx_core_init() returns without checking the retval from sdio_register_driver().
If the sdio_register_driver() failed, the module failed to install, leaving the wfx_spi_driver not unregistered.
--- drivers/net/wireless/silabs/wfx/main.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/net/wireless/silabs/wfx/main.c +15 -2
@@ -480,10 +480,23 @@ static int __init wfx_core_init(void) {int ret =0 ; -if (IS_ENABLED (CONFIG_SPI )) +if (IS_ENABLED (CONFIG_SPI )) { ret =spi_register_driver (&wfx_spi_driver); -if (IS_ENABLED (CONFIG_MMC ) && !ret) +if (ret) + goto out; + } +if (IS_ENABLED (CONFIG_MMC )) { ret =sdio_register_driver (&wfx_sdio_driver); +if (ret) + goto unregister_spi; + } + +return 0 ; + +unregister_spi: +if (IS_ENABLED (CONFIG_SPI )) +spi_unregister_driver (&wfx_spi_driver); +out:return ret; }module_init (wfx_core_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 289/826 wifi: cw1200: Fix potential NULL dereference
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit 2b94751626a6d49bbe42a19cc1503bd391016bd5 ]
A recent refactoring was identified by static analysis to cause a potential NULL dereference, fix this!
--- drivers/net/wireless/st/cw1200/cw1200_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/st/cw1200/cw1200_spi.c +1 -1
@@ -450,7 +450,7 @@ static int __maybe_unused cw1200_spi_suspend(struct device *dev) {struct hwbus_priv *self =spi_get_drvdata (to_spi_device (dev)); -if (!cw1200_can_suspend (self->core)) +if (self && !cw1200_can_suspend (self->core))return -EAGAIN ;/* XXX notify host that we have to keep CW1200 powered on? */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 290/826 drm/msm/dpu: cast crtc_clk calculation to u64 in _dpu_core_perf_calc_clk()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <[email protected]>
[ Upstream commit 20c7b42d9dbd048019bfe0af39229e3014007a98 ]
There may be a potential integer overflow issue in _dpu_core_perf_calc_clk(). crtc_clk is defined as u64, while mode->vtotal, mode->hdisplay, and drm_mode_vrefresh(mode) are defined as a smaller data type. The result of the calculation will be limited to "int" in this case without correct casting. In screen with high resolution and high refresh rate, integer overflow may happen. So, we recommend adding an extra cast to prevent potential integer overflow.
Patchwork: https://patchwork.freedesktop.org/patch/622206/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c +1 -1
@@ -80,7 +80,7 @@ static u64 _dpu_core_perf_calc_clk(const struct dpu_perf_cfg *perf_cfg, mode = &state->adjusted_mode; - crtc_clk = mode->vtotal * mode->hdisplay *drm_mode_vrefresh (mode); + crtc_clk = (u64 )mode->vtotal * mode->hdisplay *drm_mode_vrefresh (mode);drm_atomic_crtc_for_each_plane (plane, crtc) { pstate =to_dpu_plane_state (plane->state);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 291/826 bpf, bpftool: Fix incorrect disasm pc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <[email protected]>
[ Upstream commit 4d99e509c161f8610de125202c648fa4acd00541 ]
This patch addresses the bpftool issue "Wrong callq address displayed"[0].
The issue stemmed from an incorrect program counter (PC) value used during disassembly with LLVM or libbfd.
For LLVM: The PC argument must represent the actual address in the kernel to compute the correct relative address.
For libbfd: The relative address can be adjusted by adding func_ksym within the custom info->print_address_func to yield the correct address.
Links:
[0] https://github.com/libbpf/bpftool/issues/109
Changes:
v2 -> v3:
* Address comment from Quentin:
* Remove the typedef.
v1 -> v2:
* Fix the broken libbfd disassembler.
--- tools/bpf/bpftool/jit_disasm.c | 40 ++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 11 deletions(-)
tools/bpf/bpftool/jit_disasm.c +29 -11
@@ -80,7 +80,8 @@ symbol_lookup_callback(__maybe_unused void *disasm_info,static int init_context (disasm_ctx_t *ctx,const char *arch,__maybe_unused const char *disassembler_options, -__maybe_unused unsigned char *image,__maybe_unused ssize_t len) +__maybe_unused unsigned char *image,__maybe_unused ssize_t len, +__maybe_unused __u64 func_ksym) {char *triple;
@@ -109,12 +110,13 @@ static void destroy_context(disasm_ctx_t *ctx) }static int -disassemble_insn (disasm_ctx_t *ctx,unsigned char *image,ssize_t len,int pc) +disassemble_insn (disasm_ctx_t *ctx,unsigned char *image,ssize_t len,int pc, +__u64 func_ksym) {char buf[256 ];int count; - count =LLVMDisasmInstruction (*ctx, image + pc, len - pc, pc, + count =LLVMDisasmInstruction (*ctx, image + pc, len - pc, func_ksym + pc, buf,sizeof (buf));if (json_output)printf_json (buf);
@@ -136,8 +138,21 @@ int disasm_init(void)#ifdef HAVE_LIBBFD_SUPPORT #define DISASM_SPACER "\t" +struct disasm_info { +struct disassemble_info info; +__u64 func_ksym; +}; + +static void disasm_print_addr (bfd_vma addr,struct disassemble_info *info) +{ + struct disasm_info *dinfo = container_of(info, struct disasm_info, info); + + addr += dinfo->func_ksym; +generic_print_address (addr, info); +} +typedef struct { -struct disassemble_info *info; +struct disasm_info *info;disassembler_ftype disassemble;bfd *bfdf; }disasm_ctx_t ;
@@ -215,7 +230,7 @@ static int fprintf_json_styled(void *out,static int init_context (disasm_ctx_t *ctx,const char *arch,const char *disassembler_options, -unsigned char *image,ssize_t len) +unsigned char *image,ssize_t len,__u64 func_ksym) {struct disassemble_info *info;char tpath[PATH_MAX ];
@@ -238,12 +253,13 @@ static int init_context(disasm_ctx_t *ctx, const char *arch, } bfdf = ctx->bfdf; - ctx->info =malloc (sizeof (struct disassemble_info )); + ctx->info =malloc (sizeof (struct disasm_info ));if (!ctx->info) {p_err ("mem alloc failed" ); goto err_close; } - info = ctx->info; + ctx->info->func_ksym = func_ksym; + info = &ctx->info->info;if (json_output) init_disassemble_info_compat(info, stdout,
@@ -272,6 +288,7 @@ static int init_context(disasm_ctx_t *ctx, const char *arch, info->disassembler_options = disassembler_options; info->buffer = image; info->buffer_length = len; + info->print_address_func = disasm_print_addr;disassemble_init_for_target (info);
@@ -304,9 +321,10 @@ static void destroy_context(disasm_ctx_t *ctx)static int disassemble_insn (disasm_ctx_t *ctx,__maybe_unused unsigned char *image, -__maybe_unused ssize_t len,int pc) +__maybe_unused ssize_t len,int pc, +__maybe_unused __u64 func_ksym) { -return ctx->disassemble (pc, ctx->info); +return ctx->disassemble (pc, &ctx->info->info); }int disasm_init (void )
@@ -331,7 +349,7 @@ int disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,if (!len)return -1 ; -if (init_context (&ctx, arch, disassembler_options, image, len)) +if (init_context (&ctx, arch, disassembler_options, image, len, func_ksym))return -1 ;if (json_output)
@@ -360,7 +378,7 @@ int disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,printf ("%4x:" DISASM_SPACER , pc); } - count =disassemble_insn (&ctx, image, len, pc); + count =disassemble_insn (&ctx, image, len, pc, func_ksym);if (json_output) {/* Operand array, was started in fprintf_json. Before
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 292/826 bpf: Tighten tail call checks for lingering locks, RCU, preempt_disable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 46f7ed32f7a873d6675ea72e1d6317df41a55f81 ]
There are three situations when a program logically exits and transfers control to the kernel or another program: bpf_throw, BPF_EXIT, and tail calls. The former two check for any lingering locks and references, but tail calls currently do not. Expand the checks to check for spin locks, RCU read sections and preempt disabled sections.
Spin locks are indirectly preventing tail calls as function calls are disallowed, but the checks for preemption and RCU are more relaxed, hence ensure tail calls are prevented in their presence.
--- kernel/bpf/verifier.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
kernel/bpf/verifier.c +15 -0
@@ -10583,11 +10583,26 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insnswitch (func_id) {case BPF_FUNC_tail_call: +if (env->cur_state->active_lock.ptr) { +verbose (env,"tail_call cannot be used inside bpf_spin_lock-ed region\n" ); +return -EINVAL ; + } + err =check_reference_leak (env, false);if (err) {verbose (env,"tail_call would lead to reference leak\n" );return err; } + +if (env->cur_state->active_rcu_lock) { +verbose (env,"tail_call cannot be used inside bpf_rcu_read_lock-ed region\n" ); +return -EINVAL ; + } + +if (env->cur_state->active_preempt_lock) { +verbose (env,"tail_call cannot be used inside bpf_preempt_disable-ed region\n" ); +return -EINVAL ; + }break ;case BPF_FUNC_get_local_storage:/* check that flags argument in get_local_storage(map, flags) is 0,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 293/826 drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit 1d43dddd7c38ea1aa93f78f7ee10087afb0a561f ]
CRTC creation uses drmm_crtc_init_with_planes(), which automatically handles cleanup. However, an unnecessary call to drm_crtc_cleanup() is still present in the vkms_output_init() error path.
--- drivers/gpu/drm/vkms/vkms_output.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/gpu/drm/vkms/vkms_output.c +1 -4
@@ -84,7 +84,7 @@ int vkms_output_init(struct vkms_device *vkmsdev, int index) DRM_MODE_CONNECTOR_VIRTUAL);if (ret) {DRM_ERROR ("Failed to init connector\n" ); - goto err_connector; +return ret; }drm_connector_helper_add (connector, &vkms_conn_helper_funcs);
@@ -119,8 +119,5 @@ int vkms_output_init(struct vkms_device *vkmsdev, int index) err_encoder:drm_connector_cleanup (connector); -err_connector: -drm_crtc_cleanup (crtc); -return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 294/826 drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Huafei <[email protected]>
[ Upstream commit a1144da794adedb9447437c57d69add56494309d ]
Fix two issues with memory allocation in amdgpu_discovery_get_nps_info() for mem_ranges:
- Add a check for allocation failure to avoid dereferencing a null pointer.
- As suggested by Christophe, use kvcalloc() for memory allocation, which checks for multiplication overflow.
Additionally, assign the output parameters nps_type and range_cnt after the kvcalloc() call to prevent modifying the output parameters in case of an error return.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +5 -3
@@ -1757,11 +1757,13 @@ int amdgpu_discovery_get_nps_info(struct amdgpu_device *adev,switch (le16_to_cpu (nps_info->v1.header.version_major)) {case 1 : + mem_ranges =kvcalloc (nps_info->v1.count, +sizeof (*mem_ranges), +GFP_KERNEL ); +if (!mem_ranges) +return -ENOMEM ; *nps_type = nps_info->v1.nps_type; *range_cnt = nps_info->v1.count; - mem_ranges =kvzalloc ( - *range_cnt *sizeof (struct amdgpu_gmc_memrange ), -GFP_KERNEL );for (i =0 ; i < *range_cnt; i++) { mem_ranges[i].base_address = nps_info->v1.instance_info[i].base_address;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 295/826 drm/amdkfd: Use dynamic allocation for CU occupancy array in kfd_get_cu_occupancy()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 922f0e00017b09d9d47e3efac008c8b20ed546a0 ]
The kfd_get_cu_occupancy function previously declared a large cu_occupancy array as a local variable, which could lead to stack overflows due to excessive stack usage. This commit replaces the static array allocation with dynamic memory allocation using kcalloc, thereby reducing the stack size.
This change avoids the risk of stack overflows in kernel space, in scenarios where AMDGPU_MAX_QUEUES is large. The allocated memory is freed using kfree before the function returns to prevent memory leaks.
Fixes the below with gcc W=1:drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c: In function ‘kfd_get_cu_occupancy’:drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:322:1: warning: the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=]
322 | }
| ^
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +6 -3
@@ -271,11 +271,9 @@ static int kfd_get_cu_occupancy(struct attribute *attr, char *buffer)struct kfd_process *proc =NULL ;struct kfd_process_device *pdd =NULL ;int i; -struct kfd_cu_occupancy cu_occupancy[AMDGPU_MAX_QUEUES ]; +struct kfd_cu_occupancy *cu_occupancy;u32 queue_format; -memset (cu_occupancy,0x0 ,sizeof (cu_occupancy)); - pdd = container_of(attr, struct kfd_process_device, attr_cu_occupancy); dev = pdd->dev;if (dev->kfd2kgd->get_cu_occupancy ==NULL )
@@ -293,6 +291,10 @@ static int kfd_get_cu_occupancy(struct attribute *attr, char *buffer) wave_cnt =0 ; max_waves_per_cu =0 ; + cu_occupancy =kcalloc (AMDGPU_MAX_QUEUES ,sizeof (*cu_occupancy),GFP_KERNEL ); +if (!cu_occupancy) +return -ENOMEM ; +/* * For GFX 9.4.3, fetch the CU occupancy from the first XCC in the partition. * For AQL queues, because of cooperative dispatch we multiply the wave count
@@ -318,6 +320,7 @@ static int kfd_get_cu_occupancy(struct attribute *attr, char *buffer)/* Translate wave count to number of compute units */ cu_cnt = (wave_cnt + (max_waves_per_cu -1 )) / max_waves_per_cu; +kfree (cu_occupancy);return snprintf (buffer,PAGE_SIZE ,"%d\n" , cu_cnt); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 296/826 bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit cb4158ce8ec8a5bb528cc1693356a5eb8058094d ]
Arguments to a raw tracepoint are tagged as trusted, which carries the semantics that the pointer will be non-NULL. However, in certain cases, a raw tracepoint argument may end up being NULL. More context about this issue is available in [0].
Thus, there is a discrepancy between the reality, that raw_tp arguments can actually be NULL, and the verifier's knowledge, that they are never NULL, causing explicit NULL checks to be deleted, and accesses to such pointers potentially crashing the kernel.
To fix this, mark raw_tp arguments as PTR_MAYBE_NULL, and then special case the dereference and pointer arithmetic to permit it, and allow passing them into helpers/kfuncs; these exceptions are made for raw_tp programs only. Ensure that we don't do this when ref_obj_id > 0, as in that case this is an acquired object and doesn't need such adjustment.
The reason we do mask_raw_tp_trusted_reg logic is because other will recheck in places whether the register is a trusted_reg, and then consider our register as untrusted when detecting the presence of the PTR_MAYBE_NULL flag.
To allow safe dereference, we enable PROBE_MEM marking when we see loads into trusted pointers with PTR_MAYBE_NULL.
While trusted raw_tp arguments can also be passed into helpers or kfuncs where such broken assumption may cause issues, a future patch set will tackle their case separately, as PTR_TO_BTF_ID (without PTR_TRUSTED) can already be passed into helpers and causes similar problems. Thus, they are left alone for now.
It is possible that these checks also permit passing non-raw_tp args that are trusted PTR_TO_BTF_ID with null marking. In such a case, allowing dereference when pointer is NULL expands allowed behavior, so won't regress existing programs, and the case of passing these into helpers is the same as above and will be dealt with later.
Also update the failure case in tp_btf_nullable selftest to capture the new behavior, as the verifier will no longer cause an error when directly dereference a raw tracepoint argument marked as __nullable.
[0]: https://lore.kernel.org/bpf/[email protected]
--- include/linux/bpf.h | 6 ++ kernel/bpf/btf.c | 5 +- kernel/bpf/verifier.c | 79 +++++++++++++++++-- .../bpf/progs/test_tp_btf_nullable.c | 6 +- 4 files changed, 87 insertions(+), 9 deletions(-)
include/linux/bpf.h +6 -0
@@ -3461,4 +3461,10 @@ static inline bool bpf_is_subprog(const struct bpf_prog *prog) return prog->aux->func_idx != 0; } +static inline bool bpf_prog_is_raw_tp (const struct bpf_prog *prog) +{ +return prog->type ==BPF_PROG_TYPE_TRACING && + prog->expected_attach_type ==BPF_TRACE_RAW_TP ; +} +#endif /* _LINUX_BPF_H */
kernel/bpf/btf.c +4 -1
@@ -6564,7 +6564,10 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,if (prog_args_trusted (prog)) info->reg_type |=PTR_TRUSTED ; -if (btf_param_match_suffix (btf, &args[arg],"__nullable" )) +/* Raw tracepoint arguments always get marked as maybe NULL */ +if (bpf_prog_is_raw_tp (prog)) + info->reg_type |=PTR_MAYBE_NULL ; +else if (btf_param_match_suffix (btf, &args[arg],"__nullable" )) info->reg_type |=PTR_MAYBE_NULL ;if (tgt_prog) {
kernel/bpf/verifier.c +72 -7
223 lines not on this page · raw message
tools/testing/selftests/bpf/progs/test_tp_btf_nullable.c +5 -1
@@ -7,7 +7,11 @@#include "bpf_misc.h" SEC ("tp_btf/bpf_testmod_test_nullable_bare" ) -__failure __msg("R1 invalid mem access 'trusted_ptr_or_null_'") +/* This used to be a failure test, but raw_tp nullable arguments can now +* directly be dereferenced, whether they have nullable annotation or not, +* and don't need to be explicitly checked. + */ +__success int BPF_PROG(handle_tp_btf_nullable_bare1, struct bpf_testmod_test_read_ctx *nullable_ctx) {return nullable_ctx->len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 297/826 drm: use ATOMIC64_INIT() for atomic64_t
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Gray <[email protected]>
[ Upstream commit 9877bb2775d020fb7000af5ca989331d09d0e372 ]
use ATOMIC64_INIT() not ATOMIC_INIT() for atomic64_t
--- drivers/gpu/drm/drm_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_file.c +1 -1
@@ -129,7 +129,7 @@ bool drm_dev_needs_global_mutex(struct drm_device *dev)*/ struct drm_file *drm_file_alloc (struct drm_minor *minor) { -static atomic64_t ident =ATOMIC_INIT (0 ); +static atomic64_t ident =ATOMIC64_INIT (0 );struct drm_device *dev = minor->dev;struct drm_file *file;int ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 298/826 netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 9adbb4198bf6cf3634032871118a7052aeaa573f ]
On rule delete we get:
WARNING: suspicious RCU usage
net/netfilter/nf_tables_api.c:3420 RCU-list traversed in non-reader section!!
1 lock held by iptables/134:
#0: ffff888008c4fcc8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid (include/linux/jiffies.h:101) nf_tables
Code is fine, no other CPU can change the list because we're holding transaction mutex.
Pass the needed lockdep annotation to the iterator and fix two comments for functions that are no longer restricted to rcu-only context.
This is enough to resolve rule delete, but there are several other missing annotations, added in followup-patches.
--- net/netfilter/nf_tables_api.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
net/netfilter/nf_tables_api.c +13 -10
@@ -3412,13 +3412,15 @@ void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)* Rules */ -static struct nft_rule *__nft_rule_lookup (const struct nft_chain *chain, +static struct nft_rule *__nft_rule_lookup (const struct net *net, +const struct nft_chain *chain,u64 handle) {struct nft_rule *rule;// FIXME: this sucks -list_for_each_entry_rcu (rule, &chain->rules, list) { +list_for_each_entry_rcu (rule, &chain->rules, list, +lockdep_commit_lock_is_held (net)) {if (handle == rule->handle)return rule; }
@@ -3426,13 +3428,14 @@ static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,return ERR_PTR (-ENOENT ); } -static struct nft_rule *nft_rule_lookup (const struct nft_chain *chain, +static struct nft_rule *nft_rule_lookup (const struct net *net, +const struct nft_chain *chain,const struct nlattr *nla) {if (nla ==NULL )return ERR_PTR (-EINVAL ); -return __nft_rule_lookup (chain,be64_to_cpu (nla_get_be64 (nla))); +return __nft_rule_lookup (net, chain,be64_to_cpu (nla_get_be64 (nla))); }static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX +1 ] = {
@@ -3733,7 +3736,7 @@ static int nf_tables_dump_rules_done(struct netlink_callback *cb)return 0 ; } -/* called with rcu_read_lock held */ +/* Caller must hold rcu read lock or transaction mutex */ static struct sk_buff *nf_tables_getrule_single (u32 portid,const struct nfnl_info *info,const struct nlattr *const nla[],bool reset)
@@ -3760,7 +3763,7 @@ nf_tables_getrule_single(u32 portid, const struct nfnl_info *info,return ERR_CAST (chain); } - rule =nft_rule_lookup (chain, nla[NFTA_RULE_HANDLE ]); + rule =nft_rule_lookup (net, chain, nla[NFTA_RULE_HANDLE ]);if (IS_ERR (rule)) {NL_SET_BAD_ATTR (extack, nla[NFTA_RULE_HANDLE ]);return ERR_CAST (rule);
@@ -4058,7 +4061,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,if (nla[NFTA_RULE_HANDLE ]) { handle =be64_to_cpu (nla_get_be64 (nla[NFTA_RULE_HANDLE ])); - rule =__nft_rule_lookup (chain, handle); + rule =__nft_rule_lookup (net, chain, handle);if (IS_ERR (rule)) {NL_SET_BAD_ATTR (extack, nla[NFTA_RULE_HANDLE ]);return PTR_ERR (rule);
@@ -4080,7 +4083,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,if (nla[NFTA_RULE_POSITION ]) { pos_handle =be64_to_cpu (nla_get_be64 (nla[NFTA_RULE_POSITION ])); - old_rule =__nft_rule_lookup (chain, pos_handle); + old_rule =__nft_rule_lookup (net, chain, pos_handle);if (IS_ERR (old_rule)) {NL_SET_BAD_ATTR (extack, nla[NFTA_RULE_POSITION ]);return PTR_ERR (old_rule);
@@ -4297,7 +4300,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,if (chain) {if (nla[NFTA_RULE_HANDLE ]) { - rule =nft_rule_lookup (chain, nla[NFTA_RULE_HANDLE ]); + rule =nft_rule_lookup (info->net, chain, nla[NFTA_RULE_HANDLE ]);if (IS_ERR (rule)) {if (PTR_ERR (rule) == -ENOENT &&NFNL_MSG_TYPE (info->nlh->nlmsg_type) ==NFT_MSG_DESTROYRULE )
@@ -8104,7 +8107,7 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb)return 0 ; } -/* called with rcu_read_lock held */ +/* Caller must hold rcu read lock or transaction mutex */ static struct sk_buff *nf_tables_getobj_single (u32 portid,const struct nfnl_info *info,const struct nlattr *const nla[],bool reset)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 299/826 netfilter: nf_tables: must hold rcu read lock while iterating expression type list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit ee666a541ed957937454d50afa4757924508cd74 ]
nft shell tests trigger:
WARNING: suspicious RCU usage
net/netfilter/nf_tables_api.c:3125 RCU-list traversed in non-reader section!!
1 lock held by nft/2068:
#0: ffff888106c6f8c8 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nf_tables_valid_genid+0x3c/0xf0
But the transaction mutex doesn't protect this list, the nfnl subsystem mutex would, but we can't acquire it here without risk of ABBA deadlocks.
Acquire the rcu read lock to avoid this issue.
v3: add a comment that explains the ->inner_ops check implies expression is builtin and lack of a module owner reference is ok.
--- net/netfilter/nf_tables_api.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
net/netfilter/nf_tables_api.c +18 -6
@@ -3295,25 +3295,37 @@ int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla,if (!tb[NFTA_EXPR_DATA ] || !tb[NFTA_EXPR_NAME ])return -EINVAL ; +rcu_read_lock (); + type =__nft_expr_type_get (ctx->family, tb[NFTA_EXPR_NAME ]); -if (!type) -return -ENOENT ; +if (!type) { + err = -ENOENT ; + goto out_unlock; + } -if (!type->inner_ops) -return -EOPNOTSUPP ; +if (!type->inner_ops) { + err = -EOPNOTSUPP ; + goto out_unlock; + } err =nla_parse_nested_deprecated (info->tb, type->maxattr, tb[NFTA_EXPR_DATA ], type->policy,NULL );if (err <0 ) - goto err_nla_parse; + goto out_unlock; info->attr = nla; info->ops = type->inner_ops; +/* No module reference will be taken on type->owner. +* Presence of type->inner_ops implies that the expression +* is builtin, so it cannot go away. +*/ +rcu_read_unlock ();return 0 ; -err_nla_parse: +out_unlock: +rcu_read_unlock ();return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 300/826 netfilter: nf_tables: must hold rcu read lock while iterating object type list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit cddc04275f95ca3b18da5c0fb111705ac173af89 ]
Update of stateful object triggers:
WARNING: suspicious RCU usagenet/netfilter/nf_tables_api.c:7759 RCU-list traversed in non-reader section!!
other info that might help us debug this:rcu_scheduler_active = 2, debug_locks = 1
1 lock held by nft/3060:
#0: ffff88810f0578c8 (&nft_net->commit_mutex){+.+.}-{4:4}, [..]
... but this list is not protected by the transaction mutex but the nfnl nftables subsystem mutex.
Switch to nft_obj_type_get which will acquire rcu read lock, bump refcount, and returns the result.
v3: Dan Carpenter points out nft_obj_type_get returns error pointer, not NULL, on error.
--- net/netfilter/nf_tables_api.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
net/netfilter/nf_tables_api.c +6 -7
@@ -7805,9 +7805,7 @@ static int nf_tables_updobj(const struct nft_ctx *ctx,struct nft_trans *trans;int err = -ENOMEM ; -if (!try_module_get (type->owner)) -return -ENOENT ; - +/* caller must have obtained type->owner reference. */ trans =nft_trans_alloc (ctx,NFT_MSG_NEWOBJ ,sizeof (struct nft_trans_obj ));if (!trans)
@@ -7875,15 +7873,16 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,if (info->nlh->nlmsg_flags &NLM_F_REPLACE )return -EOPNOTSUPP ; - type =__nft_obj_type_get (objtype, family); -if (WARN_ON_ONCE (!type)) -return -ENOENT ; -if (!obj->ops->update)return 0 ; + type =nft_obj_type_get (net, objtype, family); +if (WARN_ON_ONCE (IS_ERR (type))) +return PTR_ERR (type); +nft_ctx_init (&ctx, net, skb, info->nlh, family, table,NULL , nla); +/* type->owner reference is put when transaction object is released. */ return nf_tables_updobj (&ctx, type, nla[NFTA_OBJ_DATA ], obj); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 301/826 netlink: typographical error in nlmsg_type constants definition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurice Lambert <[email protected]>
[ Upstream commit 84bfbfbbd32aee136afea4b6bf82581dce79c305 ]
This commit fix a typographical error in netlink nlmsg_type constants definition in the include/uapi/linux/rtnetlink.h at line 177. The definition is RTM_NEWNVLAN RTM_NEWVLAN instead of RTM_NEWVLAN RTM_NEWVLAN.
--- include/uapi/linux/rtnetlink.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/rtnetlink.h +1 -1
@@ -174,7 +174,7 @@ enum {#define RTM_GETLINKPROP RTM_GETLINKPROP RTM_NEWVLAN = 112, -#define RTM_NEWNVLAN RTM_NEWVLAN +#define RTM_NEWVLAN RTM_NEWVLAN RTM_DELVLAN,#define RTM_DELVLAN RTM_DELVLAN RTM_GETVLAN,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 302/826 wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit 81df5ed446b448bdc327b7c7f0b50121fc1f4aa2 ]
kmalloc may fail, return value might be NULL and will cause NULL pointer dereference. Add check NULL return of kmalloc in btc_fw_set_monreg().
--- drivers/net/wireless/realtek/rtw89/coex.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/realtek/rtw89/coex.c +4 -0
@@ -2492,6 +2492,8 @@ static void btc_fw_set_monreg(struct rtw89_dev *rtwdev)if (ver->fcxmreg ==7 ) { sz =struct_size (v7, regs, n); v7 =kmalloc (sz,GFP_KERNEL ); +if (!v7) +return ; v7->type =RPT_EN_MREG ; v7->fver = ver->fcxmreg; v7->len = n;
@@ -2506,6 +2508,8 @@ static void btc_fw_set_monreg(struct rtw89_dev *rtwdev) }else { sz =struct_size (v1, regs, n); v1 =kmalloc (sz,GFP_KERNEL ); +if (!v1) +return ; v1->fver = ver->fcxmreg; v1->reg_num = n;memcpy (v1->regs, chip->mon_reg,flex_array_size (v1, regs, n));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 303/826 drm/panfrost: Add missing OPP table refcnt decremental
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 043e8afebf6c19abde9da1ac3d5cbf8b7ac8393f ]
Commit f11b0417eec2 ("drm/panfrost: Add fdinfo support GPU load metrics") retrieves the OPP for the maximum device clock frequency, but forgets to keep the reference count balanced by putting the returned OPP object. This eventually leads to an OPP core warning when removing the device.
Fix it by putting OPP objects as many times as they're retrieved.
Also remove an unnecessary whitespace.
--- drivers/gpu/drm/panfrost/panfrost_devfreq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/panfrost/panfrost_devfreq.c +2 -1
@@ -38,7 +38,7 @@ static int panfrost_devfreq_target(struct device *dev, unsigned long *freq,return PTR_ERR (opp);dev_pm_opp_put (opp); - err =dev_pm_opp_set_rate (dev, *freq); + err =dev_pm_opp_set_rate (dev, *freq);if (!err) ptdev->pfdevfreq.current_frequency = *freq;
@@ -182,6 +182,7 @@ int panfrost_devfreq_init(struct panfrost_device *pfdev)* if any and will avoid a switch off by regulator_late_cleanup() */ ret =dev_pm_opp_set_opp (dev, opp); +dev_pm_opp_put (opp);if (ret) {DRM_DEV_ERROR (dev,"Couldn't set recommended OPP\n" );return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 304/826 drm/panthor: introduce job cycle and timestamp accounting
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit f8ff51a4708451763e6cfa36cc83dea8513d3318 ]
Enable calculations of job submission times in clock cycles and wall time. This is done by expanding the boilerplate command stream when running a job to include instructions that compute said times right before and after a user CS.
A separate kernel BO is created per queue to store those values. Jobs can access their sampled data through an index different from that of the queue's ringbuffer. The reason for this is saving memory on the profiling information kernel BO, since the amount of simultaneous profiled jobs we can write into the queue's ringbuffer might be much smaller than for regular jobs, as the former take more CSF instructions.
This commit is done in preparation for enabling DRM fdinfo support in the Panthor driver, which depends on the numbers calculated herein.
A profile mode mask has been added that will in a future commit allow UM to toggle performance metric sampling behaviour, which is disabled by default to save power. When a ringbuffer CS is constructed, timestamp and cycling sampling instructions are added depending on the enabled flags in the profiling mask.
A helper was provided that calculates the number of instructions for a given set of enablement mask, and these are passed as the number of credits when initialising a DRM scheduler job.
Stable-dep-of: 21c23e4b64e3 ("drm/panthor: Fix OPP refcnt leaks in devfreq initialisation")
--- drivers/gpu/drm/panthor/panthor_device.h | 22 ++ drivers/gpu/drm/panthor/panthor_sched.c | 333 +++++++++++++++++++---- 2 files changed, 306 insertions(+), 49 deletions(-)
drivers/gpu/drm/panthor/panthor_device.h +22 -0
@@ -66,6 +66,25 @@ struct panthor_irq {atomic_t suspended; }; +/** +* enum panthor_device_profiling_mode - Profiling state +*/ +enum panthor_device_profiling_flags { +/** @PANTHOR_DEVICE_PROFILING_DISABLED: Profiling is disabled. */ +PANTHOR_DEVICE_PROFILING_DISABLED =0 , + +/** @PANTHOR_DEVICE_PROFILING_CYCLES: Sampling job cycles. */ +PANTHOR_DEVICE_PROFILING_CYCLES =BIT (0 ), + +/** @PANTHOR_DEVICE_PROFILING_TIMESTAMP: Sampling job timestamp. */ +PANTHOR_DEVICE_PROFILING_TIMESTAMP =BIT (1 ), + +/** @PANTHOR_DEVICE_PROFILING_ALL: Sampling everything. */ +PANTHOR_DEVICE_PROFILING_ALL = +PANTHOR_DEVICE_PROFILING_CYCLES | +PANTHOR_DEVICE_PROFILING_TIMESTAMP , +}; +/** * struct panthor_device - Panthor device */
@@ -162,6 +181,9 @@ struct panthor_device {*/ struct page *dummy_latest_flush; } pm; + +/** @profile_mask: User-set profiling flags for job accounting. */ +u32 profile_mask; };/**
drivers/gpu/drm/panthor/panthor_sched.c +284 -49
434 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 305/826 drm/panthor: record current and maximum device clock frequencies
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 37591ae11f89cdfc0a647945a589468642a44c17 ]
In order to support UM in calculating rates of GPU utilisation, the current operating and maximum GPU clock frequencies must be recorded during device initialisation, and also during OPP state transitions.
Stable-dep-of: 21c23e4b64e3 ("drm/panthor: Fix OPP refcnt leaks in devfreq initialisation")
--- drivers/gpu/drm/panthor/panthor_devfreq.c | 18 +++++++++++++++++- drivers/gpu/drm/panthor/panthor_device.h | 6 ++++++ 2 files changed, 23 insertions(+), 1 deletion(-)
drivers/gpu/drm/panthor/panthor_devfreq.c +17 -1
@@ -62,14 +62,20 @@ static void panthor_devfreq_update_utilization(struct panthor_devfreq *pdevfreq)static int panthor_devfreq_target (struct device *dev,unsigned long *freq,u32 flags) { +struct panthor_device *ptdev =dev_get_drvdata (dev);struct dev_pm_opp *opp; +int err; opp =devfreq_recommended_opp (dev, freq, flags);if (IS_ERR (opp))return PTR_ERR (opp);dev_pm_opp_put (opp); -return dev_pm_opp_set_rate (dev, *freq); + err =dev_pm_opp_set_rate (dev, *freq); +if (!err) + ptdev->current_frequency = *freq; + +return err; }static void panthor_devfreq_reset (struct panthor_devfreq *pdevfreq)
@@ -130,6 +136,7 @@ int panthor_devfreq_init(struct panthor_device *ptdev)struct panthor_devfreq *pdevfreq;struct dev_pm_opp *opp;unsigned long cur_freq; +unsigned long freq =ULONG_MAX ;int ret; pdevfreq =drmm_kzalloc (&ptdev->base,sizeof (*ptdev->devfreq),GFP_KERNEL );
@@ -161,6 +168,7 @@ int panthor_devfreq_init(struct panthor_device *ptdev)return PTR_ERR (opp); panthor_devfreq_profile.initial_freq = cur_freq; + ptdev->current_frequency = cur_freq;/* Regulator coupling only takes care of synchronizing/balancing voltage * updates, but the coupled regulator needs to be enabled manually.
@@ -204,6 +212,14 @@ int panthor_devfreq_init(struct panthor_device *ptdev)dev_pm_opp_put (opp); +/* Find the fastest defined rate */ + opp =dev_pm_opp_find_freq_floor (dev, &freq); +if (IS_ERR (opp)) +return PTR_ERR (opp); + ptdev->fast_rate = freq; + +dev_pm_opp_put (opp); +/* * Setup default thresholds for the simple_ondemand governor. * The values are chosen based on experiments.
drivers/gpu/drm/panthor/panthor_device.h +6 -0
@@ -184,6 +184,12 @@ struct panthor_device {/** @profile_mask: User-set profiling flags for job accounting. */ u32 profile_mask; + +/** @current_frequency: Device clock frequency at present. Set by DVFS*/ +unsigned long current_frequency; + +/** @fast_rate: Maximum device clock frequency. Set by DVFS */ +unsigned long fast_rate; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 306/826 drm/panthor: Fix OPP refcnt leaks in devfreq initialisation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <[email protected]>
[ Upstream commit 21c23e4b64e360d74d31b480f0572c2add0e8558 ]
Rearrange lookup of recommended OPP for the Mali GPU device and its refcnt decremental to make sure no OPP object leaks happen in the error path.
--- drivers/gpu/drm/panthor/panthor_devfreq.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
drivers/gpu/drm/panthor/panthor_devfreq.c +8 -9
@@ -163,13 +163,6 @@ int panthor_devfreq_init(struct panthor_device *ptdev) cur_freq =clk_get_rate (ptdev->clks.core); - opp =devfreq_recommended_opp (dev, &cur_freq,0 ); -if (IS_ERR (opp)) -return PTR_ERR (opp); - - panthor_devfreq_profile.initial_freq = cur_freq; - ptdev->current_frequency = cur_freq; -/* Regulator coupling only takes care of synchronizing/balancing voltage * updates, but the coupled regulator needs to be enabled manually. *
@@ -200,18 +193,24 @@ int panthor_devfreq_init(struct panthor_device *ptdev)return ret; } + opp =devfreq_recommended_opp (dev, &cur_freq,0 ); +if (IS_ERR (opp)) +return PTR_ERR (opp); + + panthor_devfreq_profile.initial_freq = cur_freq; + ptdev->current_frequency = cur_freq; +/* * Set the recommend OPP this will enable and configure the regulator * if any and will avoid a switch off by regulator_late_cleanup() */ ret =dev_pm_opp_set_opp (dev, opp); +dev_pm_opp_put (opp);if (ret) {DRM_DEV_ERROR (dev,"Couldn't set recommended OPP\n" );return ret; } -dev_pm_opp_put (opp); -/* Find the fastest defined rate */ opp =dev_pm_opp_find_freq_floor (dev, &freq);if (IS_ERR (opp))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 307/826 isofs: avoid memory leak in iocharset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Ge <[email protected]>
[ Upstream commit 0b5bbeee4de616a268db77e2f40f19ab010a367b ]
A memleak was found as below:
unreferenced object 0xffff0000d10164d8 (size 8):
comm "pool-udisksd", pid 108217, jiffies 4295408555 hex dump (first 8 bytes):
75 74 66 38 00 cc cc cc utf8....
backtrace (crc de430d31):
[<ffff800081046e6c>] kmemleak_alloc+0xb8/0xc8
[<ffff8000803e6c3c>] __kmalloc_node_track_caller_noprof+0x380/0x474
[<ffff800080363b74>] kstrdup+0x70/0xfc
[<ffff80007bb3c6a4>] isofs_parse_param+0x228/0x2c0 [isofs]
[<ffff8000804d7f68>] vfs_parse_fs_param+0xf4/0x164
[<ffff8000804d8064>] vfs_parse_fs_string+0x8c/0xd4
[<ffff8000804d815c>] vfs_parse_monolithic_sep+0xb0/0xfc
[<ffff8000804d81d8>] generic_parse_monolithic+0x30/0x3c
[<ffff8000804d8bfc>] parse_monolithic_mount_data+0x40/0x4c
[<ffff8000804b6a64>] path_mount+0x6c4/0x9ec
[<ffff8000804b6e38>] do_mount+0xac/0xc4
[<ffff8000804b7494>] __arm64_sys_mount+0x16c/0x2b0
[<ffff80008002b8dc>] invoke_syscall+0x7c/0x104
[<ffff80008002ba44>] el0_svc_common.constprop.1+0xe0/0x104
[<ffff80008002ba94>] do_el0_svc+0x2c/0x38
[<ffff800081041108>] el0_svc+0x3c/0x1b8The opt->iocharset is freed inside the isofs_fill_super function, But there may be situations where it's not possible to enter this function.
For example, in the get_tree_bdev_flags function,when encountering the situation where "Can't mount, would change RO state," In such a case, isofs_fill_super will not have the opportunity to be called,which means that opt->iocharset will not have the chance to be freed,ultimately leading to a memory leak.
Let's move the memory freeing of opt->iocharset into isofs_free_fc function.
--- fs/isofs/inode.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/isofs/inode.c +4 -4
@@ -948,8 +948,6 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc) goto out_no_inode; } -kfree (opt->iocharset); -return 0 ;/*
@@ -987,7 +985,6 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc)brelse (bh);brelse (pri_bh); out_freesbi: -kfree (opt->iocharset);kfree (sbi); s->s_fs_info =NULL ;return error;
@@ -1528,7 +1525,10 @@ static int isofs_get_tree(struct fs_context *fc)static void isofs_free_fc (struct fs_context *fc) { -kfree (fc->fs_private); +struct isofs_options *opt = fc->fs_private; + +kfree (opt->iocharset); +kfree (opt); }static const struct fs_context_operations isofs_context_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 308/826 selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 66c54c20408d994be34be2c070fba08472f69eee ]
Add txmsg_pass to test_txmsg_pull/push/pop. If txmsg_pass is missing, tx_prog will be NULL, and no program will be attached to the sockmap. As a result, pull/push/pop are never invoked.
--- tools/testing/selftests/bpf/test_sockmap.c | 7 +++++++ 1 file changed, 7 insertions(+)
tools/testing/selftests/bpf/test_sockmap.c +7 -0
@@ -1596,11 +1596,13 @@ static void test_txmsg_cork_hangs(int cgrp, struct sockmap_options *opt)static void test_txmsg_pull (int cgrp,struct sockmap_options *opt) {/* Test basic start/end */ + txmsg_pass =1 ; txmsg_start =1 ; txmsg_end =2 ;test_send (opt, cgrp);/* Test >4k pull */ + txmsg_pass =1 ; txmsg_start =4096 ; txmsg_end =9182 ;test_send_large (opt, cgrp);
@@ -1629,11 +1631,13 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)static void test_txmsg_pop (int cgrp,struct sockmap_options *opt) {/* Test basic pop */ + txmsg_pass =1 ; txmsg_start_pop =1 ; txmsg_pop =2 ;test_send_many (opt, cgrp);/* Test pop with >4k */ + txmsg_pass =1 ; txmsg_start_pop =4096 ; txmsg_pop =4096 ;test_send_large (opt, cgrp);
@@ -1662,11 +1666,13 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)static void test_txmsg_push (int cgrp,struct sockmap_options *opt) {/* Test basic push */ + txmsg_pass =1 ; txmsg_start_push =1 ; txmsg_end_push =1 ;test_send (opt, cgrp);/* Test push 4kB >4k */ + txmsg_pass =1 ; txmsg_start_push =4096 ; txmsg_end_push =4096 ;test_send_large (opt, cgrp);
@@ -1687,6 +1693,7 @@ static void test_txmsg_push(int cgrp, struct sockmap_options *opt)static void test_txmsg_push_pop (int cgrp,struct sockmap_options *opt) { + txmsg_pass =1 ; txmsg_start_push =1 ; txmsg_end_push =10 ; txmsg_start_pop =5 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 309/826 selftests/bpf: Fix SENDPAGE data logic in test_sockmap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 4095031463d4e99b534d2cd82035a417295764ae ]
In the SENDPAGE test, "opt->iov_length * cnt" size of data will be sent cnt times by sendfile.
1. In push/pop tests, they will be invoked cnt times, for the simplicity of msg_verify_data, change chunk_sz to iov_length
2. Change iov_length in test_send_large from 1024 to 8192. We have pop test where txmsg_start_pop is 4096. 4096 > 1024, an error will be returned.
--- tools/testing/selftests/bpf/test_sockmap.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +11 -7
@@ -420,16 +420,18 @@ static int msg_loop_sendpage(int fd, int iov_length, int cnt, {bool drop = opt->drop_expected;unsigned char k =0 ; +int i, j, fp;FILE *file; -int i, fp; file =tmpfile ();if (!file) {perror ("create file for sendpage" );return 1 ; } -for (i =0 ; i < iov_length * cnt; i++, k++) -fwrite (&k,sizeof (char ),1 , file); +for (i =0 ; i < cnt; i++, k =0 ) { +for (j =0 ; j < iov_length; j++, k++) +fwrite (&k,sizeof (char ),1 , file); + }fflush (file);fseek (file,0 ,SEEK_SET );
@@ -623,7 +625,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,* This is really only useful for testing edge cases in code * paths. */ - total_bytes = (float )iov_count * (float )iov_length * (float )cnt; + total_bytes = (float )iov_length * (float )cnt; +if (!opt->sendpage) + total_bytes *= (float )iov_count;if (txmsg_apply) txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply);else
@@ -701,7 +705,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,if (data) {int chunk_sz = opt->sendpage ? - iov_length * cnt : + iov_length : iov_length * iov_count; errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt);
@@ -1466,8 +1470,8 @@ static void test_send_many(struct sockmap_options *opt, int cgrp)static void test_send_large (struct sockmap_options *opt,int cgrp) { - opt->iov_length =256 ; - opt->iov_count =1024 ; + opt->iov_length =8192 ; + opt->iov_count =32 ; opt->rate =2 ;test_exec (cgrp, opt); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 310/826 selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 523dffccbadea0cfd65f1ff04944b864c558c4a8 ]
total_bytes in msg_loop_rx should also take push into account, otherwise total_bytes will be a smaller value, which makes the msg_loop_rx end early.
Besides, total_bytes has already taken pop into account, so we don't need to subtract some bytes from iov_buf in sendmsg_test. The additional subtraction may make total_bytes a negative number, and msg_loop_rx will just end without checking anything.
--- tools/testing/selftests/bpf/test_sockmap.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +7 -5
@@ -606,8 +606,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, }clock_gettime (CLOCK_MONOTONIC , &s->end); }else { +float total_bytes, txmsg_pop_total, txmsg_push_total;int slct, recvp =0 , recv, max_fd = fd; -float total_bytes, txmsg_pop_total;int fd_flags =O_NONBLOCK ;struct timeval timeout;unsigned char k =0 ;
@@ -628,10 +628,14 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, total_bytes = (float )iov_length * (float )cnt;if (!opt->sendpage) total_bytes *= (float )iov_count; -if (txmsg_apply) +if (txmsg_apply) { + txmsg_push_total = txmsg_end_push * (total_bytes / txmsg_apply); txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply); -else + }else { + txmsg_push_total = txmsg_end_push * cnt; txmsg_pop_total = txmsg_pop * cnt; + } + total_bytes += txmsg_push_total; total_bytes -= txmsg_pop_total; err =clock_gettime (CLOCK_MONOTONIC , &s->start);if (err <0 )
@@ -800,8 +804,6 @@ static int sendmsg_test(struct sockmap_options *opt) rxpid =fork ();if (rxpid ==0 ) { -if (txmsg_pop || txmsg_start_pop) - iov_buf -= (txmsg_pop - txmsg_start_pop +1 );if (opt->drop_expected || txmsg_ktls_skb_drop)_exit (0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 311/826 selftests/bpf: Add push/pop checking for msg_verify_data in test_sockmap
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 862087c3d36219ed44569666eb263efc97f00c9a ]
Add push/pop checking for msg_verify_data in test_sockmap, except for pop/push with cork tests, in these tests the logic will be different.
1. With corking, pop/push might not be invoked in each sendmsg, it makes the layout of the received data difficult
2. It makes it hard to calculate the total_bytes in the recvmsg Temporarily skip the data integrity test for these cases now, added a TODO
--- tools/testing/selftests/bpf/test_sockmap.c | 106 ++++++++++++++++++++- 1 file changed, 101 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/test_sockmap.c +101 -5
@@ -88,6 +88,10 @@ int ktls;int peek_flag;int skb_use_parser;int txmsg_omit_skb_parser; +int verify_push_start; +int verify_push_len; +int verify_pop_start; +int verify_pop_len;static const struct option long_options[] = { {"help" , no_argument,NULL ,'h' },
@@ -514,12 +518,41 @@ static int msg_alloc_iov(struct msghdr *msg,return -ENOMEM ; } -/* TODO: Add verification logic for push, pull and pop data */ +/* In push or pop test, we need to do some calculations for msg_verify_data */ +static void msg_verify_date_prep (void ) +{ +int push_range_end = txmsg_start_push + txmsg_end_push -1 ; +int pop_range_end = txmsg_start_pop + txmsg_pop -1 ; + +if (txmsg_end_push && txmsg_pop && + txmsg_start_push <= pop_range_end && txmsg_start_pop <= push_range_end) { +/* The push range and the pop range overlap */ +int overlap_len; + + verify_push_start = txmsg_start_push; + verify_pop_start = txmsg_start_pop; +if (txmsg_start_push < txmsg_start_pop) + overlap_len =min (push_range_end - txmsg_start_pop +1 , txmsg_pop); +else + overlap_len =min (pop_range_end - txmsg_start_push +1 , txmsg_end_push); + verify_push_len =max (txmsg_end_push - overlap_len,0 ); + verify_pop_len =max (txmsg_pop - overlap_len,0 ); + }else { +/* Otherwise */ + verify_push_start = txmsg_start_push; + verify_pop_start = txmsg_start_pop; + verify_push_len = txmsg_end_push; + verify_pop_len = txmsg_pop; + } +} +static int msg_verify_data (struct msghdr *msg,int size,int chunk_sz, -unsigned char *k_p,int *bytes_cnt_p) +unsigned char *k_p,int *bytes_cnt_p, +int *check_cnt_p,int *push_p) { -int i, j, bytes_cnt = *bytes_cnt_p; +int bytes_cnt = *bytes_cnt_p, check_cnt = *check_cnt_p, push = *push_p;unsigned char k = *k_p; +int i, j;for (i =0 , j =0 ; i < msg->msg_iovlen && size; i++, j =0 ) {unsigned char *d = msg->msg_iov[i].iov_base;
@@ -538,6 +571,37 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz, }for (; j < msg->msg_iov[i].iov_len && size; j++) { +if (push >0 && + check_cnt == verify_push_start + verify_push_len - push) { +int skipped; +revisit_push: + skipped = push; +if (j + push >= msg->msg_iov[i].iov_len) + skipped = msg->msg_iov[i].iov_len - j; + push -= skipped; + size -= skipped; + j += skipped -1 ; + check_cnt += skipped; +continue ; + } + +if (verify_pop_len >0 && check_cnt == verify_pop_start) { + bytes_cnt += verify_pop_len; + check_cnt += verify_pop_len; + k += verify_pop_len; + +if (bytes_cnt == chunk_sz) { + k =0 ; + bytes_cnt =0 ; + check_cnt =0 ; + push = verify_push_len; + } + +if (push >0 && + check_cnt == verify_push_start + verify_push_len - push) + goto revisit_push; + } +if (d[j] != k++) { fprintf(stderr, "detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n",
@@ -545,15 +609,20 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz,return -EDATAINTEGRITY ; } bytes_cnt++; + check_cnt++;if (bytes_cnt == chunk_sz) { k =0 ; bytes_cnt =0 ; + check_cnt =0 ; + push = verify_push_len; } size--; } } *k_p = k; *bytes_cnt_p = bytes_cnt; + *check_cnt_p = check_cnt; + *push_p = push;return 0 ; }
@@ -612,6 +681,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,struct timeval timeout;unsigned char k =0 ;int bytes_cnt =0 ; +int check_cnt =0 ; +int push =0 ;fd_set w;fcntl (fd, fd_flags);
@@ -637,6 +708,10 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, } total_bytes += txmsg_push_total; total_bytes -= txmsg_pop_total; +if (data) { +msg_verify_date_prep (); + push = verify_push_len; + } err =clock_gettime (CLOCK_MONOTONIC , &s->start);if (err <0 )perror ("recv start time" );
@@ -712,7 +787,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, iov_length :iov_length * iov_count; - errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt); + errno =msg_verify_data (&msg, recv, chunk_sz, &k, &bytes_cnt, + &check_cnt, &push);if (errno) {perror ("data verify msg failed" ); goto out_errno;
@@ -722,7 +798,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, recvp, chunk_sz, &k, - &bytes_cnt); + &bytes_cnt, + &check_cnt, + &push);if (errno) {perror ("data verify msg_peek failed" ); goto out_errno;
@@ -1636,6 +1714,8 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)static void test_txmsg_pop (int cgrp,struct sockmap_options *opt) { +bool data = opt->data_test; +/* Test basic pop */ txmsg_pass =1 ; txmsg_start_pop =1 ;
@@ -1654,6 +1734,12 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt) txmsg_pop =2 ;test_send_many (opt, cgrp); +/* TODO: Test for pop + cork should be different, +* - It makes the layout of the received data difficult +* - It makes it hard to calculate the total_bytes in the recvmsg +* Temporarily skip the data integrity test for this case now. +*/ + opt->data_test = false;/* Test pop + cork */ txmsg_redir =0 ; txmsg_cork =512 ;
@@ -1667,10 +1753,13 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt) txmsg_start_pop =1 ; txmsg_pop =2 ;test_send_many (opt, cgrp); + opt->data_test = data; }static void test_txmsg_push (int cgrp,struct sockmap_options *opt) { +bool data = opt->data_test; +/* Test basic push */ txmsg_pass =1 ; txmsg_start_push =1 ;
@@ -1689,12 +1778,19 @@ static void test_txmsg_push(int cgrp, struct sockmap_options *opt) txmsg_end_push =2 ;test_send_many (opt, cgrp); +/* TODO: Test for push + cork should be different, +* - It makes the layout of the received data difficult +* - It makes it hard to calculate the total_bytes in the recvmsg +* Temporarily skip the data integrity test for this case now. +*/ + opt->data_test = false;/* Test push + cork */ txmsg_redir =0 ; txmsg_cork =512 ; txmsg_start_push =1 ; txmsg_end_push =2 ;test_send_many (opt, cgrp); + opt->data_test = data; }static void test_txmsg_push_pop (int cgrp,struct sockmap_options *opt)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 312/826 bpf, sockmap: Several fixes to bpf_msg_push_data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 15ab0548e3107665c34579ae523b2b6e7c22082a ]
Several fixes to bpf_msg_push_data,
1. test_sockmap has tests where bpf_msg_push_data is invoked to push some data at the end of a message, but -EINVAL is returned. In this case, in bpf_msg_push_data, after the first loop, i will be set to msg->sg.end, add the logic to handle it.
2. In the code block of "if (start - offset)", it's possible that "i" points to the last of sk_msg_elem. In this case, "sk_msg_iter_next(msg, end)" might still be called twice, another invoking is in "if (!copy)" code block, but actually only one is needed. Add the logic to handle it, and reconstruct the code to make the logic more clear.
--- net/core/filter.c | 53 +++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 20 deletions(-)
net/core/filter.c +33 -20
@@ -2795,7 +2795,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,sk_msg_iter_var_next (i); }while (i != msg->sg.end); -if (start >= offset + l) +if (start > offset + l)return -EINVAL ; space =MAX_MSG_FRAGS -sk_msg_elem_used (msg);
@@ -2820,6 +2820,8 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, raw =page_address (page); +if (i == msg->sg.end) +sk_msg_iter_var_prev (i); psge =sk_msg_elem (msg, i); front = start - offset; back = psge->length - front;
@@ -2836,7 +2838,13 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start, }put_page (sg_page (psge)); - }else if (start - offset) { + new = i; + goto place_new; + } + +if (start - offset) { +if (i == msg->sg.end) +sk_msg_iter_var_prev (i); psge =sk_msg_elem (msg, i); rsge =sk_msg_elem_cpy (msg, i);
@@ -2847,39 +2855,44 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,sk_msg_iter_var_next (i);sg_unmark_end (psge);sg_unmark_end (&rsge); -sk_msg_iter_next (msg, end); }/* Slot(s) to place newly allocated data */ +sk_msg_iter_next (msg, end); new = i; +sk_msg_iter_var_next (i); + +if (i == msg->sg.end) { +if (!rsge.length) + goto place_new; +sk_msg_iter_next (msg, end); + goto place_new; + }/* Shift one or two slots as needed */ -if (!copy) { - sge =sk_msg_elem_cpy (msg, i); + sge =sk_msg_elem_cpy (msg, new); +sg_unmark_end (&sge); + nsge =sk_msg_elem_cpy (msg, i); +if (rsge.length) {sk_msg_iter_var_next (i); -sg_unmark_end (&sge); + nnsge =sk_msg_elem_cpy (msg, i);sk_msg_iter_next (msg, end); + } - nsge =sk_msg_elem_cpy (msg, i); +while (i != msg->sg.end) { + msg->sg.data[i] = sge; + sge = nsge; +sk_msg_iter_var_next (i);if (rsge.length) { -sk_msg_iter_var_next (i); + nsge = nnsge; nnsge =sk_msg_elem_cpy (msg, i); - } - -while (i != msg->sg.end) { - msg->sg.data[i] = sge; - sge = nsge; -sk_msg_iter_var_next (i); -if (rsge.length) { - nsge = nnsge; - nnsge =sk_msg_elem_cpy (msg, i); - }else { - nsge =sk_msg_elem_cpy (msg, i); - } + }else { + nsge =sk_msg_elem_cpy (msg, i); } } +place_new:/* Place newly allocated data buffer */ sk_mem_charge (msg->sk, len); msg->sg.size += len;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 313/826 bpf, sockmap: Several fixes to bpf_msg_pop_data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 5d609ba262475db450ba69b8e8a557bd768ac07a ]
Several fixes to bpf_msg_pop_data,
1. In sk_msg_shift_left, we should put_page
2. if (len == 0), return early is better
3. pop the entire sk_msg (last == msg->sg.size) should be supported
4. Fix for the value of variable "a"
5. In sk_msg_shift_left, after shifting, i has already pointed to the next element. Addtional sk_msg_iter_var_next may result in BUG.
--- net/core/filter.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/core/filter.c +9 -6
@@ -2921,8 +2921,10 @@ static const struct bpf_func_proto bpf_msg_push_data_proto = {static void sk_msg_shift_left (struct sk_msg *msg,int i) { +struct scatterlist *sge =sk_msg_elem (msg, i);int prev; +put_page (sg_page (sge)); do { prev = i; sk_msg_iter_var_next(i);
@@ -2959,6 +2961,9 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,if (unlikely (flags))return -EINVAL ; +if (unlikely (len ==0 )) +return 0 ; +/* First find the starting scatterlist element */ i = msg->sg.start; do {
@@ -2971,7 +2976,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, }while (i != msg->sg.end);/* Bounds checks: start and pop must be inside message */ -if (start >= offset + l || last >= msg->sg.size) +if (start >= offset + l || last > msg->sg.size)return -EINVAL ; space =MAX_MSG_FRAGS -sk_msg_elem_used (msg);
@@ -3000,12 +3005,12 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,*/ if (start != offset) {struct scatterlist *nsge, *sge =sk_msg_elem (msg, i); -int a = start; +int a = start - offset;int b = sge->length - pop - a;sk_msg_iter_var_next (i); -if (pop < sge->length - a) { +if (b >0 ) {if (space) { sge->length = a;sk_msg_shift_right (msg, i);
@@ -3024,7 +3029,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,if (unlikely (!page))return -ENOMEM ; - sge->length = a; orig =sg_page (sge); from =sg_virt (sge); to =page_address (page);
@@ -3034,7 +3038,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,put_page (orig); } pop =0 ; - }else if (pop >= sge->length - a) { + }else { pop -= (sge->length - a); sge->length = a; }
@@ -3068,7 +3072,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start, pop -= sge->length;sk_msg_shift_left (msg, i); } -sk_msg_iter_var_next (i); }sk_mem_uncharge (msg->sk, len - pop);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 314/826 bpf, sockmap: Fix sk_msg_reset_curr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijian Zhang <[email protected]>
[ Upstream commit 955afd57dc4bf7e8c620a0a9e3af3c881c2c6dff ]
Found in the test_txmsg_pull in test_sockmap,
``` txmsg_cork = 512; // corking is importrant here opt->iov_length = 3; opt->iov_count = 1; opt->rate = 512; // sendmsg will be invoked 512 times ```
The first sendmsg will send an sk_msg with size 3, and bpf_msg_pull_data will be invoked the first time. sk_msg_reset_curr will reset the copybreak from 3 to 0. In the second sendmsg, since we are in the stage of corking, psock->cork will be reused in func sk_msg_alloc. msg->sg.copybreak is 0 now, the second msg will overwrite the first msg. As a result, we could not pass the data integrity test.
The same problem happens in push and pop test. Thus, fix sk_msg_reset_curr to restore the correct copybreak.
--- net/core/filter.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
net/core/filter.c +9 -11
@@ -2621,18 +2621,16 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes)static void sk_msg_reset_curr (struct sk_msg *msg) { -u32 i = msg->sg.start; -u32 len =0 ; - -do { - len +=sk_msg_elem (msg, i)->length; -sk_msg_iter_var_next (i); -if (len >= msg->sg.size) -break ; - }while (i != msg->sg.end); +if (!msg->sg.size) { + msg->sg.curr = msg->sg.start; + msg->sg.copybreak =0 ; + }else { +u32 i = msg->sg.end; - msg->sg.curr = i; - msg->sg.copybreak =0 ; +sk_msg_iter_var_prev (i); + msg->sg.curr = i; + msg->sg.copybreak = msg->sg.data[i].length; + } }static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 315/826 ipv6: release nexthop on device removal
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit eb02688c5c45c3e7af7e71f036a7144f5639cbfe ]
The CI is hitting some aperiodic hangup at device removal time in the pmtu.sh self-test:
unregister_netdevice: waiting for veth_A-R1 to become free. Usage count = 6ref_tracker: veth_A-R1@ffff888013df15d8 has 1/5 users at
dst_init+0x84/0x4a0 dst_alloc+0x97/0x150 ip6_dst_alloc+0x23/0x90 ip6_rt_pcpu_alloc+0x1e6/0x520 ip6_pol_route+0x56f/0x840 fib6_rule_lookup+0x334/0x630 ip6_route_output_flags+0x259/0x480 ip6_dst_lookup_tail.constprop.0+0x5c2/0x940 ip6_dst_lookup_flow+0x88/0x190 udp_tunnel6_dst_lookup+0x2a7/0x4c0 vxlan_xmit_one+0xbde/0x4a50 [vxlan] vxlan_xmit+0x9ad/0xf20 [vxlan] dev_hard_start_xmit+0x10e/0x360 __dev_queue_xmit+0xf95/0x18c0 arp_solicit+0x4a2/0xe00 neigh_probe+0xaa/0xf0
While the first suspect is the dst_cache, explicitly tracking the dst owing the last device reference via probes proved such dst is held by the nexthop in the originating fib6_info.
Similar to commit f5b51fe804ec ("ipv6: route: purge exception on removal"), we need to explicitly release the originating fib info when disconnecting a to-be-removed device from a live ipv6 dst: move the fib6_info cleanup into ip6_dst_ifdown().
Tested running:
./pmtu.sh cleanup_ipv6_exception
in a tight loop for more than 400 iterations with no spat, running an unpatched kernel I observed a splat every ~10 iterations.
--- net/ipv6/route.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv6/route.c +3 -3
@@ -374,6 +374,7 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev) {struct rt6_info *rt =dst_rt6_info (dst);struct inet6_dev *idev = rt->rt6i_idev; +struct fib6_info *from;if (idev && idev->dev != blackhole_netdev) {struct inet6_dev *blackhole_idev =in6_dev_get (blackhole_netdev);
@@ -383,6 +384,8 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev)in6_dev_put (idev); } } + from =unrcu_pointer (xchg (&rt->from,NULL )); +fib6_info_release (from); }static bool __rt6_check_expired (const struct rt6_info *rt)
@@ -1455,7 +1458,6 @@ static DEFINE_SPINLOCK(rt6_exception_lock);static void rt6_remove_exception (struct rt6_exception_bucket *bucket,struct rt6_exception *rt6_ex) { -struct fib6_info *from;struct net *net;if (!bucket || !rt6_ex)
@@ -1467,8 +1469,6 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,/* purge completely the exception to allow releasing the held resources: * some [sk] cache may keep the dst around for unlimited time */ - from =unrcu_pointer (xchg (&rt6_ex->rt6i->from,NULL )); -fib6_info_release (from);dst_dev_put (&rt6_ex->rt6i->dst);hlist_del_rcu (&rt6_ex->hlist);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 316/826 selftests: net: really check for bg process completion
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 52ed077aa6336dbef83a2d6d21c52d1706fb7f16 ]
A recent refactor transformed the check for process completion in a true statement, due to a typo.
As a result, the relevant test-case is unable to catch the regression it was supposed to detect.
Restore the correct condition.
--- tools/testing/selftests/net/pmtu.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/pmtu.sh +1 -1
@@ -2056,7 +2056,7 @@ check_running() { pid=${1} cmd=${2} - [ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "{cmd}" ] + [ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "${cmd}" ] } test_cleanup_vxlanX_exception() {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 317/826 wifi: cfg80211: Remove the Medium Synchronization Delay validity check
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lingbo Kong <[email protected]>
[ Upstream commit b4ebb58cb9a4b1b5cb5278b09d6afdcd71b2a6b4 ]
Currently, when the driver attempts to connect to an AP MLD with multiple APs, the cfg80211_mlme_check_mlo_compat() function requires the Medium Synchronization Delay values from different APs of the same AP MLD to be equal, which may result in connection failures.
This is because when the driver receives a multi-link probe response from an AP MLD with multiple APs, cfg80211 updates the Elements for each AP based on the multi-link probe response. If the Medium Synchronization Delay is set in the multi-link probe response, the Elements for each AP belonging to the same AP MLD will have the Medium Synchronization Delay set simultaneously. If non-multi-link probe responses are received from different APs of the same MLD AP, cfg80211 will still update the Elements based on the non-multi-link probe response. Since the non-multi-link probe response does not set the Medium Synchronization Delay
(IEEE 802.11be-2024-35.3.4.4), if the Elements from a non-multi-link probe response overwrite those from a multi-link probe response that has set the Medium Synchronization Delay, the Medium Synchronization Delay values for APs belonging to the same AP MLD will not be equal. This discrepancy causes the cfg80211_mlme_check_mlo_compat() function to fail, leading to connection failures. Commit ccb964b4ab16
("wifi: cfg80211: validate MLO connections better") did not take this into account.
To address this issue, remove this validity check.
--- net/wireless/mlme.c | 6 ------ 1 file changed, 6 deletions(-)
net/wireless/mlme.c +0 -6
@@ -340,12 +340,6 @@ cfg80211_mlme_check_mlo_compat(const struct ieee80211_multi_link_elem *mle_a,return -EINVAL ; } -if (ieee80211_mle_get_eml_med_sync_delay ((const u8 *)mle_a) != -ieee80211_mle_get_eml_med_sync_delay ((const u8 *)mle_b)) { -NL_SET_ERR_MSG (extack,"link EML medium sync delay mismatch" ); -return -EINVAL ; - } -if (ieee80211_mle_get_eml_cap ((const u8 *)mle_a) !=ieee80211_mle_get_eml_cap ((const u8 *)mle_b)) {NL_SET_ERR_MSG (extack,"link EML capabilities mismatch" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 318/826 wifi: iwlwifi: allow fast resume on ax200
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit e53ebc72054efca12e0329d69342e3daf7250a5a ]
This feature can be used on ax200 as well. It'll avoid to restart the firmware upon suspend / resume flow. Doing so also avoids releasing and re-allocating all the device related memory which makes the memory's subsystem task easier.
Stable-dep-of: d1a54ec21b8e ("wifi: iwlwifi: mvm: tell iwlmei when we finished suspending")
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +1 -1
@@ -1377,7 +1377,7 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm, bool suspend)iwl_mvm_rm_aux_sta (mvm);if (suspend && - mvm->trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_AX210 ) + mvm->trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_22000 )iwl_mvm_fast_suspend (mvm);else iwl_mvm_stop_device (mvm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 319/826 wifi: iwlwifi: mvm: tell iwlmei when we finished suspending
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit d1a54ec21b8e7bca59141ff1ac6ce73e07d744f2 ]
Since we no longer shut down the device in suspend, we also no longer call iwl_mvm_mei_device_state() and this is a problem because iwlmei expects this to be called when it runs its own suspend sequence. It checks mei->device_down in iwl_mei_remove() which is called upon suspend.
Fix this by telling iwlmei when we're done accessing the device. When we'll wake up, the device should be untouched if CSME didn't use it during the suspend time. If CSME used it, we'll notice it through the CSR_FUNC_SCRATCH register.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +6 -2
@@ -1237,6 +1237,7 @@ int __iwl_mvm_mac_start(struct iwl_mvm *mvm) fast_resume = mvm->fast_resume;if (fast_resume) { +iwl_mvm_mei_device_state (mvm, true); ret =iwl_mvm_fast_resume (mvm);if (ret) {iwl_mvm_stop_device (mvm);
@@ -1377,10 +1378,13 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm, bool suspend)iwl_mvm_rm_aux_sta (mvm);if (suspend && - mvm->trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_22000 ) + mvm->trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_22000 ) {iwl_mvm_fast_suspend (mvm); -else +/* From this point on, we won't touch the device */ +iwl_mvm_mei_device_state (mvm, false); + }else {iwl_mvm_stop_device (mvm); + }iwl_mvm_async_handlers_purge (mvm);/* async_handlers_list is empty and will stay empty: HW is stopped */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 320/826 drm/amdgpu: fix ACA bank count boundary check error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit 2bb7dced1c2f8c0e705cc74840f776406db492c3 ]
fix ACA bank count boundary check error.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +1 -1
@@ -158,7 +158,7 @@ static int aca_smu_get_valid_aca_banks(struct amdgpu_device *adev, enum aca_smu_return -EINVAL ; } -if (start + count >= max_count) +if (start + count > max_count)return -EINVAL ; count =min_t (int, count, max_count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 321/826 drm/amdgpu: Fix map/unmap queue logic
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit fa31798582882740f2b13d19e1bd43b4ef918e2f ]
In current logic, it calls ring_alloc followed by a ring_test. ring_test in turn will call another ring_alloc. This is illegal usage as a ring_alloc is expected to be closed properly with a ring_commit. Change to commit the map/unmap queue packet first followed by a ring_test. Add a comment about the usage of ring_test.
Also, reorder the current pre-condition checks of job hang or kiq ring scheduler not ready. Without them being met, it is not useful to attempt ring or memory allocations.
Fixes tag refers to the original patch which introduced this issue which then got carried over into newer code.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 13 ++++- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 63 +++++++++++++++------- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 7 +++ 3 files changed, 63 insertions(+), 20 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +11 -2
@@ -834,6 +834,9 @@ int amdgpu_amdkfd_unmap_hiq(struct amdgpu_device *adev, u32 doorbell_off,if (!kiq->pmf || !kiq->pmf->kiq_unmap_queues)return -EINVAL ; +if (!kiq_ring->sched.ready || adev->job_hang) +return 0 ; + ring_funcs =kzalloc (sizeof (*ring_funcs),GFP_KERNEL );if (!ring_funcs)return -ENOMEM ;
@@ -858,8 +861,14 @@ int amdgpu_amdkfd_unmap_hiq(struct amdgpu_device *adev, u32 doorbell_off, kiq->pmf->kiq_unmap_queues (kiq_ring, ring,RESET_QUEUES ,0 ,0 ); -if (kiq_ring->sched.ready && !adev->job_hang) - r =amdgpu_ring_test_helper (kiq_ring); +/* Submit unmap queue packet */ +amdgpu_ring_commit (kiq_ring); +/* +* Ring test will do a basic scratch register change check. Just run +* this to ensure that unmap queues that is submitted before got +* processed successfully before returning. +*/ + r =amdgpu_ring_test_helper (kiq_ring);spin_unlock (&kiq->ring_lock);
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +45 -18
104 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +7 -0
@@ -4823,6 +4823,13 @@ static int gfx_v8_0_kcq_disable(struct amdgpu_device *adev)amdgpu_ring_write (kiq_ring,0 );amdgpu_ring_write (kiq_ring,0 ); } +/* Submit unmap queue packet */ +amdgpu_ring_commit (kiq_ring); +/* +* Ring test will do a basic scratch register change check. Just run +* this to ensure that unmap queues that is submitted before got +* processed successfully before returning. +*/ r =amdgpu_ring_test_helper (kiq_ring);if (r)DRM_ERROR ("KCQ disable failed\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 322/826 drm/amdkfd: Fix wrong usage of INIT_WORK()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <[email protected]>
[ Upstream commit 21cae8debc6a1d243f64fa82cd1b41cb612b5c61 ]
In kfd_procfs_show(), the sdma_activity_work_handler is a local variable and the sdma_activity_work_handler.sdma_activity_work should initialize with INIT_WORK_ONSTACK() instead of INIT_WORK().
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +3 -2
@@ -341,8 +341,8 @@ static ssize_t kfd_procfs_show(struct kobject *kobj, struct attribute *attr, attr_sdma);struct kfd_sdma_activity_handler_workarea sdma_activity_work_handler; -INIT_WORK (&sdma_activity_work_handler.sdma_activity_work, - kfd_sdma_activity_worker); +INIT_WORK_ONSTACK (&sdma_activity_work_handler.sdma_activity_work, + kfd_sdma_activity_worker); sdma_activity_work_handler.pdd = pdd; sdma_activity_work_handler.sdma_activity_counter =0 ;
@@ -350,6 +350,7 @@ static ssize_t kfd_procfs_show(struct kobject *kobj, struct attribute *attr,schedule_work (&sdma_activity_work_handler.sdma_activity_work);flush_work (&sdma_activity_work_handler.sdma_activity_work); +destroy_work_on_stack (&sdma_activity_work_handler.sdma_activity_work); return snprintf(buffer, PAGE_SIZE, "%llu\n", (sdma_activity_work_handler.sdma_activity_counter)/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 323/826 bpf: Allow return values 0 and 1 for kprobe session
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 17c4b65a24938c6dd79496cce5df15f70d9c253c ]
The kprobe session program can return only 0 or 1, instruct verifier to check for that.
--- kernel/bpf/verifier.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/bpf/verifier.c +9 -0
@@ -15988,6 +15988,15 @@ static int check_return_code(struct bpf_verifier_env *env, int regno, const charreturn -ENOTSUPP ; }break ; +case BPF_PROG_TYPE_KPROBE : +switch (env->prog->expected_attach_type) { +case BPF_TRACE_KPROBE_SESSION : + range =retval_range (0 ,1 ); +break ; +default : +return 0 ; + } +break ;case BPF_PROG_TYPE_SK_LOOKUP : range =retval_range (SK_DROP ,SK_PASS );break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 324/826 bpf: Force uprobe bpf program to always return 0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit f505005bc7426f4309880da94cfbfc37efa225bd ]
As suggested by Andrii make uprobe multi bpf programs to always return 0, so they can't force uprobe removal.
Keeping the int return type for uprobe_prog_run, because it will be used in following session changes.
--- kernel/trace/bpf_trace.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
kernel/trace/bpf_trace.c +2 -3
@@ -3205,7 +3205,6 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,struct bpf_prog *prog = link->link.prog;bool sleepable = prog->sleepable;struct bpf_run_ctx *old_run_ctx; -int err =0 ;if (link->task && !same_thread_group (current, link->task))return 0 ;
@@ -3218,7 +3217,7 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,migrate_disable (); old_run_ctx =bpf_set_run_ctx (&run_ctx.run_ctx); - err =bpf_prog_run (link->link.prog, regs); +bpf_prog_run (link->link.prog, regs);bpf_reset_run_ctx (old_run_ctx);migrate_enable ();
@@ -3227,7 +3226,7 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,rcu_read_unlock_trace (); elsercu_read_unlock (); -return err; +return 0 ; } static bool
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 325/826 selftests/bpf: skip the timer_lockup test for single-CPU nodes
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viktor Malik <[email protected]>
[ Upstream commit 937a1c29a287e8f48c4cea714c76a13e14d989ac ]
The timer_lockup test needs 2 CPUs to work, on single-CPU nodes it fails to set thread affinity to CPU 1 since it doesn't exist:
# ./test_progs -t timer_lockup
test_timer_lockup:PASS:timer_lockup__open_and_load 0 nsec
test_timer_lockup:PASS:pthread_create thread1 0 nsec
test_timer_lockup:PASS:pthread_create thread2 0 nsec
timer_lockup_thread:PASS:cpu affinity 0 nsec
timer_lockup_thread:FAIL:cpu affinity unexpected error: 22 (errno 0)
test_timer_lockup:PASS: 0 nsec
#406 timer_lockup:FAILSkip the test if only 1 CPU is available.
--- tools/testing/selftests/bpf/prog_tests/timer_lockup.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/bpf/prog_tests/timer_lockup.c +6 -0
@@ -5,6 +5,7 @@#include <test_progs.h> #include <pthread.h> #include <network_helpers.h> +#include <sys/sysinfo.h> #include "timer_lockup.skel.h"
@@ -52,6 +53,11 @@ void test_timer_lockup(void)pthread_t thrds[2 ];void *ret; +if (get_nprocs () <2 ) { +test__skip (); +return ; + } + skel =timer_lockup__open_and_load ();if (!ASSERT_OK_PTR (skel,"timer_lockup__open_and_load" ))return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 326/826 ipv6: Fix soft lockups in fib6_select_path under high next hop churn
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omid Ehtemam-Haghighi <[email protected]>
[ Upstream commit d9ccb18f83ea2bb654289b6ecf014fd267cc988b ]
Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using the bird service, these routers continuously update BGP-advertised routes due to frequently changing nexthop destinations, while also managing significant IPv6 traffic. The lockups occur during the traversal of the multipath circular linked-list in the fib6_select_path function, particularly while iterating through the siblings in the list. The issue typically arises when the nodes of the linked list are unexpectedly deleted concurrently on a different core—indicated by their 'next' and 'previous' elements pointing back to the node itself and their reference count dropping to zero. This results in an infinite loop, leading to a soft lockup that triggers a system panic via the watchdog timer.
Apply RCU primitives in the problematic code sections to resolve the issue. Where necessary, update the references to fib6_siblings to annotate or use the RCU APIs.
Include a test script that reproduces the issue. The script periodically updates the routing table while generating a heavy load of outgoing IPv6 traffic through multiple iperf3 clients. It consistently induces infinite soft lockups within a couple of minutes.
Kernel log:
0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb
1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3
2 [ffffbd13003e8e58] panic at ffffffff8cef65d4
3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03
4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756
6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d
-- <IRQ stack> --
8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb
[exception RIP: fib6_select_path+299]
RIP: ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287
RAX: ffff975850b43600 RBX: ffff975850b40200 RCX: 0000000000000000
RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618
RBP: ffffbd13003d3800 R8: 0000000000000000 R9: ffff975850b40200
R10: 0000000000000000 R11: 0000000000000000 R12: ffffbd13003d3830
R13: ffff975850b436a8 R14: ffff975850b43600 R15: 0000000000000007
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c
10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c 11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5
12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47
13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0 14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274 15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474
16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615
17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec 18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3 19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9
20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice] 21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice] 22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice] 23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000
24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581
25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9
26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47
27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30 28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f
29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64
30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb
--- net/ipv6/ip6_fib.c | 8 +- net/ipv6/route.c | 45 ++- tools/testing/selftests/net/Makefile | 1 + .../net/ipv6_route_update_soft_lockup.sh | 262 ++++++++++++++++++ 4 files changed, 297 insertions(+), 19 deletions(-) create mode 100755 tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh
net/ipv6/ip6_fib.c +4 -4
@@ -1190,8 +1190,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,while (sibling) {if (sibling->fib6_metric == rt->fib6_metric &&rt6_qualify_for_ecmp (sibling)) { -list_add_tail (&rt->fib6_siblings, - &sibling->fib6_siblings); +list_add_tail_rcu (&rt->fib6_siblings, + &sibling->fib6_siblings);break ; } sibling = rcu_dereference_protected(sibling->fib6_next,
@@ -1252,7 +1252,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, fib6_siblings) sibling->fib6_nsiblings--; rt->fib6_nsiblings =0 ; -list_del_init (&rt->fib6_siblings); +list_del_rcu (&rt->fib6_siblings);rt6_multipath_rebalance (next_sibling);return err; }
@@ -1970,7 +1970,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; rt->fib6_nsiblings =0 ; -list_del_init (&rt->fib6_siblings); +list_del_rcu (&rt->fib6_siblings);rt6_multipath_rebalance (next_sibling); }
net/ipv6/route.c +30 -15
112 lines not on this page · raw message
tools/testing/selftests/net/Makefile +1 -0
@@ -97,6 +97,7 @@ TEST_PROGS += fdb_flush.sh TEST_PROGS += fq_band_pktlimit.sh TEST_PROGS += vlan_hw_filter.sh TEST_PROGS += bpf_offload.py +TEST_PROGS += ipv6_route_update_soft_lockup.sh # YNL files, must be before "include ..lib.mk" EXTRA_CLEAN += $(OUTPUT)/libynl.a
tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh new file +262 -0
262 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 327/826 net: rfkill: gpio: Add check for clk_enable()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingwei Zheng <[email protected]>
[ Upstream commit 8251e7621b25ccdb689f1dd9553b8789e3745ea1 ]
Add check for the return value of clk_enable() to catch the potential error.
--- net/rfkill/rfkill-gpio.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/rfkill/rfkill-gpio.c +6 -2
@@ -32,8 +32,12 @@ static int rfkill_gpio_set_power(void *data, bool blocked) {struct rfkill_gpio_data *rfkill = data; -if (!blocked && !IS_ERR (rfkill->clk) && !rfkill->clk_enabled) -clk_enable (rfkill->clk); +if (!blocked && !IS_ERR (rfkill->clk) && !rfkill->clk_enabled) { +int ret =clk_enable (rfkill->clk); + +if (ret) +return ret; + }gpiod_set_value_cansleep (rfkill->shutdown_gpio, !blocked);gpiod_set_value_cansleep (rfkill->reset_gpio, !blocked);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 328/826 Revert "wifi: iwlegacy: do not skip frames with bad FCS"
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalle Valo <[email protected]>
[ Upstream commit 11597043d74809daf5d14256b96d6781749b3f82 ]
This reverts commit 02b682d54598f61cbb7dbb14d98ec1801112b878.
Alf reports that this commit causes the connection to eventually die on iwl4965. The reason is that rx_status.flag is zeroed after RX_FLAG_FAILED_FCS_CRC is set and mac80211 doesn't know the received frame is corrupted.
--- drivers/net/wireless/intel/iwlegacy/3945.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlegacy/3945.c +1 -1
@@ -566,7 +566,7 @@ il3945_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)if (!(rx_end->status &RX_RES_STATUS_NO_CRC32_ERROR ) || !(rx_end->status &RX_RES_STATUS_NO_RXE_OVERFLOW )) {D_RX ("Bad CRC or FIFO: 0x%08X.\n" , rx_end->status); - rx_status.flag |=RX_FLAG_FAILED_FCS_CRC ; +return ; }/* Convert 3945's rssi indicator to dBm */
drivers/net/wireless/intel/iwlegacy/4965-mac.c +1 -1
@@ -664,7 +664,7 @@ il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)if (!(rx_pkt_status &RX_RES_STATUS_NO_CRC32_ERROR ) || !(rx_pkt_status &RX_RES_STATUS_NO_RXE_OVERFLOW )) {D_RX ("Bad CRC or FIFO: 0x%08X.\n" ,le32_to_cpu (rx_pkt_status)); - rx_status.flag |=RX_FLAG_FAILED_FCS_CRC ; +return ; }/* This will be used in several places later */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 329/826 bpf: Use function pointers count as struct_ops links count
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 821a3fa32bbe3bc0fa23b3189325d3720a49a24c ]
Only function pointers in a struct_ops structure can be linked to bpf progs, so set the links count to the function pointers count, instead of the total members count in the structure.
Stable-dep-of: 7c8ce4ffb684 ("bpf: Add kernel symbol for struct_ops trampoline")
--- kernel/bpf/bpf_struct_ops.c | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-)
kernel/bpf/bpf_struct_ops.c +25 -10
@@ -32,7 +32,7 @@ struct bpf_struct_ops_map {* (in kvalue.data). */ struct bpf_link **links; -u32 links_cnt; +u32 funcs_cnt;u32 image_pages_cnt;/* image_pages is an array of pages that has all the trampolines * that stores the func args before calling the bpf_prog.
@@ -481,11 +481,11 @@ static void bpf_struct_ops_map_put_progs(struct bpf_struct_ops_map *st_map) {u32 i; -for (i =0 ; i < st_map->links_cnt; i++) { -if (st_map->links[i]) { -bpf_link_put (st_map->links[i]); - st_map->links[i] =NULL ; - } +for (i =0 ; i < st_map->funcs_cnt; i++) { +if (!st_map->links[i]) +break ; +bpf_link_put (st_map->links[i]); + st_map->links[i] =NULL ; } }
@@ -601,6 +601,7 @@ static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,int prog_fd, err;u32 i, trampoline_start, image_off =0 ;void *cur_image =NULL , *image =NULL ; +struct bpf_link **plink;if (flags)return -EINVAL ;
@@ -639,6 +640,7 @@ static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, udata = &uvalue->data; kdata = &kvalue->data; + plink = st_map->links; module_type =btf_type_by_id (btf_vmlinux, st_ops_ids[IDX_MODULE_ID ]);for_each_member (i, t, member) {const struct btf_type *mtype, *ptype;
@@ -714,7 +716,7 @@ static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, }bpf_link_init (&link->link,BPF_LINK_TYPE_STRUCT_OPS , &bpf_struct_ops_link_lops, prog); - st_map->links[i] = &link->link; + *plink++ = &link->link; trampoline_start = image_off; err = bpf_struct_ops_prepare_trampoline(tlinks, link,
@@ -895,6 +897,19 @@ static int bpf_struct_ops_map_alloc_check(union bpf_attr *attr)return 0 ; } +static u32 count_func_ptrs (const struct btf *btf,const struct btf_type *t) +{ +int i; +u32 count; +const struct btf_member *member; + + count =0 ; +for_each_member (i, t, member) +if (btf_type_resolve_func_ptr (btf, member->type,NULL )) + count++; +return count; +} +static struct bpf_map *bpf_struct_ops_map_alloc (union bpf_attr *attr) {const struct bpf_struct_ops_desc *st_ops_desc;
@@ -961,9 +976,9 @@ static struct bpf_map *bpf_struct_ops_map_alloc(union bpf_attr *attr) map = &st_map->map; st_map->uvalue =bpf_map_area_alloc (vt->size,NUMA_NO_NODE ); - st_map->links_cnt =btf_type_vlen (t); + st_map->funcs_cnt =count_func_ptrs (btf, t); st_map->links = -bpf_map_area_alloc (st_map->links_cnt *sizeof (struct bpf_links *), +bpf_map_area_alloc (st_map->funcs_cnt *sizeof (struct bpf_link *),NUMA_NO_NODE );if (!st_map->uvalue || !st_map->links) { ret = -ENOMEM ;
@@ -994,7 +1009,7 @@ static u64 bpf_struct_ops_map_mem_usage(const struct bpf_map *map) usage =sizeof (*st_map) + vt->size -sizeof (struct bpf_struct_ops_value ); usage += vt->size; - usage +=btf_type_vlen (vt) *sizeof (struct bpf_links *); + usage += st_map->funcs_cnt *sizeof (struct bpf_link *); usage +=PAGE_SIZE ;return usage; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 330/826 bpf: Add kernel symbol for struct_ops trampoline
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Kuohai <[email protected]>
[ Upstream commit 7c8ce4ffb684676039b1ff9ff81c126794e8d88e ]
Without kernel symbols for struct_ops trampoline, the unwinder may produce unexpected stacktraces.
For example, the x86 ORC and FP unwinders check if an IP is in kernel text by verifying the presence of the IP's kernel symbol. When a struct_ops trampoline address is encountered, the unwinder stops due to the absence of symbol, resulting in an incomplete stacktrace that consists only of direct and indirect child functions called from the trampoline.
The arm64 unwinder is another example. While the arm64 unwinder can proceed across a struct_ops trampoline address, the corresponding symbol name is displayed as "unknown", which is confusing.
Thus, add kernel symbol for struct_ops trampoline. The name is bpf__<struct_ops_name>_<member_name>, where <struct_ops_name> is the type name of the struct_ops, and <member_name> is the name of the member that the trampoline is linked to.
Below is a comparison of stacktraces captured on x86 by perf record, before and after this patch.
Before:ffffffff8116545d __lock_acquire+0xad ([kernel.kallsyms]) ffffffff81167fcc lock_acquire+0xcc ([kernel.kallsyms]) ffffffff813088f4 __bpf_prog_enter+0x34 ([kernel.kallsyms])
After:ffffffff811656bd __lock_acquire+0x30d ([kernel.kallsyms]) ffffffff81167fcc lock_acquire+0xcc ([kernel.kallsyms]) ffffffff81309024 __bpf_prog_enter+0x34 ([kernel.kallsyms]) ffffffffc000d7e9 bpf__tcp_congestion_ops_cong_avoid+0x3e ([kernel.kallsyms]) ffffffff81f250a5 tcp_ack+0x10d5 ([kernel.kallsyms]) ffffffff81f27c66 tcp_rcv_established+0x3b6 ([kernel.kallsyms]) ffffffff81f3ad03 tcp_v4_do_rcv+0x193 ([kernel.kallsyms]) ffffffff81d65a18 __release_sock+0xd8 ([kernel.kallsyms]) ffffffff81d65af4 release_sock+0x34 ([kernel.kallsyms]) ffffffff81f15c4b tcp_sendmsg+0x3b ([kernel.kallsyms]) ffffffff81f663d7 inet_sendmsg+0x47 ([kernel.kallsyms]) ffffffff81d5ab40 sock_write_iter+0x160 ([kernel.kallsyms]) ffffffff8149c67b vfs_write+0x3fb ([kernel.kallsyms]) ffffffff8149caf6 ksys_write+0xc6 ([kernel.kallsyms]) ffffffff8149cb5d __x64_sys_write+0x1d ([kernel.kallsyms]) ffffffff81009200 x64_sys_call+0x1d30 ([kernel.kallsyms]) ffffffff82232d28 do_syscall_64+0x68 ([kernel.kallsyms]) ffffffff8240012f entry_SYSCALL_64_after_hwframe+0x76 ([kernel.kallsyms])
--- include/linux/bpf.h | 3 +- kernel/bpf/bpf_struct_ops.c | 79 ++++++++++++++++++++++++++++++++++++- kernel/bpf/dispatcher.c | 3 +- kernel/bpf/trampoline.c | 9 ++++- 4 files changed, 89 insertions(+), 5 deletions(-)
include/linux/bpf.h +2 -1
@@ -1373,7 +1373,8 @@ int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcvoid bpf_dispatcher_change_prog (struct bpf_dispatcher *d,struct bpf_prog *from,struct bpf_prog *to);/* Called only from JIT-enabled code, so there's no need for stubs. */ -void bpf_image_ksym_add (void *data,unsigned int size,struct bpf_ksym *ksym); +void bpf_image_ksym_init (void *data,unsigned int size,struct bpf_ksym *ksym); +void bpf_image_ksym_add (struct bpf_ksym *ksym);void bpf_image_ksym_del (struct bpf_ksym *ksym);void bpf_ksym_add (struct bpf_ksym *ksym);void bpf_ksym_del (struct bpf_ksym *ksym);
kernel/bpf/bpf_struct_ops.c +78 -1
160 lines not on this page · raw message
kernel/bpf/dispatcher.c +2 -1
@@ -154,7 +154,8 @@ void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from, d->image =NULL ; goto out; } -bpf_image_ksym_add (d->image,PAGE_SIZE , &d->ksym); +bpf_image_ksym_init (d->image,PAGE_SIZE , &d->ksym); +bpf_image_ksym_add (&d->ksym); } prev_num_progs = d->num_progs;
kernel/bpf/trampoline.c +7 -2
@@ -115,10 +115,14 @@ bool bpf_prog_has_trampoline(const struct bpf_prog *prog) (ptype ==BPF_PROG_TYPE_LSM && eatype ==BPF_LSM_MAC ); } -void bpf_image_ksym_add (void *data,unsigned int size,struct bpf_ksym *ksym) +void bpf_image_ksym_init (void *data,unsigned int size,struct bpf_ksym *ksym) { ksym->start = (unsigned long ) data; ksym->end = ksym->start + size; +} + +void bpf_image_ksym_add (struct bpf_ksym *ksym) +{bpf_ksym_add (ksym);perf_event_ksymbol (PERF_RECORD_KSYMBOL_TYPE_BPF , ksym->start,PAGE_SIZE , false, ksym->name);
@@ -377,7 +381,8 @@ static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, int size) ksym = &im->ksym;INIT_LIST_HEAD_RCU (&ksym->lnode);snprintf (ksym->name,KSYM_NAME_LEN ,"bpf_trampoline_%llu" , key); -bpf_image_ksym_add (image, size, ksym); +bpf_image_ksym_init (image, size, ksym); +bpf_image_ksym_add (ksym);return im; out_free_image:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 331/826 ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit dafb28f02be407e07a6f679e922a626592b481b0 ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
--- sound/usb/usx2y/usbusx2y.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/usx2y/usbusx2y.c +1 -1
@@ -422,7 +422,7 @@ static void snd_usx2y_disconnect(struct usb_interface *intf) }if (usx2y->us428ctls_sharedmem)wake_up (&usx2y->us428ctls_wait_queue_head); -snd_card_free (card); +snd_card_free_when_closed (card); } static int snd_usx2y_probe(struct usb_interface *intf,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 332/826 ALSA: us122l: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b7df09bb348016943f56b09dcaafe221e3f73947 ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
The loop of us122l->mmap_count check is dropped as well. The check is useless for the asynchronous operation with *_when_closed().
--- sound/usb/usx2y/us122l.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
sound/usb/usx2y/us122l.c +1 -4
@@ -606,10 +606,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf)usb_put_intf (usb_ifnum_to_if (us122l->dev,1 ));usb_put_dev (us122l->dev); -while (atomic_read (&us122l->mmap_count)) -msleep (500 ); - -snd_card_free (card); +snd_card_free_when_closed (card); }static int snd_us122l_suspend (struct usb_interface *intf,pm_message_t message)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 333/826 ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c ]
The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.
This patch also splits the code to the disconnect and the free phases; the former is called immediately at the USB disconnect callback while the latter is called from the card destructor.
--- sound/usb/caiaq/audio.c | 10 ++++++++-- sound/usb/caiaq/audio.h | 1 + sound/usb/caiaq/device.c | 19 +++++++++++++++---- sound/usb/caiaq/input.c | 12 +++++++++--- sound/usb/caiaq/input.h | 1 + 5 files changed, 34 insertions(+), 9 deletions(-)
sound/usb/caiaq/audio.c +8 -2
@@ -858,14 +858,20 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)return 0 ; } -void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev) +void snd_usb_caiaq_audio_disconnect (struct snd_usb_caiaqdev *cdev) {struct device *dev =caiaqdev_to_dev (cdev);dev_dbg (dev,"%s(%p)\n" , __func__, cdev);stream_stop (cdev); +} + +void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev) +{ +struct device *dev =caiaqdev_to_dev (cdev); + +dev_dbg (dev,"%s(%p)\n" , __func__, cdev);free_urbs (cdev->data_urbs_in);free_urbs (cdev->data_urbs_out);kfree (cdev->data_cb_info); } -
sound/usb/caiaq/audio.h +1 -0
@@ -3,6 +3,7 @@#define CAIAQ_AUDIO_H int snd_usb_caiaq_audio_init (struct snd_usb_caiaqdev *cdev); +void snd_usb_caiaq_audio_disconnect (struct snd_usb_caiaqdev *cdev);void snd_usb_caiaq_audio_free (struct snd_usb_caiaqdev *cdev);#endif /* CAIAQ_AUDIO_H */
sound/usb/caiaq/device.c +15 -4
@@ -376,6 +376,17 @@ static void setup_card(struct snd_usb_caiaqdev *cdev)dev_err (dev,"Unable to set up control system (ret=%d)\n" , ret); } +static void card_free (struct snd_card *card) +{ +struct snd_usb_caiaqdev *cdev =caiaqdev (card); + +#ifdef CONFIG_SND_USB_CAIAQ_INPUT +snd_usb_caiaq_input_free (cdev); +#endif +snd_usb_caiaq_audio_free (cdev); +usb_reset_device (cdev->chip.dev); +} +static int create_card (struct usb_device *usb_dev,struct usb_interface *intf,struct snd_card **cardp)
@@ -489,6 +500,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) cdev->vendor_name, cdev->product_name, usbpath);setup_card (cdev); + card->private_free = card_free;return 0 ; err_kill_urb:
@@ -534,15 +546,14 @@ static void snd_disconnect(struct usb_interface *intf)snd_card_disconnect (card);#ifdef CONFIG_SND_USB_CAIAQ_INPUT -snd_usb_caiaq_input_free (cdev); +snd_usb_caiaq_input_disconnect (cdev);#endif -snd_usb_caiaq_audio_free (cdev); +snd_usb_caiaq_audio_disconnect (cdev);usb_kill_urb (&cdev->ep1_in_urb);usb_kill_urb (&cdev->midi_out_urb); -snd_card_free (card); -usb_reset_device (interface_to_usbdev (intf)); +snd_card_free_when_closed (card); }
sound/usb/caiaq/input.c +9 -3
@@ -829,15 +829,21 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev)return ret; } -void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev) +void snd_usb_caiaq_input_disconnect (struct snd_usb_caiaqdev *cdev) {if (!cdev || !cdev->input_dev)return ;usb_kill_urb (cdev->ep4_in_urb); +input_unregister_device (cdev->input_dev); +} + +void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev) +{ +if (!cdev || !cdev->input_dev) +return ; +usb_free_urb (cdev->ep4_in_urb); cdev->ep4_in_urb =NULL ; - -input_unregister_device (cdev->input_dev); cdev->input_dev =NULL ; }
sound/usb/caiaq/input.h +1 -0
@@ -4,6 +4,7 @@void snd_usb_caiaq_input_dispatch (struct snd_usb_caiaqdev *cdev,char *buf,unsigned int len);int snd_usb_caiaq_input_init (struct snd_usb_caiaqdev *cdev); +void snd_usb_caiaq_input_disconnect (struct snd_usb_caiaqdev *cdev);void snd_usb_caiaq_input_free (struct snd_usb_caiaqdev *cdev);#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 334/826 ALSA: 6fire: Release resources at card release
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ]
The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()).
For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback.
--- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/usb/6fire/chip.c +5 -5
@@ -61,8 +61,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy (struct sfire_chip *chip) +static void usb6fire_card_free (struct snd_card *card) { +struct sfire_chip *chip = card->private_data; +if (chip) {if (chip->pcm)usb6fire_pcm_destroy (chip);
@@ -72,8 +74,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip)usb6fire_comm_destroy (chip);if (chip->control)usb6fire_control_destroy (chip); -if (chip->card) -snd_card_free (chip->card); } }
@@ -136,6 +136,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count =1 ; chip->card = card; + card->private_free = usb6fire_card_free; ret =usb6fire_comm_init (chip);if (ret <0 )
@@ -162,7 +163,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf,return 0 ; destroy_chip: -usb6fire_chip_destroy (chip); +snd_card_free (card);return ret; }
@@ -181,7 +182,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true;usb6fire_chip_abort (chip); -usb6fire_chip_destroy (chip); } } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 335/826 i2c: dev: Fix memory leak when underlying adapter does not support I2C
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Pylypiv <[email protected]>
[ Upstream commit 48730a9d04ffccda541602d722d1ff81920a85d8 ]
Early return in i2cdev_ioctl_rdwr() failed to free the memory allocated by the caller. Move freeing the memory to the function where it has been allocated to prevent similar leaks in the future.
--- drivers/i2c/i2c-dev.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/i2c/i2c-dev.c +9 -8
@@ -251,10 +251,8 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,return -EOPNOTSUPP ; data_ptrs =kmalloc_array (nmsgs,sizeof (u8 __user *),GFP_KERNEL ); -if (data_ptrs ==NULL ) { -kfree (msgs); +if (!data_ptrs)return -ENOMEM ; - } res =0 ;for (i =0 ; i < nmsgs; i++) {
@@ -302,7 +300,6 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,for (j =0 ; j < i; ++j)kfree (msgs[j].buf);kfree (data_ptrs); -kfree (msgs);return res; }
@@ -316,7 +313,6 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,kfree (msgs[i].buf); }kfree (data_ptrs); -kfree (msgs);return res; }
@@ -446,6 +442,7 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)case I2C_RDWR : {struct i2c_rdwr_ioctl_data rdwr_arg;struct i2c_msg *rdwr_pa; +int res; if (copy_from_user(&rdwr_arg, (struct i2c_rdwr_ioctl_data __user *)arg,
@@ -467,7 +464,9 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)if (IS_ERR (rdwr_pa))return PTR_ERR (rdwr_pa); -return i2cdev_ioctl_rdwr (client, rdwr_arg.nmsgs, rdwr_pa); + res =i2cdev_ioctl_rdwr (client, rdwr_arg.nmsgs, rdwr_pa); +kfree (rdwr_pa); +return res; }case I2C_SMBUS : {
@@ -540,7 +539,7 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lostruct i2c_rdwr_ioctl_data32 rdwr_arg;struct i2c_msg32 __user *p;struct i2c_msg *rdwr_pa; -int i; +int i, res; if (copy_from_user(&rdwr_arg, (struct i2c_rdwr_ioctl_data32 __user *)arg,
@@ -573,7 +572,9 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lo }; } -return i2cdev_ioctl_rdwr (client, rdwr_arg.nmsgs, rdwr_pa); + res =i2cdev_ioctl_rdwr (client, rdwr_arg.nmsgs, rdwr_pa); +kfree (rdwr_pa); +return res; }case I2C_SMBUS : {struct i2c_smbus_ioctl_data32 data32;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 336/826 selftests: netfilter: Fix missing return values in conntrack_dump_flush
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: guanjing <[email protected]>
[ Upstream commit 041bd1e4f2d82859690cd8b41c35f0f9404c3770 ]
Fix the bug of some functions were missing return values.
--- .../testing/selftests/net/netfilter/conntrack_dump_flush.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/net/netfilter/conntrack_dump_flush.c +6 -0
@@ -43,6 +43,8 @@ static int build_cta_tuple_v4(struct nlmsghdr *nlh, int type,mnl_attr_nest_end (nlh, nest_proto);mnl_attr_nest_end (nlh, nest); + +return 0 ; } static int build_cta_tuple_v6(struct nlmsghdr *nlh, int type,
@@ -71,6 +73,8 @@ static int build_cta_tuple_v6(struct nlmsghdr *nlh, int type,mnl_attr_nest_end (nlh, nest_proto);mnl_attr_nest_end (nlh, nest); + +return 0 ; }static int build_cta_proto (struct nlmsghdr *nlh)
@@ -90,6 +94,8 @@ static int build_cta_proto(struct nlmsghdr *nlh)mnl_attr_nest_end (nlh, nest_proto);mnl_attr_nest_end (nlh, nest); + +return 0 ; } static int conntrack_data_insert(struct mnl_socket *sock, struct nlmsghdr *nlh,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 337/826 Bluetooth: btintel_pcie: Add handshake between driver and firmware
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiran K <[email protected]>
[ Upstream commit 05c200c8f0295c9c91beeb3ee0552331c1f8adbe ]
The following handshake mechanism needs be followed after firmware download is completed to bring the firmware to running state.
After firmware fragments of Operational image are downloaded and secure sends result of the image succeeds,
1. Driver sends HCI Intel reset with boot option #1 to switch FW image.
2. FW sends Alive GP[0] MSIx
3. Driver enables data path (doorbell 0x460 for RBDs, etc...)
4. Driver gets Bootup event from firmware
5. Driver performs D0 entry to device (WRITE to IPC_Sleep_Control =0x0)
6. FW sends Alive GP[0] MSIx
7. Device host interface is fully set for BT protocol stack operation.
8. Driver may optionally get debug event with ID 0x97 which can be dropped
For Intermediate loadger image, all the above steps are applicable expcept #5 and #6.
On HCI_OP_RESET, firmware raises alive interrupt. Driver needs to wait for it before passing control over to bluetooth stack.
Stable-dep-of: 510e8380b038 ("Bluetooth: btintel: Do no pass vendor events to stack")
--- drivers/bluetooth/btintel.c | 56 ++++++- drivers/bluetooth/btintel.h | 7 + drivers/bluetooth/btintel_pcie.c | 262 ++++++++++++++++++++++++++++++- drivers/bluetooth/btintel_pcie.h | 16 +- 4 files changed, 329 insertions(+), 12 deletions(-)
drivers/bluetooth/btintel.c +52 -4
@@ -1841,6 +1841,37 @@ static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)return 0 ; } +static int btintel_boot_wait_d0 (struct hci_dev *hdev,ktime_t calltime, +int msec) +{ +ktime_t delta, rettime; +unsigned long long duration; +int err; + +bt_dev_info (hdev,"Waiting for device transition to d0" ); + + err =btintel_wait_on_flag_timeout (hdev,INTEL_WAIT_FOR_D0 , +TASK_INTERRUPTIBLE , +msecs_to_jiffies (msec)); +if (err == -EINTR ) { +bt_dev_err (hdev,"Device d0 move interrupted" ); +return -EINTR ; + } + +if (err) { +bt_dev_err (hdev,"Device d0 move timeout" ); +return -ETIMEDOUT ; + } + + rettime =ktime_get (); + delta =ktime_sub (rettime, calltime); + duration = (unsigned long long )ktime_to_ns (delta) >>10 ; + +bt_dev_info (hdev,"Device moved to D0 in %llu usecs" , duration); + +return 0 ; +} +static int btintel_boot (struct hci_dev *hdev,u32 boot_addr) {ktime_t calltime;
@@ -1849,6 +1880,7 @@ static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) calltime =ktime_get ();btintel_set_flag (hdev,INTEL_BOOTING ); +btintel_set_flag (hdev,INTEL_WAIT_FOR_D0 ); err =btintel_send_intel_reset (hdev, boot_addr);if (err) {
@@ -1861,13 +1893,28 @@ static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)* is done by the operational firmware sending bootup notification. * * Booting into operational firmware should not take longer than -* 1 second. However if that happens, then just fail the setup +* 5 second. However if that happens, then just fail the setup * since something went wrong. */ - err =btintel_boot_wait (hdev, calltime,1000 ); -if (err == -ETIMEDOUT ) + err =btintel_boot_wait (hdev, calltime,5000 ); +if (err == -ETIMEDOUT ) {btintel_reset_to_bootloader (hdev); + goto exit_error; + } +if (hdev->bus ==HCI_PCI ) { +/* In case of PCIe, after receiving bootup event, driver performs +* D0 entry by writing 0 to sleep control register (check +* btintel_pcie_recv_event()) +* Firmware acks with alive interrupt indicating host is full ready to +* perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 +* bit is cleared. +*/ + calltime =ktime_get (); + err =btintel_boot_wait_d0 (hdev, calltime,2000 ); + } + +exit_error:return err; }
@@ -3273,7 +3320,7 @@ int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) }EXPORT_SYMBOL_GPL (btintel_configure_setup); -static int btintel_diagnostics (struct hci_dev *hdev,struct sk_buff *skb) +int btintel_diagnostics (struct hci_dev *hdev,struct sk_buff *skb) {struct intel_tlv *tlv = (void *)&skb->data[5 ];
@@ -3301,6 +3348,7 @@ static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) recv_frame:return hci_recv_frame (hdev, skb); } +EXPORT_SYMBOL_GPL (btintel_diagnostics);int btintel_recv_event (struct hci_dev *hdev,struct sk_buff *skb) {
drivers/bluetooth/btintel.h +7 -0
@@ -178,6 +178,7 @@ enum {INTEL_ROM_LEGACY ,INTEL_ROM_LEGACY_NO_WBS_SUPPORT ,INTEL_ACPI_RESET_ACTIVE , +INTEL_WAIT_FOR_D0 , __INTEL_NUM_FLAGS, };
@@ -249,6 +250,7 @@ int btintel_bootloader_setup_tlv(struct hci_dev *hdev,int btintel_shutdown_combined (struct hci_dev *hdev);void btintel_hw_error (struct hci_dev *hdev,u8 code);void btintel_print_fseq_info (struct hci_dev *hdev); +int btintel_diagnostics (struct hci_dev *hdev,struct sk_buff *skb);#else static inline int btintel_check_bdaddr (struct hci_dev *hdev)
@@ -382,4 +384,9 @@ static inline void btintel_hw_error(struct hci_dev *hdev, u8 code)static inline void btintel_print_fseq_info (struct hci_dev *hdev) { } + +static inline int btintel_diagnostics (struct hci_dev *hdev,struct sk_buff *skb) +{ +return -EOPNOTSUPP ; +}#endif
drivers/bluetooth/btintel_pcie.c +255 -7
334 lines not on this page · raw message
drivers/bluetooth/btintel_pcie.h +15 -1
@@ -12,6 +12,7 @@#define BTINTEL_PCIE_CSR_HW_REV_REG (BTINTEL_PCIE_CSR_BASE + 0x028)#define BTINTEL_PCIE_CSR_RF_ID_REG (BTINTEL_PCIE_CSR_BASE + 0x09C)#define BTINTEL_PCIE_CSR_BOOT_STAGE_REG (BTINTEL_PCIE_CSR_BASE + 0x108) +#define BTINTEL_PCIE_CSR_IPC_SLEEP_CTL_REG (BTINTEL_PCIE_CSR_BASE + 0x114)#define BTINTEL_PCIE_CSR_CI_ADDR_LSB_REG (BTINTEL_PCIE_CSR_BASE + 0x118)#define BTINTEL_PCIE_CSR_CI_ADDR_MSB_REG (BTINTEL_PCIE_CSR_BASE + 0x11C)#define BTINTEL_PCIE_CSR_IMG_RESPONSE_REG (BTINTEL_PCIE_CSR_BASE + 0x12C)
@@ -32,6 +33,7 @@#define BTINTEL_PCIE_CSR_BOOT_STAGE_IML_LOCKDOWN (BIT(11))#define BTINTEL_PCIE_CSR_BOOT_STAGE_MAC_ACCESS_ON (BIT(16))#define BTINTEL_PCIE_CSR_BOOT_STAGE_ALIVE (BIT(23)) +#define BTINTEL_PCIE_CSR_BOOT_STAGE_D3_STATE_READY (BIT(24))/* Registers for MSI-X */ #define BTINTEL_PCIE_CSR_MSIX_BASE (0x2000)
@@ -55,6 +57,16 @@ enum msix_hw_int_causes { BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0 = BIT(0), /* cause 32 */ }; +/* PCIe device states +* Host-Device interface is active +* Host-Device interface is inactive(as reflected by IPC_SLEEP_CONTROL_CSR_AD) +* Host-Device interface is inactive(as reflected by IPC_SLEEP_CONTROL_CSR_AD) +*/ +enum { +BTINTEL_PCIE_STATE_D0 =0 , +BTINTEL_PCIE_STATE_D3_HOT =2 , +BTINTEL_PCIE_STATE_D3_COLD =3 , +};#define BTINTEL_PCIE_MSIX_NON_AUTO_CLEAR_CAUSE BIT(7)/* Minimum and Maximum number of MSI-X Vector
@@ -67,7 +79,7 @@ enum msix_hw_int_causes {#define BTINTEL_DEFAULT_MAC_ACCESS_TIMEOUT_US 200000/* Default interrupt timeout in msec */ -#define BTINTEL_DEFAULT_INTR_TIMEOUT 3000 +#define BTINTEL_DEFAULT_INTR_TIMEOUT_MS 3000/* The number of descriptors in TX/RX queues */ #define BTINTEL_DESCS_COUNT 16
@@ -343,6 +355,7 @@ struct rxq {* @ia: Index Array struct * @txq: TX Queue struct * @rxq: RX Queue struct +* @alive_intr_ctxt: Alive interrupt context */ struct btintel_pcie_data {struct pci_dev *pdev;
@@ -389,6 +402,7 @@ struct btintel_pcie_data {struct ia ia;struct txq txq;struct rxq rxq; +u32 alive_intr_ctxt; }; static inline u32 btintel_pcie_rd_reg32(struct btintel_pcie_data *data,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 338/826 Bluetooth: btintel: Do no pass vendor events to stack
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiran K <[email protected]>
[ Upstream commit 510e8380b0382ee3b070748656b00f83c9a5bf80 ]
During firmware download, vendor specific events like boot up and secure send result are generated. These events can be safely processed at the driver level. Passing on these events to stack prints unnecessary log as below.
Bluetooth: hci0: Malformed MSFT vendor event: 0x02
--- drivers/bluetooth/btintel.c | 6 ++++-- drivers/bluetooth/btintel_pcie.c | 9 ++++++--- 2 files changed, 10 insertions(+), 5 deletions(-)
drivers/bluetooth/btintel.c +4 -2
@@ -3368,7 +3368,8 @@ int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb)* indicating that the bootup completed. */ btintel_bootup (hdev, ptr, len); -break ; +kfree_skb (skb); +return 0 ;case 0x06 :/* When the firmware loading completes the * device sends out a vendor specific event
@@ -3376,7 +3377,8 @@ int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb)* loading. */ btintel_secure_send_result (hdev, ptr, len); -break ; +kfree_skb (skb); +return 0 ; } }
drivers/bluetooth/btintel_pcie.c +6 -3
@@ -536,7 +536,8 @@ static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb)if (btintel_pcie_in_op (data)) {btintel_pcie_wr_sleep_cntrl (data,BTINTEL_PCIE_STATE_D0 ); data->alive_intr_ctxt =BTINTEL_PCIE_INTEL_HCI_RESET2 ; -break ; +kfree_skb (skb); +return 0 ; }if (btintel_pcie_in_iml (data)) {
@@ -553,7 +554,8 @@ static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb)btintel_wake_up_flag (data->hdev,INTEL_WAIT_FOR_D0 ); } -break ; +kfree_skb (skb); +return 0 ;case 0x06 :/* When the firmware loading completes the * device sends out a vendor specific event
@@ -561,7 +563,8 @@ static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb)* loading. */ btintel_secure_send_result (hdev, ptr, len); -break ; +kfree_skb (skb); +return 0 ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 339/826 Bluetooth: btmtk: adjust the position to init iso data anchor
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit 61c5a3def90ac729a538e5ca5ff7f461cff72776 ]
MediaTek iso data anchor init should be moved to where MediaTek claims iso data interface.
If there is an unexpected BT usb disconnect during setup flow, it will cause a NULL pointer crash issue when releasing iso anchor since the anchor wasn't been init yet. Adjust the position to do iso data anchor init.
[ 17.137991] pc : usb_kill_anchored_urbs+0x60/0x168 [ 17.137998] lr : usb_kill_anchored_urbs+0x44/0x168 [ 17.137999] sp : ffffffc0890cb5f0 [ 17.138000] x29: ffffffc0890cb5f0 x28: ffffff80bb6c2e80 [ 17.144081] gpio gpiochip0: registered chardev handle for 1 lines [ 17.148421] x27: 0000000000000000 [ 17.148422] x26: ffffffd301ff4298 x25: 0000000000000003 x24: 00000000000000f0 [ 17.148424] x23: 0000000000000000 x22: 00000000ffffffff x21: 0000000000000001 [ 17.148425] x20: ffffffffffffffd8 x19: ffffff80c0f25560 x18: 0000000000000000 [ 17.148427] x17: ffffffd33864e408 x16: ffffffd33808f7c8 x15: 0000000000200000 [ 17.232789] x14: e0cd73cf80ffffff x13: 50f2137c0a0338c9 x12: 0000000000000001 [ 17.239912] x11: 0000000080150011 x10: 0000000000000002 x9 : 0000000000000001 [ 17.247035] x8 : 0000000000000000 x7 : 0000000000008080 x6 : 8080000000000000 [ 17.254158] x5 : ffffffd33808ebc0 x4 : fffffffe033dcf20 x3 : 0000000080150011 [ 17.261281] x2 : ffffff8087a91400 x1 : 0000000000000000 x0 : ffffff80c0f25588 [ 17.268404] Call trace: [ 17.270841] usb_kill_anchored_urbs+0x60/0x168 [ 17.275274] btusb_mtk_release_iso_intf+0x2c/0xd8 [btusb (HASH:5afe 6)] [ 17.284226] btusb_mtk_disconnect+0x14/0x28 [btusb (HASH:5afe 6)] [ 17.292652] btusb_disconnect+0x70/0x140 [btusb (HASH:5afe 6)] [ 17.300818] usb_unbind_interface+0xc4/0x240 [ 17.305079] device_release_driver_internal+0x18c/0x258 [ 17.310296] device_release_driver+0x1c/0x30 [ 17.314557] bus_remove_device+0x140/0x160 [ 17.318643] device_del+0x1c0/0x330 [ 17.322121] usb_disable_device+0x80/0x180 [ 17.326207] usb_disconnect+0xec/0x300 [ 17.329948] hub_quiesce+0x80/0xd0 [ 17.333339] hub_disconnect+0x44/0x190 [ 17.337078] usb_unbind_interface+0xc4/0x240 [ 17.341337] device_release_driver_internal+0x18c/0x258 [ 17.346551] device_release_driver+0x1c/0x30 [ 17.350810] usb_driver_release_interface+0x70/0x88 [ 17.355677] proc_ioctl+0x13c/0x228 [ 17.359157] proc_ioctl_default+0x50/0x80 [ 17.363155] usbdev_ioctl+0x830/0xd08 [ 17.366808] __arm64_sys_ioctl+0x94/0xd0 [ 17.370723] invoke_syscall+0x6c/0xf8 [ 17.374377] el0_svc_common+0x84/0xe0 [ 17.378030] do_el0_svc+0x20/0x30 [ 17.381334] el0_svc+0x34/0x60 [ 17.384382] el0t_64_sync_handler+0x88/0xf0 [ 17.388554] el0t_64_sync+0x180/0x188 [ 17.392208] Code: f9400677 f100a2f4 54fffea0 d503201f (b8350288) [ 17.398289] ---[ end trace 0000000000000000 ]---
--- drivers/bluetooth/btmtk.c | 1 - drivers/bluetooth/btusb.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btmtk.c +0 -1
@@ -1215,7 +1215,6 @@ static int btmtk_usb_isointf_init(struct hci_dev *hdev)struct sk_buff *skb;int err; -init_usb_anchor (&btmtk_data->isopkt_anchor);spin_lock_init (&btmtk_data->isorxlock);__set_mtk_intr_interface (hdev);
drivers/bluetooth/btusb.c +1 -0
@@ -2616,6 +2616,7 @@ static void btusb_mtk_claim_iso_intf(struct btusb_data *data) }set_bit (BTMTK_ISOPKT_OVER_INTR , &btmtk_data->flags); +init_usb_anchor (&btmtk_data->isopkt_anchor); }static void btusb_mtk_release_iso_intf (struct btusb_data *data)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 340/826 Bluetooth: btbcm: fix missing of_node_put() in btbcm_get_board_name()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit e42eec0f182ac0605e658145f6fe3b6a7c256c45 ]
of_find_node_by_path() returns a pointer to a device_node with its refcount incremented, and a call to of_node_put() is required to decrement the refcount again and avoid leaking the resource.
If 'of_property_read_string_index(root, "compatible", 0, &tmp)' fails, the function returns without calling of_node_put(root) before doing so.
The automatic cleanup attribute can be used by means of the __free() macro to automatically call of_node_put() when the variable goes out of scope, fixing the issue and also accounting for new error paths.
--- drivers/bluetooth/btbcm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/bluetooth/btbcm.c +1 -3
@@ -541,11 +541,10 @@ static const struct bcm_subver_table bcm_usb_subver_table[] = {static const char *btbcm_get_board_name (struct device *dev) {#ifdef CONFIG_OF -struct device_node *root; + struct device_node *root __free(device_node) = of_find_node_by_path("/");char *board_type;const char *tmp; - root =of_find_node_by_path ("/" );if (!root)return NULL ;
@@ -555,7 +554,6 @@ static const char *btbcm_get_board_name(struct device *dev)/* get rid of any '/' in the compatible string */ board_type =devm_kstrdup (dev, tmp,GFP_KERNEL );strreplace (board_type,'/' ,'-' ); -of_node_put (root);return board_type;#else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 341/826 Bluetooth: ISO: Use kref to track lifetime of iso_conn
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit dc26097bdb864a0d5955b9a25e43376ffc1af99b ]
This make use of kref to keep track of reference of iso_conn which allows better tracking of its lifetime with usage of things like kref_get_unless_zero in a similar way as used in l2cap_chan.
In addition to it remove call to iso_sock_set_timer on iso_sock_disconn since at that point it is useless to set a timer as the sk will be freed there is nothing to be done in iso_sock_timeout.
--- net/bluetooth/iso.c | 88 ++++++++++++++++++++++++++++++++++++--------- 1 file changed, 71 insertions(+), 17 deletions(-)
net/bluetooth/iso.c +71 -17
@@ -35,6 +35,7 @@ struct iso_conn {struct sk_buff *rx_skb;__u32 rx_len;__u16 tx_sn; +struct kref ref; };#define iso_conn_lock (c) spin_lock(&(c)->lock)
@@ -93,6 +94,49 @@ static struct sock *iso_get_sock(bdaddr_t *src, bdaddr_t *dst,#define ISO_CONN_TIMEOUT (HZ * 40)#define ISO_DISCONN_TIMEOUT (HZ * 2) +static void iso_conn_free (struct kref *ref) +{ + struct iso_conn *conn = container_of(ref, struct iso_conn, ref); + +BT_DBG ("conn %p" , conn); + +if (conn->sk) +iso_pi (conn->sk)->conn =NULL ; + +if (conn->hcon) { + conn->hcon->iso_data =NULL ; +hci_conn_drop (conn->hcon); + } + +/* Ensure no more work items will run since hci_conn has been dropped */ +disable_delayed_work_sync (&conn->timeout_work); + +kfree (conn); +} + +static void iso_conn_put (struct iso_conn *conn) +{ +if (!conn) +return ; + +BT_DBG ("conn %p refcnt %d" , conn,kref_read (&conn->ref)); + +kref_put (&conn->ref, iso_conn_free); +} + +static struct iso_conn *iso_conn_hold_unless_zero (struct iso_conn *conn) +{ +if (!conn) +return NULL ; + +BT_DBG ("conn %p refcnt %u" , conn,kref_read (&conn->ref)); + +if (!kref_get_unless_zero (&conn->ref)) +return NULL ; + +return conn; +} +static struct sock *iso_sock_hold (struct iso_conn *conn) {if (!conn || !bt_sock_linked (&iso_sk_list, conn->sk))
@@ -109,9 +153,14 @@ static void iso_sock_timeout(struct work_struct *work) timeout_work.work);struct sock *sk; + conn =iso_conn_hold_unless_zero (conn); +if (!conn) +return ; +iso_conn_lock (conn); sk =iso_sock_hold (conn);iso_conn_unlock (conn); +iso_conn_put (conn);if (!sk)return ;
@@ -149,9 +198,14 @@ static struct iso_conn *iso_conn_add(struct hci_conn *hcon) {struct iso_conn *conn = hcon->iso_data; + conn =iso_conn_hold_unless_zero (conn);if (conn) { -if (!conn->hcon) +if (!conn->hcon) { +iso_conn_lock (conn); conn->hcon = hcon; +iso_conn_unlock (conn); + } +iso_conn_put (conn);return conn; }
@@ -159,6 +213,7 @@ static struct iso_conn *iso_conn_add(struct hci_conn *hcon)if (!conn)return NULL ; +kref_init (&conn->ref);spin_lock_init (&conn->lock);INIT_DELAYED_WORK (&conn->timeout_work, iso_sock_timeout);
@@ -178,17 +233,15 @@ static void iso_chan_del(struct sock *sk, int err)struct sock *parent; conn =iso_pi (sk)->conn; +iso_pi (sk)->conn =NULL ;BT_DBG ("sk %p, conn %p, err %d" , sk, conn, err);if (conn) {iso_conn_lock (conn); conn->sk =NULL ; -iso_pi (sk)->conn =NULL ;iso_conn_unlock (conn); - -if (conn->hcon) -hci_conn_drop (conn->hcon); +iso_conn_put (conn); } sk->sk_state =BT_CLOSED ;
@@ -210,6 +263,7 @@ static void iso_conn_del(struct hci_conn *hcon, int err)struct iso_conn *conn = hcon->iso_data;struct sock *sk; + conn =iso_conn_hold_unless_zero (conn);if (!conn)return ;
@@ -219,20 +273,18 @@ static void iso_conn_del(struct hci_conn *hcon, int err)iso_conn_lock (conn); sk =iso_sock_hold (conn);iso_conn_unlock (conn); +iso_conn_put (conn); -if (sk) { -lock_sock (sk); -iso_sock_clear_timer (sk); -iso_chan_del (sk, err); -release_sock (sk); -sock_put (sk); +if (!sk) { +iso_conn_put (conn); +return ; } -/* Ensure no more work items will run before freeing conn. */ -cancel_delayed_work_sync (&conn->timeout_work); - - hcon->iso_data =NULL ; -kfree (conn); +lock_sock (sk); +iso_sock_clear_timer (sk); +iso_chan_del (sk, err); +release_sock (sk); +sock_put (sk); } static int __iso_chan_add(struct iso_conn *conn, struct sock *sk,
@@ -652,6 +704,8 @@ static void iso_sock_destruct(struct sock *sk) {BT_DBG ("sk %p" , sk); +iso_conn_put (iso_pi (sk)->conn); +skb_queue_purge (&sk->sk_receive_queue);skb_queue_purge (&sk->sk_write_queue); }
@@ -711,6 +765,7 @@ static void iso_sock_disconn(struct sock *sk)*/ if (bis_sk) { hcon->state =BT_OPEN ; + hcon->iso_data =NULL ;iso_pi (sk)->conn->hcon =NULL ;iso_sock_clear_timer (sk);iso_chan_del (sk,bt_to_errno (hcon->abort_reason));
@@ -720,7 +775,6 @@ static void iso_sock_disconn(struct sock *sk) } sk->sk_state =BT_DISCONN ; -iso_sock_set_timer (sk,ISO_DISCONN_TIMEOUT );iso_conn_lock (iso_pi (sk)->conn);hci_conn_drop (iso_pi (sk)->conn->hcon);iso_pi (sk)->conn->hcon =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 342/826 Bluetooth: ISO: Do not emit LE PA Create Sync if previous is pending
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iulia Tanasescu <[email protected]>
[ Upstream commit 4a5e0ba68676b3a77298cf646cd2b39c94fbd2f5 ]
The Bluetooth Core spec does not allow a LE PA Create sync command to be sent to Controller if another one is pending (Vol 4, Part E, page 2493).
In order to avoid this issue, the HCI_CONN_CREATE_PA_SYNC was added to mark that the LE PA Create Sync command has been sent for a hcon. Once the PA Sync Established event is received, the hcon flag is erased and the next pending hcon is handled.
Stable-dep-of: 07a9342b94a9 ("Bluetooth: ISO: Send BIG Create Sync via hci_sync")
--- include/net/bluetooth/hci.h | 3 +- include/net/bluetooth/hci_core.h | 34 +++++++++ net/bluetooth/hci_conn.c | 123 +++++++++++++++++++++---------- net/bluetooth/hci_event.c | 19 ++++- 4 files changed, 139 insertions(+), 40 deletions(-)
include/net/bluetooth/hci.h +2 -1
@@ -1,7 +1,7 @@/* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2000-2001 Qualcomm Incorporated -Copyright 2023 NXP +Copyright 2023-2024 NXP Written 2000,2001 by Maxim Krasnyansky <[email protected]>
@@ -683,6 +683,7 @@ enum {#define HCI_RSSI_INVALID 127#define HCI_SYNC_HANDLE_INVALID 0xffff +#define HCI_SID_INVALID 0xff#define HCI_ROLE_MASTER 0x00#define HCI_ROLE_SLAVE 0x01
include/net/bluetooth/hci_core.h +34 -0
@@ -668,6 +668,7 @@ struct hci_conn {__u8 adv_instance;__u16 handle;__u16 sync_handle; +__u8 sid;__u16 state;__u16 mtu;__u8 mode;
@@ -947,6 +948,7 @@ enum {HCI_CONN_CREATE_CIS ,HCI_CONN_BIG_SYNC ,HCI_CONN_BIG_SYNC_FAILED , +HCI_CONN_CREATE_PA_SYNC ,HCI_CONN_PA_SYNC , HCI_CONN_PA_SYNC_FAILED, };
@@ -1099,6 +1101,30 @@ static inline struct hci_conn *hci_conn_hash_lookup_bis(struct hci_dev *hdev,return NULL ; } +static inline struct hci_conn *hci_conn_hash_lookup_sid (struct hci_dev *hdev, +__u8 sid, +bdaddr_t *dst, +__u8 dst_type) +{ +struct hci_conn_hash *h = &hdev->conn_hash; +struct hci_conn *c; + +rcu_read_lock (); + +list_for_each_entry_rcu (c, &h->list, list) { +if (c->type !=ISO_LINK ||bacmp (&c->dst, dst) || + c->dst_type != dst_type || c->sid != sid) +continue ; + +rcu_read_unlock (); +return c; + } + +rcu_read_unlock (); + +return NULL ; +} +static inline struct hci_conn * hci_conn_hash_lookup_per_adv_bis(struct hci_dev *hdev, bdaddr_t *ba,
@@ -1328,6 +1354,13 @@ hci_conn_hash_lookup_pa_sync_handle(struct hci_dev *hdev, __u16 sync_handle)if (c->type !=ISO_LINK )continue ; +/* Ignore the listen hcon, we are looking +* for the child hcon that was created as +* a result of the PA sync established event. +*/ +if (c->state ==BT_LISTEN ) +continue ; +if (c->sync_handle == sync_handle) {rcu_read_unlock ();return c;
@@ -1445,6 +1478,7 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle);void hci_sco_setup (struct hci_conn *conn,__u8 status);bool hci_iso_setup_path (struct hci_conn *conn);int hci_le_create_cis_pending (struct hci_dev *hdev); +int hci_pa_create_sync_pending (struct hci_dev *hdev);int hci_conn_check_create_cis (struct hci_conn *conn); struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
net/bluetooth/hci_conn.c +85 -38
164 lines not on this page · raw message
net/bluetooth/hci_event.c +18 -1
@@ -6345,7 +6345,7 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,struct hci_ev_le_pa_sync_established *ev = data;int mask = hdev->link_mode;__u8 flags =0 ; -struct hci_conn *pa_sync; +struct hci_conn *pa_sync, *conn;bt_dev_dbg (hdev,"status 0x%2.2x" , ev->status);
@@ -6353,6 +6353,20 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,hci_dev_clear_flag (hdev,HCI_PA_SYNC ); + conn =hci_conn_hash_lookup_sid (hdev, ev->sid, &ev->bdaddr, + ev->bdaddr_type); +if (!conn) { +bt_dev_err (hdev, +"Unable to find connection for dst %pMR sid 0x%2.2x" , + &ev->bdaddr, ev->sid); + goto unlock; + } + +clear_bit (HCI_CONN_CREATE_PA_SYNC , &conn->flags); + + conn->sync_handle =le16_to_cpu (ev->handle); + conn->sid =HCI_SID_INVALID ; + mask |=hci_proto_connect_ind (hdev, &ev->bdaddr,ISO_LINK , &flags);if (!(mask &HCI_LM_ACCEPT )) {hci_le_pa_term_sync (hdev, ev->handle);
@@ -6379,6 +6393,9 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data, } unlock: +/* Handle any other pending PA sync command */ +hci_pa_create_sync_pending (hdev); +hci_dev_unlock (hdev); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 343/826 Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iulia Tanasescu <[email protected]>
[ Upstream commit 42ecf1947135110ea08abeaca39741636f9a2285 ]
The Bluetooth Core spec does not allow a LE BIG Create sync command to be sent to Controller if another one is pending (Vol 4, Part E, page 2586).
In order to avoid this issue, the HCI_CONN_CREATE_BIG_SYNC was added to mark that the LE BIG Create Sync command has been sent for a hcon. Once the BIG Sync Established event is received, the hcon flag is erased and the next pending hcon is handled.
Stable-dep-of: 07a9342b94a9 ("Bluetooth: ISO: Send BIG Create Sync via hci_sync")
--- include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 29 +++++++++++ net/bluetooth/hci_conn.c | 87 +++++++++++++++++++++++++++----- net/bluetooth/hci_event.c | 20 +++++++- net/bluetooth/iso.c | 4 +- 5 files changed, 125 insertions(+), 16 deletions(-)
include/net/bluetooth/hci.h +1 -0
@@ -29,6 +29,7 @@#define HCI_MAX_ACL_SIZE 1024#define HCI_MAX_SCO_SIZE 255#define HCI_MAX_ISO_SIZE 251 +#define HCI_MAX_ISO_BIS 31#define HCI_MAX_EVENT_SIZE 260#define HCI_MAX_FRAME_SIZE (HCI_MAX_ACL_SIZE + 4)
include/net/bluetooth/hci_core.h +29 -0
@@ -711,6 +711,9 @@ struct hci_conn {__s8 tx_power;__s8 max_tx_power;struct bt_iso_qos iso_qos; +__u8 num_bis; +__u8 bis[HCI_MAX_ISO_BIS ]; +unsigned long flags;enum conn_reasons conn_reason;
@@ -946,6 +949,7 @@ enum {HCI_CONN_PER_ADV ,HCI_CONN_BIG_CREATED ,HCI_CONN_CREATE_CIS , +HCI_CONN_CREATE_BIG_SYNC ,HCI_CONN_BIG_SYNC ,HCI_CONN_BIG_SYNC_FAILED , HCI_CONN_CREATE_PA_SYNC,
@@ -1295,6 +1299,30 @@ static inline struct hci_conn *hci_conn_hash_lookup_big(struct hci_dev *hdev,return NULL ; } +static inline struct hci_conn * +hci_conn_hash_lookup_big_sync_pend (struct hci_dev *hdev, +__u8 handle,__u8 num_bis) +{ +struct hci_conn_hash *h = &hdev->conn_hash; +struct hci_conn *c; + +rcu_read_lock (); + +list_for_each_entry_rcu (c, &h->list, list) { +if (c->type !=ISO_LINK ) +continue ; + +if (handle == c->iso_qos.bcast.big && num_bis == c->num_bis) { +rcu_read_unlock (); +return c; + } + } + +rcu_read_unlock (); + +return NULL ; +} +static inline struct hci_conn *hci_conn_hash_lookup_big_state (struct hci_dev *hdev,__u8 handle,__u16 state) {
@@ -1479,6 +1507,7 @@ void hci_sco_setup(struct hci_conn *conn, __u8 status);bool hci_iso_setup_path (struct hci_conn *conn);int hci_le_create_cis_pending (struct hci_dev *hdev);int hci_pa_create_sync_pending (struct hci_dev *hdev); +int hci_le_big_create_sync_pending (struct hci_dev *hdev);int hci_conn_check_create_cis (struct hci_conn *conn); struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
net/bluetooth/hci_conn.c +73 -14
107 lines not on this page · raw message
net/bluetooth/hci_event.c +19 -1
@@ -6913,7 +6913,7 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb) {struct hci_evt_le_big_sync_estabilished *ev = data; -struct hci_conn *bis; +struct hci_conn *bis, *conn;int i;bt_dev_dbg (hdev,"status 0x%2.2x" , ev->status);
@@ -6924,6 +6924,20 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,hci_dev_lock (hdev); + conn =hci_conn_hash_lookup_big_sync_pend (hdev, ev->handle, + ev->num_bis); +if (!conn) { +bt_dev_err (hdev, +"Unable to find connection for big 0x%2.2x" , + ev->handle); + goto unlock; + } + +clear_bit (HCI_CONN_CREATE_BIG_SYNC , &conn->flags); + + conn->num_bis =0 ; +memset (conn->bis,0 ,sizeof (conn->num_bis)); +for (i =0 ; i < ev->num_bis; i++) {u16 handle =le16_to_cpu (ev->bis[i]);__le32 interval;
@@ -6973,6 +6987,10 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,hci_connect_cfm (bis, ev->status); } +unlock: +/* Handle any other pending BIG sync command */ +hci_le_big_create_sync_pending (hdev); +hci_dev_unlock (hdev); }
net/bluetooth/iso.c +3 -1
@@ -1996,6 +1996,7 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)if (sk) {int err; +struct hci_conn *hcon =iso_pi (sk)->conn->hcon;iso_pi (sk)->qos.bcast.encryption = ev2->encryption;
@@ -2004,7 +2005,8 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)if (!test_bit (BT_SK_DEFER_SETUP , &bt_sk (sk)->flags) && !test_and_set_bit (BT_SK_BIG_SYNC , &iso_pi (sk)->flags)) { - err = hci_le_big_create_sync(hdev, NULL, + err = hci_le_big_create_sync(hdev, + hcon, &iso_pi(sk)->qos, iso_pi(sk)->sync_handle, iso_pi(sk)->bc_num_bis,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 344/826 Bluetooth: ISO: Send BIG Create Sync via hci_sync
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Iulia Tanasescu <[email protected]>
[ Upstream commit 07a9342b94a91b306ed1cf6aa8254aea210764c9 ]
Before issuing the LE BIG Create Sync command, an available BIG handle is chosen by iterating through the conn_hash list and finding the first unused value.
If a BIG is terminated, the associated hcons are removed from the list and the LE BIG Terminate Sync command is sent via hci_sync queue. However, a new LE BIG Create sync command might be issued via hci_send_cmd, before the previous BIG sync was terminated. This can cause the same BIG handle to be reused and the LE BIG Create Sync to fail with Command Disallowed.
< HCI Command: LE Broadcast Isochronous Group Create Sync (0x08|0x006b)
BIG Handle: 0x00
BIG Sync Handle: 0x0002
Encryption: Unencrypted (0x00)
Broadcast Code[16]: 00000000000000000000000000000000
Maximum Number Subevents: 0x00
Timeout: 20000 ms (0x07d0)
Number of BIS: 1
BIS ID: 0x01Quoted 1 line
HCI Event: Command Status (
0x0f) plen 4
LE Broadcast Isochronous Group Create Sync (0x08|0x006b) ncmd 1
Status: Command Disallowed (0x0c)
< HCI Command: LE Broadcast Isochronous Group Terminate Sync (0x08|0x006c)
BIG Handle: 0x00This commit fixes the ordering of the LE BIG Create Sync/LE BIG Terminate Sync commands, to make sure that either the previous BIG sync is terminated before reusing the handle, or that a new handle is chosen for a new sync.
--- net/bluetooth/hci_conn.c | 17 ++++++++++++++++- net/bluetooth/iso.c | 9 +++++++++ 2 files changed, 25 insertions(+), 1 deletion(-)
net/bluetooth/hci_conn.c +16 -1
@@ -2188,7 +2188,15 @@ static bool hci_conn_check_create_big_sync(struct hci_conn *conn)return true; } -int hci_le_big_create_sync_pending (struct hci_dev *hdev) +static void big_create_sync_complete (struct hci_dev *hdev,void *data,int err) +{ +bt_dev_dbg (hdev,"" ); + +if (err) +bt_dev_err (hdev,"Unable to create BIG sync: %d" , err); +} + +static int big_create_sync (struct hci_dev *hdev,void *data) { DEFINE_FLEX(struct hci_cp_le_big_create_sync, pdu, bis, num_bis, 0x11);struct hci_conn *conn;
@@ -2245,6 +2253,13 @@ int hci_le_big_create_sync_pending(struct hci_dev *hdev) struct_size(pdu, bis, pdu->num_bis), pdu); } +int hci_le_big_create_sync_pending (struct hci_dev *hdev) +{ +/* Queue big_create_sync */ +return hci_cmd_sync_queue_once (hdev, big_create_sync, +NULL , big_create_sync_complete); +} +int hci_le_big_create_sync (struct hci_dev *hdev,struct hci_conn *hcon,struct bt_iso_qos *qos,__u16 sync_handle,__u8 num_bis,__u8 bis[])
net/bluetooth/iso.c +9 -0
@@ -1392,6 +1392,13 @@ static void iso_conn_big_sync(struct sock *sk)if (!hdev)return ; +/* hci_le_big_create_sync requires hdev lock to be held, since +* it enqueues the HCI LE BIG Create Sync command via +* hci_cmd_sync_queue_once, which checks hdev flags that might +* change. +*/ +hci_dev_lock (hdev); +if (!test_and_set_bit (BT_SK_BIG_SYNC , &iso_pi (sk)->flags)) { err = hci_le_big_create_sync(hdev, iso_pi(sk)->conn->hcon, &iso_pi(sk)->qos,
@@ -1402,6 +1409,8 @@ static void iso_conn_big_sync(struct sock *sk)bt_dev_err (hdev,"hci_le_big_create_sync: %d" , err); } + +hci_dev_unlock (hdev); } static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 345/826 Bluetooth: fix use-after-free in device_for_each_child()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d ]
Syzbot has reported the following KASAN splat:
BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980 CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 ? device_for_each_child+0x18f/0x1a0 print_report+0x13a/0x4cb ? __virt_addr_valid+0x5e/0x590 ? __phys_addr+0xc6/0x150 ? device_for_each_child+0x18f/0x1a0 kasan_report+0xda/0x110 ? device_for_each_child+0x18f/0x1a0 ? __pfx_dev_memalloc_noio+0x10/0x10 device_for_each_child+0x18f/0x1a0 ? __pfx_device_for_each_child+0x10/0x10 pm_runtime_set_memalloc_noio+0xf2/0x180 netdev_unregister_kobject+0x1ed/0x270 unregister_netdevice_many_notify+0x123c/0x1d80 ? __mutex_trylock_common+0xde/0x250 ? __pfx_unregister_netdevice_many_notify+0x10/0x10 ? trace_contention_end+0xe6/0x140 ? __mutex_lock+0x4e7/0x8f0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x12/0xc0 ? unregister_netdev+0x12/0x30 unregister_netdevice_queue+0x30d/0x3f0 ? __pfx_unregister_netdevice_queue+0x10/0x10 ? __pfx_down_write+0x10/0x10 unregister_netdev+0x1c/0x30 bnep_session+0x1fb3/0x2ab0 ? __pfx_bnep_session+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_woken_wake_function+0x10/0x10 ? __kthread_parkme+0x132/0x200 ? __pfx_bnep_session+0x10/0x10 ? kthread+0x13a/0x370 ? __pfx_bnep_session+0x10/0x10 kthread+0x2b7/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x48/0x80 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 4974: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kmalloc_noprof+0x1d1/0x440 hci_alloc_dev_priv+0x1d/0x2820 __vhci_create_device+0xef/0x7d0 vhci_write+0x2c7/0x480 vfs_write+0x6a0/0xfc0 ksys_write+0x12f/0x260 do_syscall_64+0xc7/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 4979: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x4f/0x70 kfree+0x141/0x490 hci_release_dev+0x4d9/0x600 bt_host_release+0x6a/0xb0 device_release+0xa4/0x240 kobject_put+0x1ec/0x5a0 put_device+0x1f/0x30 vhci_release+0x81/0xf0 __fput+0x3f6/0xb30 task_work_run+0x151/0x250 do_exit+0xa79/0x2c30 do_group_exit+0xd5/0x2a0 get_signal+0x1fcd/0x2210 arch_do_signal_or_restart+0x93/0x780 syscall_exit_to_user_mode+0x140/0x290 do_syscall_64+0xd4/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f
In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly.
--- net/bluetooth/hci_sysfs.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
net/bluetooth/hci_sysfs.c +4 -11
@@ -21,16 +21,6 @@ static const struct device_type bt_link = { .release = bt_link_release, }; -/* -* The rfcomm tty device will possibly retain even when conn -* is down, and sysfs doesn't support move zombie device, -* so we should move the device before conn device is destroyed. -*/ -static int __match_tty (struct device *dev,void *data) -{ -return !strncmp (dev_name (dev),"rfcomm" ,6 ); -} -void hci_conn_init_sysfs (struct hci_conn *conn) {struct hci_dev *hdev = conn->hdev;
@@ -73,10 +63,13 @@ void hci_conn_del_sysfs(struct hci_conn *conn)return ; } +/* If there are devices using the connection as parent reset it to NULL +* before unregistering the device. +*/ while (1 ) {struct device *dev; - dev =device_find_child (&conn->dev,NULL , __match_tty); + dev =device_find_any_child (&conn->dev);if (!dev)break ;device_move (dev,NULL ,DPM_ORDER_DEV_LAST );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 346/826 xsk: Free skb when TX metadata options are invalid
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Maurer <[email protected]>
[ Upstream commit 0c0d0f42ffa6ac94cd79893b7ed419c15e1b45de ]
When a new skb is allocated for transmitting an xsk descriptor, i.e., for every non-multibuf descriptor or the first frag of a multibuf descriptor, but the descriptor is later found to have invalid options set for the TX metadata, the new skb is never freed. This can leak skbs until the send buffer is full which makes sending more packets impossible.
Fix this by freeing the skb in the error path if we are currently dealing with the first frag, i.e., an skb allocated in this iteration of xsk_build_skb.
--- net/xdp/xsk.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/xdp/xsk.c +6 -5
@@ -675,6 +675,8 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs, len = desc->len;if (!skb) { + first_frag = true; + hr =max (NET_SKB_PAD ,L1_CACHE_ALIGN (dev->needed_headroom)); tr = dev->needed_tailroom; skb =sock_alloc_send_skb (&xs->sk, hr + len + tr,1 , &err);
@@ -685,12 +687,8 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,skb_put (skb, len); err =skb_store_bits (skb,0 , buffer, len); -if (unlikely (err)) { -kfree_skb (skb); +if (unlikely (err)) goto free_err; - } - - first_frag = true; }else {int nr_frags =skb_shinfo (skb)->nr_frags;struct page *page;
@@ -758,6 +756,9 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,return skb; free_err: +if (first_frag && skb) +kfree_skb (skb); +if (err == -EOVERFLOW ) {/* Drop the packet */ xsk_set_destructor_arg (xs->skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 347/826 erofs: fix file-backed mounts over FUSE
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 3a23787ca8756920d65fda39f41353a4be1d1642 ]
syzbot reported a null-ptr-deref in fuse_read_args_fill:
fuse_read_folio+0xb0/0x100 fs/fuse/file.c:905 filemap_read_folio+0xc6/0x2a0 mm/filemap.c:2367 do_read_cache_folio+0x263/0x5c0 mm/filemap.c:3825 read_mapping_folio include/linux/pagemap.h:1011 [inline] erofs_bread+0x34d/0x7e0 fs/erofs/data.c:41 erofs_read_superblock fs/erofs/super.c:281 [inline] erofs_fc_fill_super+0x2b9/0x2500 fs/erofs/super.c:625
Unlike most filesystems, some network filesystems and FUSE need unavoidable valid file pointers for their read I/Os [1]. Anyway, those use cases need to be supported too.
[1] https://docs.kernel.org/filesystems/vfs.html
--- fs/erofs/data.c | 10 ++++++---- fs/erofs/internal.h | 1 + 2 files changed, 7 insertions(+), 4 deletions(-)
fs/erofs/data.c +6 -4
@@ -38,7 +38,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, }if (!folio || !folio_contains (folio, index)) {erofs_put_metabuf (buf); - folio =read_mapping_folio (buf->mapping, index,NULL ); + folio =read_mapping_folio (buf->mapping, index, buf->file);if (IS_ERR (folio))return folio; }
@@ -61,9 +61,11 @@ void erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb) {struct erofs_sb_info *sbi =EROFS_SB (sb); -if (erofs_is_fileio_mode (sbi)) - buf->mapping =file_inode (sbi->fdev)->i_mapping; -else if (erofs_is_fscache_mode (sb)) + buf->file =NULL ; +if (erofs_is_fileio_mode (sbi)) { + buf->file = sbi->fdev;/* some fs like FUSE needs it */ + buf->mapping = buf->file->f_mapping; + }else if (erofs_is_fscache_mode (sb)) buf->mapping = sbi->s_fscache->inode->i_mapping;else buf->mapping = sb->s_bdev->bd_mapping;
fs/erofs/internal.h +1 -0
@@ -221,6 +221,7 @@ enum erofs_kmap_type {struct erofs_buf {struct address_space *mapping; +struct file *file;struct page *page;void *base;enum erofs_kmap_type kmap_type;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 348/826 erofs: fix blksize < PAGE_SIZE for file-backed mounts
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongzhen Luo <[email protected]>
[ Upstream commit bae0854160939a64a092516ff1b2f221402b843b ]
Adjust sb->s_blocksize{,_bits} directly for file-backed mounts when the fs block size is smaller than PAGE_SIZE.
Previously, EROFS used sb_set_blocksize(), which caused a panic if bdev-backed mounts is not used.
--- fs/erofs/super.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/erofs/super.c +5 -1
@@ -631,7 +631,11 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)errorfc (fc,"unsupported blksize for fscache mode" );return -EINVAL ; } -if (!sb_set_blocksize (sb,1 << sbi->blkszbits)) { + +if (erofs_is_fileio_mode (sbi)) { + sb->s_blocksize =1 << sbi->blkszbits; + sb->s_blocksize_bits = sbi->blkszbits; + }else if (!sb_set_blocksize (sb,1 << sbi->blkszbits)) {errorfc (fc,"failed to set erofs blksize" );return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 349/826 erofs: handle NONHEAD !delta[1] lclusters gracefully
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ]
syzbot reported a WARNING in iomap_iter_done:
iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline]
Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions.
Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions.
lclusterbits > 14 is illegal for compact indexes, error out too.
--- fs/erofs/zmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
fs/erofs/zmap.c +9 -8
@@ -219,7 +219,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m,unsigned int amortizedshift;erofs_off_t pos; -if (lcn >= totalidx) +if (lcn >= totalidx || vi->z_logical_clusterbits >14 )return -EINVAL ; m->lcn = lcn;
@@ -390,7 +390,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits;int err; - do { +while (1 ) {/* handle the last EOF pcluster (no next HEAD lcluster) */ if ((lcn << lclusterbits) >= inode->i_size) { map->m_llen = inode->i_size - map->m_la;
@@ -402,14 +402,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)return err;if (m->type ==Z_EROFS_LCLUSTER_TYPE_NONHEAD ) { -DBG_BUGON (!m->delta[1 ] && - m->clusterofs !=1 << lclusterbits); +/* work around invalid d1 generated by pre-1.0 mkfs */ +if (unlikely (!m->delta[1 ])) { + m->delta[1 ] =1 ; +DBG_BUGON (1 ); + } }else if (m->type ==Z_EROFS_LCLUSTER_TYPE_PLAIN || m->type ==Z_EROFS_LCLUSTER_TYPE_HEAD1 || m->type ==Z_EROFS_LCLUSTER_TYPE_HEAD2 ) { -/* go on until the next HEAD lcluster */ if (lcn != headlcn) -break ; +break ;/* ends at the next HEAD lcluster */ m->delta[1 ] =1 ; }else { erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu",
@@ -418,8 +420,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)return -EOPNOTSUPP ; } lcn += m->delta[1 ]; - }while (m->delta[1 ]); - + } map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 350/826 dlm: fix dlm_recover_members refcount on error
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit 200b977ebbc313a59174ba971006a231b3533dc5 ]
If dlm_recover_members() fails we don't drop the references of the previous created root_list that holds and keep all rsbs alive during the recovery. It might be not an unlikely event because ping_members() could run into an -EINTR if another recovery progress was triggered again.
--- fs/dlm/recoverd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/dlm/recoverd.c +1 -1
@@ -151,7 +151,7 @@ static int ls_recover(struct dlm_ls *ls, struct dlm_recover *rv) error =dlm_recover_members (ls, rv, &neg);if (error) {log_rinfo (ls,"dlm_recover_members error %d" , error); - goto fail; + goto fail_root_list; }dlm_recover_dir_nodeid (ls, &root_list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 351/826 eth: fbnic: dont disable the PCI device twice
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 62e9c00ea868ceb71156c517747dc69316c25bf1 ]
We use pcim_enable_device(), there is no need to call pci_disable_device().
--- drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_pci.c +0 -2
@@ -319,7 +319,6 @@ static int fbnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) free_irqs:fbnic_free_irqs (fbd); free_fbd: -pci_disable_device (pdev);fbnic_devlink_free (fbd);return err;
@@ -349,7 +348,6 @@ static void fbnic_remove(struct pci_dev *pdev)fbnic_fw_disable_mbx (fbd);fbnic_free_irqs (fbd); -pci_disable_device (pdev);fbnic_devlink_free (fbd); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 352/826 net: txgbe: remove GPIO interrupt controller
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit e867ed3ac8aa50945170723a450b5c068a56339a ]
Since the GPIO interrupt controller is always not working properly, we need to constantly add workaround to cope with hardware deficiencies. So just remove GPIO interrupt controller, and let the SFP driver poll the GPIO status.
--- .../net/ethernet/wangxun/txgbe/txgbe_irq.c | 24 +-- .../net/ethernet/wangxun/txgbe/txgbe_main.c | 1 - .../net/ethernet/wangxun/txgbe/txgbe_phy.c | 166 ------------------ .../net/ethernet/wangxun/txgbe/txgbe_phy.h | 2 - .../net/ethernet/wangxun/txgbe/txgbe_type.h | 7 +- 5 files changed, 4 insertions(+), 196 deletions(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c +2 -22
@@ -72,14 +72,6 @@ int txgbe_request_queue_irqs(struct wx *wx)return err; } -static int txgbe_request_gpio_irq (struct txgbe *txgbe) -{ - txgbe->gpio_irq =irq_find_mapping (txgbe->misc.domain,TXGBE_IRQ_GPIO ); -return request_threaded_irq (txgbe->gpio_irq,NULL , - txgbe_gpio_irq_handler, -IRQF_ONESHOT ,"txgbe-gpio-irq" , txgbe); -} -static int txgbe_request_link_irq (struct txgbe *txgbe) { txgbe->link_irq =irq_find_mapping (txgbe->misc.domain,TXGBE_IRQ_LINK );
@@ -149,11 +141,6 @@ static irqreturn_t txgbe_misc_irq_thread_fn(int irq, void *data)u32 eicr; eicr =wx_misc_isb (wx,WX_ISB_MISC ); -if (eicr &TXGBE_PX_MISC_GPIO ) { - sub_irq =irq_find_mapping (txgbe->misc.domain,TXGBE_IRQ_GPIO ); -handle_nested_irq (sub_irq); - nhandled++; - }if (eicr & (TXGBE_PX_MISC_ETH_LK |TXGBE_PX_MISC_ETH_LKDN |TXGBE_PX_MISC_ETH_AN )) { sub_irq =irq_find_mapping (txgbe->misc.domain,TXGBE_IRQ_LINK );
@@ -179,7 +166,6 @@ static void txgbe_del_irq_domain(struct txgbe *txgbe)void txgbe_free_misc_irq (struct txgbe *txgbe) { -free_irq (txgbe->gpio_irq, txgbe);free_irq (txgbe->link_irq, txgbe);free_irq (txgbe->misc.irq, txgbe);txgbe_del_irq_domain (txgbe);
@@ -191,7 +177,7 @@ int txgbe_setup_misc_irq(struct txgbe *txgbe)struct wx *wx = txgbe->wx;int hwirq, err; - txgbe->misc.nirqs =2 ; + txgbe->misc.nirqs =1 ; txgbe->misc.domain =irq_domain_add_simple (NULL , txgbe->misc.nirqs,0 , &txgbe_misc_irq_domain_ops, txgbe);if (!txgbe->misc.domain)
@@ -216,20 +202,14 @@ int txgbe_setup_misc_irq(struct txgbe *txgbe)if (err) goto del_misc_irq; - err =txgbe_request_gpio_irq (txgbe); -if (err) - goto free_msic_irq; - err =txgbe_request_link_irq (txgbe);if (err) - goto free_gpio_irq; + goto free_msic_irq; wx->misc_irq_domain = true;return 0 ; -free_gpio_irq: -free_irq (txgbe->gpio_irq, txgbe); free_msic_irq:free_irq (txgbe->misc.irq, txgbe); del_misc_irq:
drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +0 -1
@@ -82,7 +82,6 @@ static void txgbe_up_complete(struct wx *wx) {struct net_device *netdev = wx->netdev; -txgbe_reinit_gpio_intr (wx);wx_control_hw (wx, true);wx_configure_vectors (wx);
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +0 -166
180 lines not on this page · raw message
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.h +0 -2
@@ -4,8 +4,6 @@#ifndef _TXGBE_PHY_H_#define _TXGBE_PHY_H_ -irqreturn_t txgbe_gpio_irq_handler (int irq,void *data); -void txgbe_reinit_gpio_intr (struct wx *wx);irqreturn_t txgbe_link_irq_handler (int irq,void *data);int txgbe_init_phy (struct txgbe *txgbe);void txgbe_remove_phy (struct txgbe *txgbe);
drivers/net/ethernet/wangxun/txgbe/txgbe_type.h +2 -5
@@ -75,8 +75,7 @@#define TXGBE_PX_MISC_IEN_MASK \ (TXGBE_PX_MISC_ETH_LKDN | TXGBE_PX_MISC_DEV_RST | \ TXGBE_PX_MISC_ETH_EVENT | TXGBE_PX_MISC_ETH_LK | \ - TXGBE_PX_MISC_ETH_AN | TXGBE_PX_MISC_INT_ERR | \ - TXGBE_PX_MISC_GPIO) + TXGBE_PX_MISC_ETH_AN | TXGBE_PX_MISC_INT_ERR)/* Port cfg registers */ #define TXGBE_CFG_PORT_ST 0x14404
@@ -313,8 +312,7 @@ struct txgbe_nodes { };enum txgbe_misc_irqs { -TXGBE_IRQ_GPIO =0 , -TXGBE_IRQ_LINK , +TXGBE_IRQ_LINK =0 ,TXGBE_IRQ_MAX };
@@ -335,7 +333,6 @@ struct txgbe {struct clk_lookup *clock;struct clk *clk;struct gpio_chip *gpio; -unsigned int gpio_irq;unsigned int link_irq;/* flow director */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 353/826 net: txgbe: fix null pointer to pcs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit 2160428bcb20f2f70a72ee84aba91a1264dc4ff3 ]
For 1000BASE-X or SGMII interface mode, the PCS also need to be selected. Only return null pointer when there is a copper NIC with external PHY.
--- drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +1 -1
@@ -162,7 +162,7 @@ static struct phylink_pcs *txgbe_phylink_mac_select(struct phylink_config *confistruct wx *wx =phylink_to_wx (config);struct txgbe *txgbe = wx->priv; -if (interface ==PHY_INTERFACE_MODE_10GBASER ) +if (wx->media_type != sp_media_copper)return &txgbe->xpcs->pcs;return NULL ;
Signature · 1 line
2.43.0