6.17.9-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.17.9-rc1 review
This is the start of the stable review cycle for the 6.17.9 release. There are 247 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 23 Nov 2025 13:01:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.17.9-rc1
Horatiu Vultur <[email protected]>
net: phy: micrel: Fix lan8814_config_init
Abdun Nihaal <[email protected]>
isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
Sean Christopherson <[email protected]>
KVM: VMX: Inject #UD if guest tries to execute SEAMCALL or TDCALL
Xin Li <[email protected]>
KVM: x86: Add support for RDMSR/WRMSRNS w/ immediate on Intel
Sean Christopherson <[email protected]>
KVM: x86: Rename local "ecx" variables to "msr" and "pmc" as appropriate
Claudiu Beznea <[email protected]>
ASoC: da7213: Use component driver suspend/resume
Geert Uytterhoeven <[email protected]>
ASoC: da7213: Convert to DEFINE_RUNTIME_DEV_PM_OPS()
Carlos Llamas <[email protected]>
scripts/decode_stacktrace.sh: fix build ID and PC source parsing
Matthieu Baerts (NGI0) <[email protected]>
scripts/decode_stacktrace.sh: symbol: preserve alignment
Matthieu Baerts (NGI0) <[email protected]>
scripts/decode_stacktrace.sh: symbol: avoid trailing whitespaces
Kiryl Shutsemau <[email protected]>
mm/memory: do not populate page table entries beyond i_size
Zi Yan <[email protected]>
mm/huge_memory: do not change split_huge_page*() target order silently
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: properly kill background tasks
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: userspace: longer transfer
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: trunc: read all recv data
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: endpoints: longer transfer
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: rm: set backup flag
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: connect: fix fallback note due to OoO
Marek Szyprowski <[email protected]>
pmdomain: samsung: Rework legacy splash-screen handover workaround
André Draszik <[email protected]>
pmdomain: samsung: plug potential memleak during probe
Miaoqian Lin <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_remove
Sudeep Holla <[email protected]>
pmdomain: arm: scmi: Fix genpd leak on provider registration failure
Nitin Gote <[email protected]>
drm/xe/xe3: Add WA_14024681466 for Xe3_LPG
Tangudu Tilak Tirumalesh <[email protected]>
drm/xe/xe3: Extend wa_14023061436
Nitin Gote <[email protected]>
drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg
Jani Nikula <[email protected]>
drm/i915/psr: fix pipe to vblank conversion
Vitaly Prosyak <[email protected]>
drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
Jesse.Zhang <[email protected]>
drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process
Jonathan Kim <[email protected]>
drm/amdkfd: relax checks for over allocation of save area
Zilin Guan <[email protected]>
btrfs: release root after error in data_reloc_print_warning_inode()
Filipe Manana <[email protected]>
btrfs: do not update last_log_commit when logging inode due to a new name
Zilin Guan <[email protected]>
btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
Naohiro Aota <[email protected]>
btrfs: zoned: fix stripe width calculation
Naohiro Aota <[email protected]>
btrfs: zoned: fix conventional zone capacity calculation
Mario Limonciello (AMD) <[email protected]>
PM: hibernate: Use atomic64_t for compressed_size variable
Mario Limonciello (AMD) <[email protected]>
PM: hibernate: Emit an error when image writing fails
Niravkumar L Rabara <[email protected]>
EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
Niravkumar L Rabara <[email protected]>
EDAC/altera: Handle OCRAM ECC enable after warm reset
Huacai Chen <[email protected]>
LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
Huacai Chen <[email protected]>
LoongArch: Consolidate max_pfn & max_low_pfn calculation
Song Liu <[email protected]>
ftrace: Fix BPF fexit with livepatch
Jens Axboe <[email protected]>
io_uring/rw: ensure allocated iovec gets cleared for early failure
Sami Tolvanen <[email protected]>
gendwarfksyms: Skip files with no exports
Ankit Khushwaha <[email protected]>
selftests/user_events: fix type cast for write_index packed member in perf_test
Mario Limonciello <[email protected]>
x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
Hans de Goede <[email protected]>
spi: Try to get ACPI GPIO IRQ earlier
Henrique Carvalho <[email protected]>
smb: client: fix cifs_pick_channel when channel needs reconnect
Miaoqian Lin <[email protected]>
crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value
Sourabh Jain <[email protected]>
crash: fix crashkernel resource shrink
Hao Ge <[email protected]>
codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext
Edward Adam Davis <[email protected]>
cifs: client: fix memory leak in smb3_fs_context_parse_param
Miaoqian Lin <[email protected]>
ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present()
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver
Shawn Lin <[email protected]>
mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
Rakuram Eswaran <[email protected]>
mmc: pxamci: Simplify pxamci_probe() error handling using devm APIs
Shawn Lin <[email protected]>
mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
Zi Yan <[email protected]>
mm/huge_memory: fix folio split check for anon folios in swapcache
Kairui Song <[email protected]>
mm, swap: fix potential UAF issue for VMA readahead
Dev Jain <[email protected]>
mm/mremap: honour writable bit in mremap pte batching
Kairui Song <[email protected]>
mm/shmem: fix THP allocation and fallback loop
Aleksei Nikiforov <[email protected]>
mm/kmsan: fix kmsan kmalloc hook when no stack depots are allocated yet
Quanmin Yan <[email protected]>
mm/damon/stat: change last_refresh_jiffies to a global variable
Isaac J. Manjarres <[email protected]>
mm/mm_init: fix hash table order logging in alloc_large_system_hash()
Wei Yang <[email protected]>
fs/proc: fix uaf in proc_readdir_de()
Zi Yan <[email protected]>
mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
Johannes Berg <[email protected]>
wifi: mac80211: reject address change while connecting
Steven Rostedt <[email protected]>
selftests/tracing: Run sample events to clear page cache events
Lance Yang <[email protected]>
mm/secretmem: fix use-after-free race in fault handler
Breno Leitao <[email protected]>
net: netpoll: fix incorrect refcount handling causing incorrect cleanup
Edward Adam Davis <[email protected]>
nilfs2: avoid having an active sc_timer before freeing sci
Quanmin Yan <[email protected]>
mm/damon/sysfs: change next_update_jiffies to a global variable
Chuang Wang <[email protected]>
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
Tianyang Zhang <[email protected]>
LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
Huacai Chen <[email protected]>
LoongArch: Use correct accessor to read FWPC/MWPC
Huacai Chen <[email protected]>
LoongArch: Consolidate early_ioremap()/ioremap_prot()
Martin Kaiser <[email protected]>
maple_tree: fix tracepoint string pointers
Qinxin Xia <[email protected]>
dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
Nate Karstens <[email protected]>
strparser: Fix signed/unsigned mismatch bug
Pratyush Yadav <[email protected]>
kho: warn and exit when unpreserved page wasn't preserved
Pasha Tatashin <[email protected]>
kho: allocate metadata directly from the buddy allocator
Pasha Tatashin <[email protected]>
kho: increase metadata bitmap size to PAGE_SIZE
Pasha Tatashin <[email protected]>
kho: warn and fail on metadata or preserved memory in scratch area
Pedro Demarchi Gomes <[email protected]>
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
Joshua Rogers <[email protected]>
ksmbd: close accepted socket when per-IP limit rejects connection
Peter Oberparleiter <[email protected]>
gcov: add support for GCC 15
Olga Kornievskaia <[email protected]>
NFSD: free copynotify stateid in nfs4_free_ol_stateid()
Olga Kornievskaia <[email protected]>
nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
NeilBrown <[email protected]>
nfsd: fix refcount leak in nfsd_set_fh_dentry()
Sukrit Bhatnagar <[email protected]>
KVM: VMX: Fix check for valid GVA on an EPT violation
Yosry Ahmed <[email protected]>
KVM: nSVM: Fix and simplify LBR virtualization handling with nested
Yosry Ahmed <[email protected]>
KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv()
Yosry Ahmed <[email protected]>
KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
Marc Zyngier <[email protected]>
KVM: arm64: Make all 32bit ID registers fully writable
Sean Christopherson <[email protected]>
KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying
Bibo Mao <[email protected]>
LoongArch: KVM: Fix max supported vCPUs set with EIOINTC
Bibo Mao <[email protected]>
LoongArch: KVM: Add delay until timer interrupt injected
Bibo Mao <[email protected]>
LoongArch: KVM: Restore guest PMU if it is enabled
Abdun Nihaal <[email protected]>
HID: uclogic: Fix potential memory leak in error path
Abdun Nihaal <[email protected]>
HID: playstation: Fix memory leak in dualshock4_get_calibration_data()
Luke Wang <[email protected]>
pwm: adp5585: Correct mismatched pwm chip info
Chukun Pan <[email protected]>
arm64: dts: rockchip: drop reset from rk3576 i2c9 node
Andrey Leonchikov <[email protected]>
arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2
Rafał Miłecki <[email protected]>
ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
Masami Ichikawa <[email protected]>
HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
Frieder Schrempf <[email protected]>
arm64: dts: imx8mp-kontron: Fix USB OTG role switching
João Paulo Gonçalves <[email protected]>
arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred
Jihed Chaibi <[email protected]>
ARM: dts: imx51-zii-rdu1: Fix audmux node names
Dario Binacchi <[email protected]>
ARM: dts: imx6ull-engicam-microgea-rmm: fix report-rate-hz value
Dragan Simic <[email protected]>
arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic
Andrey Leonchikov <[email protected]>
arm64: dts: rockchip: Fix PCIe power enable pin for BigTreeTech CB2 and Pi2
Anand Moon <[email protected]>
arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
Ravi Bangoria <[email protected]>
perf test: Fix lock contention test
Ian Rogers <[email protected]>
perf test shell lock_contention: Extra debug diagnostics
Ravi Bangoria <[email protected]>
perf lock: Fix segfault due to missing kernel map
Arnaldo Carvalho de Melo <[email protected]>
perf build: Don't fail fast path feature detection when binutils-devel is not available
Thomas Falcon <[email protected]>
perf header: Write bpf_prog (infos|btfs)_cnt to data file
Zqiang <[email protected]>
sched_ext: Fix unsafe locking in the scx_dump_state()
Andrei Vagin <[email protected]>
fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
Zilin Guan <[email protected]>
binfmt_misc: restore write access before closing files opened by open_exec()
Alok Tiwari <[email protected]>
virtio-fs: fix incorrect check for fsvq->kobj
Dan Carpenter <[email protected]>
mtd: onenand: Pass correct pointer to IRQ handler
David Howells <[email protected]>
afs: Fix dynamic lookup to fail on cell lookup failure
Hongbo Li <[email protected]>
hostfs: Fix only passing host root in boot stage with new mount
Eric Biggers <[email protected]>
lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
Eslam Khafagy <[email protected]>
posix-timers: Plug potential memory leak in do_timer_create()
Nick Hu <[email protected]>
irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
Eduard Zingerman <[email protected]>
bpf: account for current allocated stack depth in widen_imprecise_scalars()
Eric Dumazet <[email protected]>
bpf: Add bpf_prog_run_data_pointers()
Randy Dunlap <[email protected]>
drm/client: fix MODULE_PARM_DESC string for "active"
Haotian Zhang <[email protected]>
ASoC: rsnd: fix OF node reference leak in rsnd_ssiu_probe()
Dave Jiang <[email protected]>
acpi/hmat: Fix lockdep warning for hmem_register_resource()
Sultan Alsawaf <[email protected]>
drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO
Haein Lee <[email protected]>
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
Dai Ngo <[email protected]>
NFS: Fix LTP test failures when timestamps are delegated
Trond Myklebust <[email protected]>
NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
Yang Xiuwei <[email protected]>
NFS: sysfs: fix leak when nfs_client kobject add fails
Trond Myklebust <[email protected]>
NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
Al Viro <[email protected]>
simplify nfs_atomic_open_v23()
Trond Myklebust <[email protected]>
NFS: Check the TLS certificate fields in nfs_match_client()
Trond Myklebust <[email protected]>
pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
Trond Myklebust <[email protected]>
pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
Trond Myklebust <[email protected]>
pnfs: Fix TLS logic in _nfs4_pnfs_v3_ds_connect()
Boris Brezillon <[email protected]>
drm/panthor: Flush shmem writes before mapping buffers CPU-uncached
Shenghao Ding <[email protected]>
ASoC: tas2781: fix getting the wrong device number
Ian Forbes <[email protected]>
drm/vmwgfx: Restore Guest-Backed only cursor plane support
Ian Forbes <[email protected]>
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
Haotian Zhang <[email protected]>
ASoC: codecs: va-macro: fix resource leak in probe error path
Haotian Zhang <[email protected]>
ASoC: cs4271: Fix regulator leak on probe failure
Haotian Zhang <[email protected]>
regulator: fixed: fix GPIO descriptor leak on register failure
Shuai Xue <[email protected]>
acpi,srat: Fix incorrect device handle check for Generic Initiator
Caleb Sander Mateos <[email protected]>
io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs
Andrii Melnychenko <[email protected]>
netfilter: nft_ct: add seqadj extension for natted connections
Pauli Virtanen <[email protected]>
Bluetooth: L2CAP: export l2cap_chan_hold for modules
Srinivas Pandruvada <[email protected]>
cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Perform fast check switch only for online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Check _CPC validity for only the online CPUs
Gautham R. Shenoy <[email protected]>
ACPI: CPPC: Detect preferred core availability on online CPUs
Felix Maurer <[email protected]>
hsr: Follow standard for HSRv0 supervision frames
Felix Maurer <[email protected]>
hsr: Fix supervision frame sending on HSRv0
Xuan Zhuo <[email protected]>
virtio-net: fix incorrect flags recording in big mode
Miri Korenblit <[email protected]>
wifi: iwlwifi: mld: always take beacon ies in link grading
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: fix beacon template/fixed rate
Eric Dumazet <[email protected]>
net_sched: limit try_bulk_dequeue_skb() batches
Akiva Goldberger <[email protected]>
mlx5: Fix default values in create CQ
Cosmin Ratiu <[email protected]>
net/mlx5e: Prepare for using different CQ doorbells
Cosmin Ratiu <[email protected]>
net/mlx5: Store the global doorbell in mlx5_priv
Cosmin Ratiu <[email protected]>
net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET
Gal Pressman <[email protected]>
net/mlx5e: Fix potentially misleading debug message
Gal Pressman <[email protected]>
net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
Gal Pressman <[email protected]>
net/mlx5e: Fix maxrate wraparound in threshold between units
Carolina Jubran <[email protected]>
net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state()
Ranganath V N <[email protected]>
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
Ranganath V N <[email protected]>
net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Fix not handling PA Sync Lost event
Kuniyuki Iwashima <[email protected]>
af_unix: Initialise scc_index in unix_add_edge().
Benjamin Berg <[email protected]>
wifi: mac80211: skip rate verification for not captured PSDUs
Buday Csaba <[email protected]>
net: mdio: fix resource leak in mdiobus_register_device()
Kuniyuki Iwashima <[email protected]>
tipc: Fix use-after-free in tipc_mon_reinit_self().
Aksh Garg <[email protected]>
net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism
Aksh Garg <[email protected]>
net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout
Zilin Guan <[email protected]>
net/handshake: Fix memory leak in tls_handshake_accept()
D. Wythe <[email protected]>
net/smc: fix mismatch between CLC header and proposal
Jonas Gorski <[email protected]>
net: dsa: tag_brcm: do not mark link local traffic as offloaded
Eric Dumazet <[email protected]>
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
Pauli Virtanen <[email protected]>
Bluetooth: MGMT: cancel mesh send timer when hdev removed
Chuck Lever <[email protected]>
NFSD: Skip close replay processing if XDR encoding fails
Xi Ruoyao <[email protected]>
rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags
Horatiu Vultur <[email protected]>
net: phy: micrel: lan8814 fix reset of the QSGMII interface
Horatiu Vultur <[email protected]>
net: phy: micrel: Replace hardcoded pages with defines
Horatiu Vultur <[email protected]>
net: phy: micrel: Introduce lanphy_modify_page_reg
Wei Fang <[email protected]>
net: fec: correct rx_bytes statistic for the case SHIFT16 is set
Alexander Sverdlin <[email protected]>
selftests: net: local_termination: Wait for interfaces to come up
Gao Xiang <[email protected]>
erofs: avoid infinite loop due to incomplete zstd-compressed data
Nicolas Escande <[email protected]>
wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
Jedrzej Jagielski <[email protected]>
ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd
Dawn Gardner <[email protected]>
ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx
Sharique Mohammad <[email protected]>
ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
Stuart Hayhurst <[email protected]>
HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
ZhangGuoDong <[email protected]>
smb/server: fix possible refcount leak in smb2_sess_setup()
ZhangGuoDong <[email protected]>
smb/server: fix possible memory leak in smb2_read()
Pavel Begunkov <[email protected]>
io_uring: fix unexpected placement on same size resizing
Jaehun Gou <[email protected]>
exfat: fix improper check of dentry.stream.valid_size
Oleg Makarenko <[email protected]>
HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
Scott Mayhew <[email protected]>
NFS: check if suid/sgid was cleared after a write as needed
Vicki Pfau <[email protected]>
HID: nintendo: Wait longer for initial probe
Jedrzej Jagielski <[email protected]>
ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation
Tristan Lobb <[email protected]>
HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
Abhishek Tamboli <[email protected]>
HID: intel-thc-hid: intel-quickspi: Add ARL PCI Device Id's
Joshua Watt <[email protected]>
NFS4: Apply delay_retrans to async operations
Jonathan Kim <[email protected]>
drm/amdkfd: fix suspend/resume all calls in mes based eviction path
Joshua Watt <[email protected]>
NFS4: Fix state renewals missing after boot
Jesse.Zhang <[email protected]>
drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
Christian König <[email protected]>
drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
Christian König <[email protected]>
drm/amdgpu: remove two invalid BUG_ON()s
Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
Andrey Albershteyn <[email protected]>
fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls
Han Gao <[email protected]>
riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
Danil Skrebenkov <[email protected]>
RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
Feng Jiang <[email protected]>
riscv: Build loader.bin exclusively for Canaan K210
Peter Zijlstra <[email protected]>
compiler_types: Move unused static inline functions warning to W=2
Yang Shi <[email protected]>
arm64: kprobes: check the return value of set_memory_rox()
Timur Kristóf <[email protected]>
drm/amd: Disable ASPM on SI
Timur Kristóf <[email protected]>
drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
Timur Kristóf <[email protected]>
drm/amd/display: Disable fastboot on DCE 6 too
Timur Kristóf <[email protected]>
drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
Timur Kristóf <[email protected]>
drm/amd/display: Add pixel_clock to amd_pp_display_configuration
Jouni Högander <[email protected]>
drm/xe: Do clean shutdown also when using flr
Tejas Upadhyay <[email protected]>
drm/xe: Move declarations under conditional branch
Balasubramani Vivekanandan <[email protected]>
drm/xe/guc: Synchronize Dead CT worker with unbind
Mario Limonciello <[email protected]>
drm/amd: Fix suspend failure with secure display TA
Peter Zijlstra <[email protected]>
futex: Optimize per-cpu reference counting
Jason Gunthorpe <[email protected]>
iommufd: Make vfio_compat's unmap succeed if the range is already empty
Shuhao Fu <[email protected]>
smb: client: fix refcount leak in smb2_set_path_attr
Mario Limonciello (AMD) <[email protected]>
drm/amd/display: Don't stretch non-native images by default in eDP
Alex Deucher <[email protected]>
drm/amdgpu: set default gfx reset masks for gfx6-8
Umesh Nerlige Ramappa <[email protected]>
drm/i915: Fix conversion between clock ticks and nanoseconds
Janusz Krzysztofik <[email protected]>
drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
Jason-JH Lin <[email protected]>
drm/mediatek: Add pm_runtime support for GCE power control
Nicolin Chen <[email protected]>
iommufd/selftest: Fix ioctl return value in _test_cmd_trigger_vevents()
-------------
Diffstat:
Makefile | 4 +- .../boot/dts/broadcom/bcm47189-luxul-xap-1440.dts | 4 +- arch/arm/boot/dts/nxp/imx/imx51-zii-rdu1.dts | 4 +- .../dts/nxp/imx/imx6ull-engicam-microgea-rmm.dts | 2 +- arch/arm/crypto/Kconfig | 2 +- arch/arm64/boot/dts/freescale/imx8-ss-img.dtsi | 2 - .../boot/dts/freescale/imx8mp-kontron-bl-osm-s.dts | 24 +- .../boot/dts/rockchip/rk3566-bigtreetech-cb2.dtsi | 6 +- arch/arm64/boot/dts/rockchip/rk3568-odroid-m1.dts | 2 + arch/arm64/boot/dts/rockchip/rk3576.dtsi | 2 - arch/arm64/boot/dts/rockchip/rk3588-opp.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3588j.dtsi | 2 +- arch/arm64/kernel/probes/kprobes.c | 5 +- arch/arm64/kvm/sys_regs.c | 59 +-- arch/loongarch/include/asm/hw_breakpoint.h | 4 +- arch/loongarch/include/asm/io.h | 5 +- arch/loongarch/include/asm/pgtable.h | 11 +- arch/loongarch/kernel/mem.c | 7 +- arch/loongarch/kernel/numa.c | 23 +- arch/loongarch/kernel/setup.c | 5 +- arch/loongarch/kernel/traps.c | 4 +- arch/loongarch/kvm/intc/eiointc.c | 2 +- arch/loongarch/kvm/timer.c | 2 + arch/loongarch/kvm/vcpu.c | 5 + arch/loongarch/mm/init.c | 2 - arch/loongarch/mm/ioremap.c | 2 +- arch/riscv/Makefile | 2 +- arch/riscv/kernel/cpu-hotplug.c | 1 + arch/riscv/kernel/setup.c | 7 +- arch/x86/include/asm/kvm_host.h | 3 + arch/x86/include/uapi/asm/vmx.h | 7 +- arch/x86/kernel/acpi/cppc.c | 2 +- arch/x86/kernel/cpu/amd.c | 7 + arch/x86/kernel/cpu/microcode/amd.c | 1 + arch/x86/kvm/svm/nested.c | 20 +- arch/x86/kvm/svm/svm.c | 73 ++- arch/x86/kvm/vmx/common.h | 2 +- arch/x86/kvm/vmx/nested.c | 21 +- arch/x86/kvm/vmx/vmx.c | 29 ++ arch/x86/kvm/vmx/vmx.h | 5 + arch/x86/kvm/x86.c | 75 ++- drivers/acpi/cppc_acpi.c | 6 +- drivers/acpi/numa/hmat.c | 46 +- drivers/acpi/numa/srat.c | 2 +- drivers/bluetooth/btusb.c | 13 +- drivers/cpufreq/intel_pstate.c | 9 +- drivers/crypto/hisilicon/qm.c | 2 + drivers/edac/altera_edac.c | 22 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 12 + drivers/gpu/drm/amd/amdgpu/amdgpu_isp.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 - drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 5 + drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 5 + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 5 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 73 +-- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 12 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c | 1 + .../amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 2 +- drivers/gpu/drm/amd/display/dc/dm_services_types.h | 2 +- .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 6 +- drivers/gpu/drm/amd/include/dm_pp_interface.h | 1 + drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 67 +++ drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h | 2 + drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +- drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | 6 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 70 ++- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 11 +- drivers/gpu/drm/clients/drm_client_setup.c | 4 +- drivers/gpu/drm/i915/display/intel_psr.c | 3 +- drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 +- drivers/gpu/drm/i915/i915_vma.c | 16 +- drivers/gpu/drm/mediatek/mtk_crtc.c | 7 + drivers/gpu/drm/panthor/panthor_gem.c | 18 + drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 16 +- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.h | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 + drivers/gpu/drm/xe/regs/xe_gt_regs.h | 1 + drivers/gpu/drm/xe/xe_device.c | 14 +- drivers/gpu/drm/xe/xe_guc_ct.c | 3 + drivers/gpu/drm/xe/xe_wa.c | 11 + drivers/hid/hid-ids.h | 4 + drivers/hid/hid-logitech-hidpp.c | 21 + drivers/hid/hid-nintendo.c | 2 +- drivers/hid/hid-ntrig.c | 7 +- drivers/hid/hid-playstation.c | 2 + drivers/hid/hid-quirks.c | 2 + drivers/hid/hid-uclogic-params.c | 4 +- .../intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 + .../intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 + drivers/infiniband/hw/mlx5/cq.c | 15 +- drivers/iommu/iommufd/io_pagetable.c | 12 +- drivers/iommu/iommufd/ioas.c | 4 + drivers/irqchip/irq-riscv-intc.c | 3 +- drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +- drivers/mmc/host/dw_mmc-rockchip.c | 4 +- drivers/mmc/host/pxamci.c | 56 +-- drivers/mmc/host/sdhci-of-dwcmshc.c | 2 +- drivers/mtd/nand/onenand/onenand_samsung.c | 2 +- drivers/net/ethernet/freescale/fec_main.c | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 15 + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 79 ++++ drivers/net/ethernet/mellanox/mlx5/core/cq.c | 24 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../net/ethernet/mellanox/mlx5/core/en/params.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 5 +- .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 +- .../net/ethernet/mellanox/mlx5/core/en_common.c | 11 +- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 33 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +- drivers/net/ethernet/mellanox/mlx5/core/eq.c | 8 +- .../net/ethernet/mellanox/mlx5/core/fpga/conn.c | 16 +- drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c | 8 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 11 +- .../mellanox/mlx5/core/steering/hws/send.c | 15 +- .../mellanox/mlx5/core/steering/sws/dr_send.c | 29 +- drivers/net/ethernet/mellanox/mlx5/core/wc.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-qos.c | 53 ++- drivers/net/phy/mdio_bus.c | 5 +- drivers/net/phy/micrel.c | 515 +++++++++++++-------- drivers/net/virtio_net.c | 16 +- drivers/net/wireless/ath/ath11k/wmi.c | 3 + drivers/net/wireless/intel/iwlwifi/mld/link.c | 7 +- drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 13 +- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 12 +- drivers/pmdomain/arm/scmi_pm_domain.c | 13 +- drivers/pmdomain/imx/gpc.c | 2 + drivers/pmdomain/samsung/exynos-pm-domains.c | 29 +- drivers/pwm/pwm-adp5585.c | 4 +- drivers/regulator/fixed.c | 1 + drivers/spi/spi.c | 10 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 6 +- fs/afs/cell.c | 78 +++- fs/afs/dynroot.c | 3 +- fs/afs/internal.h | 12 +- fs/afs/mntpt.c | 3 +- fs/afs/proc.c | 3 +- fs/afs/super.c | 2 +- fs/afs/vl_alias.c | 3 +- fs/binfmt_misc.c | 4 +- fs/btrfs/inode.c | 4 +- fs/btrfs/scrub.c | 2 + fs/btrfs/tree-log.c | 2 +- fs/btrfs/zoned.c | 60 ++- fs/erofs/decompressor_zstd.c | 11 +- fs/exfat/namei.c | 6 +- fs/file_attr.c | 4 + fs/fuse/virtio_fs.c | 2 +- fs/hostfs/hostfs_kern.c | 29 +- fs/namespace.c | 32 +- fs/nfs/client.c | 8 + fs/nfs/dir.c | 23 +- fs/nfs/inode.c | 18 +- fs/nfs/nfs3client.c | 14 +- fs/nfs/nfs4client.c | 15 +- fs/nfs/nfs4proc.c | 22 +- fs/nfs/pnfs_nfs.c | 66 +-- fs/nfs/sysfs.c | 1 + fs/nfs/write.c | 3 +- fs/nfsd/nfs4state.c | 3 +- fs/nfsd/nfs4xdr.c | 3 +- fs/nfsd/nfsd.h | 1 + fs/nfsd/nfsfh.c | 6 +- fs/nilfs2/segment.c | 7 +- fs/proc/generic.c | 12 +- fs/smb/client/fs_context.c | 2 + fs/smb/client/smb2inode.c | 2 + fs/smb/client/transport.c | 2 +- fs/smb/server/smb2pdu.c | 2 + fs/smb/server/transport_tcp.c | 5 +- include/linux/compiler_types.h | 5 +- include/linux/filter.h | 20 + include/linux/gfp.h | 3 + include/linux/huge_mm.h | 55 +-- include/linux/map_benchmark.h | 1 + include/linux/mlx5/cq.h | 2 +- include/linux/mlx5/driver.h | 3 +- include/linux/nfs_xdr.h | 1 + include/net/bluetooth/hci.h | 5 + include/uapi/linux/mount.h | 2 +- io_uring/register.c | 7 - io_uring/rsrc.c | 16 +- io_uring/rw.c | 3 + kernel/Kconfig.kexec | 9 + kernel/Makefile | 1 + kernel/bpf/trampoline.c | 5 - kernel/bpf/verifier.c | 6 +- kernel/crash_core.c | 2 +- kernel/futex/core.c | 12 +- kernel/gcov/gcc_4_7.c | 4 +- kernel/kexec_handover.c | 84 ++-- kernel/kexec_handover_debug.c | 25 + kernel/kexec_handover_internal.h | 20 + kernel/power/swap.c | 17 +- kernel/sched/ext.c | 4 +- kernel/time/posix-timers.c | 12 +- kernel/trace/ftrace.c | 20 +- lib/maple_tree.c | 30 +- mm/damon/stat.c | 9 +- mm/damon/sysfs.c | 10 +- mm/filemap.c | 20 +- mm/huge_memory.c | 38 +- mm/kmsan/core.c | 3 - mm/kmsan/hooks.c | 6 +- mm/kmsan/shadow.c | 2 +- mm/ksm.c | 113 ++++- mm/memory.c | 20 +- mm/mm_init.c | 2 +- mm/mremap.c | 2 +- mm/secretmem.c | 2 +- mm/shmem.c | 9 +- mm/slub.c | 6 +- mm/swap_state.c | 13 + mm/truncate.c | 6 +- net/bluetooth/6lowpan.c | 103 +++-- net/bluetooth/hci_conn.c | 33 +- net/bluetooth/hci_event.c | 56 ++- net/bluetooth/hci_sync.c | 2 +- net/bluetooth/l2cap_core.c | 1 + net/bluetooth/mgmt.c | 1 + net/core/netpoll.c | 7 +- net/dsa/tag_brcm.c | 6 +- net/handshake/tlshd.c | 1 + net/hsr/hsr_device.c | 5 +- net/hsr/hsr_forward.c | 22 +- net/ipv4/route.c | 5 + net/mac80211/iface.c | 14 +- net/mac80211/rx.c | 10 +- net/netfilter/nft_ct.c | 5 + net/sched/act_bpf.c | 6 +- net/sched/act_connmark.c | 12 +- net/sched/act_ife.c | 12 +- net/sched/cls_bpf.c | 6 +- net/sched/sch_generic.c | 17 +- net/sctp/transport.c | 13 +- net/smc/smc_clc.c | 1 + net/strparser/strparser.c | 2 +- net/tipc/net.c | 2 + net/unix/garbage.c | 14 +- rust/Makefile | 2 +- scripts/decode_stacktrace.sh | 43 +- scripts/gendwarfksyms/gendwarfksyms.c | 3 +- scripts/gendwarfksyms/gendwarfksyms.h | 2 +- scripts/gendwarfksyms/symbols.c | 4 +- sound/hda/codecs/hdmi/nvhdmi-mcp.c | 4 +- sound/hda/codecs/realtek/alc269.c | 1 + sound/soc/codecs/cs4271.c | 10 +- sound/soc/codecs/da7213.c | 65 ++- sound/soc/codecs/da7213.h | 1 + sound/soc/codecs/lpass-va-macro.c | 2 +- sound/soc/codecs/max98090.c | 6 +- sound/soc/codecs/nau8821.c | 22 +- sound/soc/codecs/nau8821.h | 2 +- sound/soc/codecs/tas2781-i2c.c | 9 +- sound/soc/renesas/rcar/ssiu.c | 3 +- sound/soc/sdw_utils/soc_sdw_utils.c | 20 +- sound/usb/endpoint.c | 5 + sound/usb/mixer.c | 2 + tools/build/feature/Makefile | 4 +- tools/perf/Makefile.config | 5 +- tools/perf/builtin-lock.c | 2 + tools/perf/tests/shell/lock_contention.sh | 21 +- tools/perf/util/header.c | 10 +- .../ftrace/test.d/filter/event-filter-function.tc | 4 + tools/testing/selftests/iommu/iommufd.c | 2 + tools/testing/selftests/iommu/iommufd_utils.h | 4 +- .../selftests/net/forwarding/local_termination.sh | 2 + tools/testing/selftests/net/mptcp/mptcp_connect.c | 18 +- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 90 ++-- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 21 + tools/testing/selftests/user_events/perf_test.c | 2 +- virt/kvm/guest_memfd.c | 47 +- 282 files changed, 2607 insertions(+), 1416 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/247 iommufd/selftest: Fix ioctl return value in _test_cmd_trigger_vevents()
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <[email protected]>
[ Upstream commit b09ed52db1e688eb8205b1939ca1345179ecd515 ]
The ioctl returns 0 upon success, so !0 returning -1 breaks the selftest.
Drop the '!' to fix it.
--- tools/testing/selftests/iommu/iommufd_utils.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/iommu/iommufd_utils.h +2 -2
@@ -1044,8 +1044,8 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents) };while (nvevents--) { -if (!ioctl (fd,_IOMMU_TEST_CMD (IOMMU_TEST_OP_TRIGGER_VEVENT ), - &trigger_vevent_cmd)) +if (ioctl (fd,_IOMMU_TEST_CMD (IOMMU_TEST_OP_TRIGGER_VEVENT ), + &trigger_vevent_cmd))return -1 ; }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 2/247 drm/mediatek: Add pm_runtime support for GCE power control
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH Lin <[email protected]>
[ Upstream commit afcfb6c8474d9e750880aaa77952cc588f859613 ]
Call pm_runtime_resume_and_get() before accessing GCE hardware in mbox_send_message(), and invoke pm_runtime_put_autosuspend() in the cmdq callback to release the PM reference and start autosuspend for GCE. This ensures correct power management for the GCE device.
--- drivers/gpu/drm/mediatek/mtk_crtc.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/mediatek/mtk_crtc.c +7 -0
@@ -283,6 +283,10 @@ static void ddp_cmdq_cb(struct mbox_client *cl, void *mssg)unsigned int i;unsigned long flags; +/* release GCE HW usage and start autosuspend */ +pm_runtime_mark_last_busy (cmdq_cl->chan->mbox->dev); +pm_runtime_put_autosuspend (cmdq_cl->chan->mbox->dev); +if (data->sta <0 )return ;
@@ -618,6 +622,9 @@ static void mtk_crtc_update_config(struct mtk_crtc *mtk_crtc, bool needs_vblank) mtk_crtc->config_updating = false;spin_unlock_irqrestore (&mtk_crtc->config_lock, flags); +if (pm_runtime_resume_and_get (mtk_crtc->cmdq_client.chan->mbox->dev) <0 ) + goto update_config_out; +mbox_send_message (mtk_crtc->cmdq_client.chan, cmdq_handle);mbox_client_txdone (mtk_crtc->cmdq_client.chan,0 ); goto update_config_out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 3/247 drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <[email protected]>
[ Upstream commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b ]
On completion of i915_vma_pin_ww(), a synchronous variant of dma_fence_work_commit() is called. When pinning a VMA to GGTT address space on a Cherry View family processor, or on a Broxton generation SoC with VTD enabled, i.e., when stop_machine() is then called from intel_ggtt_bind_vma(), that can potentially lead to lock inversion among reservation_ww and cpu_hotplug locks.
[86.861179] ======================================================
[86.861193] WARNING: possible circular locking dependency detected
[86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U
[86.861226] ------------------------------------------------------
[86.861238] i915_module_loa/1432 is trying to acquire lock:
[86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50
[86.861290]
but task is already holding lock:
[86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.862233]
which lock already depends on the new lock.
[86.862251]
the existing dependency chain (in reverse order) is:
[86.862265]
-> #5 (reservation_ww_class_mutex){+.+.}-{3:3}:
[86.862292] dma_resv_lockdep+0x19a/0x390
[86.862315] do_one_initcall+0x60/0x3f0
[86.862334] kernel_init_freeable+0x3cd/0x680
[86.862353] kernel_init+0x1b/0x200
[86.862369] ret_from_fork+0x47/0x70
[86.862383] ret_from_fork_asm+0x1a/0x30
[86.862399]
-> #4 (reservation_ww_class_acquire){+.+.}-{0:0}:
[86.862425] dma_resv_lockdep+0x178/0x390
[86.862440] do_one_initcall+0x60/0x3f0
[86.862454] kernel_init_freeable+0x3cd/0x680
[86.862470] kernel_init+0x1b/0x200
[86.862482] ret_from_fork+0x47/0x70
[86.862495] ret_from_fork_asm+0x1a/0x30
[86.862509]
-> #3 (&mm->mmap_lock){++++}-{3:3}:
[86.862531] down_read_killable+0x46/0x1e0
[86.862546] lock_mm_and_find_vma+0xa2/0x280
[86.862561] do_user_addr_fault+0x266/0x8e0
[86.862578] exc_page_fault+0x8a/0x2f0
[86.862593] asm_exc_page_fault+0x27/0x30
[86.862607] filldir64+0xeb/0x180
[86.862620] kernfs_fop_readdir+0x118/0x480
[86.862635] iterate_dir+0xcf/0x2b0
[86.862648] __x64_sys_getdents64+0x84/0x140
[86.862661] x64_sys_call+0x1058/0x2660
[86.862675] do_syscall_64+0x91/0xe90
[86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.862703]
-> #2 (&root->kernfs_rwsem){++++}-{3:3}:
[86.862725] down_write+0x3e/0xf0
[86.862738] kernfs_add_one+0x30/0x3c0
[86.862751] kernfs_create_dir_ns+0x53/0xb0
[86.862765] internal_create_group+0x134/0x4c0
[86.862779] sysfs_create_group+0x13/0x20
[86.862792] topology_add_dev+0x1d/0x30
[86.862806] cpuhp_invoke_callback+0x4b5/0x850
[86.862822] cpuhp_issue_call+0xbf/0x1f0
[86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320
[86.862852] __cpuhp_setup_state+0xb0/0x220
[86.862866] topology_sysfs_init+0x30/0x50
[86.862879] do_one_initcall+0x60/0x3f0
[86.862893] kernel_init_freeable+0x3cd/0x680
[86.862908] kernel_init+0x1b/0x200
[86.862921] ret_from_fork+0x47/0x70
[86.862934] ret_from_fork_asm+0x1a/0x30
[86.862947]
-> #1 (cpuhp_state_mutex){+.+.}-{3:3}:
[86.862969] __mutex_lock+0xaa/0xed0
[86.862982] mutex_lock_nested+0x1b/0x30
[86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320
[86.863012] __cpuhp_setup_state+0xb0/0x220
[86.863026] page_alloc_init_cpuhp+0x2d/0x60
[86.863041] mm_core_init+0x22/0x2d0
[86.863054] start_kernel+0x576/0xbd0
[86.863068] x86_64_start_reservations+0x18/0x30
[86.863084] x86_64_start_kernel+0xbf/0x110
[86.863098] common_startup_64+0x13e/0x141
[86.863114]
-> #0 (cpu_hotplug_lock){++++}-{0:0}:
[86.863135] __lock_acquire+0x1635/0x2810
[86.863152] lock_acquire+0xc4/0x2f0
[86.863166] cpus_read_lock+0x41/0x100
[86.863180] stop_machine+0x1c/0x50
[86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
[86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915]
[86.864735] __vma_bind+0x55/0x70 [i915]
[86.865510] fence_work+0x26/0xa0 [i915]
[86.866248] fence_notify+0xa1/0x140 [i915]
[86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915]
[86.867719] i915_sw_fence_commit+0x39/0x60 [i915]
[86.868453] i915_vma_pin_ww+0x462/0x1360 [i915]
[86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
[86.870001] initial_plane_vma+0x307/0x840 [i915]
[86.870774] intel_initial_plane_config+0x33f/0x670 [i915]
[86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
[86.872330] i915_driver_probe+0x7fa/0xe80 [i915]
[86.873057] i915_pci_probe+0xe6/0x220 [i915]
[86.873782] local_pci_probe+0x47/0xb0
[86.873802] pci_device_probe+0xf3/0x260
[86.873817] really_probe+0xf1/0x3c0
[86.873833] __driver_probe_device+0x8c/0x180
[86.873848] driver_probe_device+0x24/0xd0
[86.873862] __driver_attach+0x10f/0x220
[86.873876] bus_for_each_dev+0x7f/0xe0
[86.873892] driver_attach+0x1e/0x30
[86.873904] bus_add_driver+0x151/0x290
[86.873917] driver_register+0x5e/0x130
[86.873931] __pci_register_driver+0x7d/0x90
[86.873945] i915_pci_register_driver+0x23/0x30 [i915]
[86.874678] i915_init+0x37/0x120 [i915]
[86.875347] do_one_initcall+0x60/0x3f0
[86.875369] do_init_module+0x97/0x2a0
[86.875385] load_module+0x2c54/0x2d80
[86.875398] init_module_from_file+0x96/0xe0
[86.875413] idempotent_init_module+0x117/0x330
[86.875426] __x64_sys_finit_module+0x77/0x100
[86.875440] x64_sys_call+0x24de/0x2660
[86.875454] do_syscall_64+0x91/0xe90
[86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.875486]
other info that might help us debug this:
[86.875502] Chain exists of:
cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
[86.875539] Possible unsafe locking scenario:
[86.875552] CPU0 CPU1
[86.875563] ---- ----
[86.875573] lock(reservation_ww_class_mutex);
[86.875588] lock(reservation_ww_class_acquire);
[86.875606] lock(reservation_ww_class_mutex);
[86.875624] rlock(cpu_hotplug_lock);
[86.875637]
*** DEADLOCK ***
[86.875650] 3 locks held by i915_module_loa/1432:
[86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220
[86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915]
[86.877305]
stack backtrace:
[86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary)
[86.877334] Tainted: [U]=USER
[86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020
[86.877339] Call Trace:
[86.877344] <TASK>
[86.877353] dump_stack_lvl+0x91/0xf0
[86.877364] dump_stack+0x10/0x20
[86.877369] print_circular_bug+0x285/0x360
[86.877379] check_noncircular+0x135/0x150
[86.877390] __lock_acquire+0x1635/0x2810
[86.877403] lock_acquire+0xc4/0x2f0
[86.877408] ? stop_machine+0x1c/0x50
[86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
[86.878173] cpus_read_lock+0x41/0x100
[86.878182] ? stop_machine+0x1c/0x50
[86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915]
[86.878916] stop_machine+0x1c/0x50
[86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915]
[86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915]
[86.880375] __vma_bind+0x55/0x70 [i915]
[86.881133] fence_work+0x26/0xa0 [i915]
[86.881851] fence_notify+0xa1/0x140 [i915]
[86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915]
[86.883286] i915_sw_fence_commit+0x39/0x60 [i915]
[86.884003] i915_vma_pin_ww+0x462/0x1360 [i915]
[86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915]
[86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915]
[86.886281] initial_plane_vma+0x307/0x840 [i915]
[86.887049] intel_initial_plane_config+0x33f/0x670 [i915]
[86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915]
[86.888587] i915_driver_probe+0x7fa/0xe80 [i915]
[86.889293] ? mutex_unlock+0x12/0x20
[86.889301] ? drm_privacy_screen_get+0x171/0x190
[86.889308] ? acpi_dev_found+0x66/0x80
[86.889321] i915_pci_probe+0xe6/0x220 [i915]
[86.890038] local_pci_probe+0x47/0xb0
[86.890049] pci_device_probe+0xf3/0x260
[86.890058] really_probe+0xf1/0x3c0
[86.890067] __driver_probe_device+0x8c/0x180
[86.890072] driver_probe_device+0x24/0xd0
[86.890078] __driver_attach+0x10f/0x220
[86.890083] ? __pfx___driver_attach+0x10/0x10
[86.890088] bus_for_each_dev+0x7f/0xe0
[86.890097] driver_attach+0x1e/0x30
[86.890101] bus_add_driver+0x151/0x290
[86.890107] driver_register+0x5e/0x130
[86.890113] __pci_register_driver+0x7d/0x90
[86.890119] i915_pci_register_driver+0x23/0x30 [i915]
[86.890833] i915_init+0x37/0x120 [i915]
[86.891482] ? __pfx_i915_init+0x10/0x10 [i915]
[86.892135] do_one_initcall+0x60/0x3f0
[86.892145] ? __kmalloc_cache_noprof+0x33f/0x470
[86.892157] do_init_module+0x97/0x2a0
[86.892164] load_module+0x2c54/0x2d80
[86.892168] ? __kernel_read+0x15c/0x300
[86.892185] ? kernel_read_file+0x2b1/0x320
[86.892195] init_module_from_file+0x96/0xe0
[86.892199] ? init_module_from_file+0x96/0xe0
[86.892211] idempotent_init_module+0x117/0x330
[86.892224] __x64_sys_finit_module+0x77/0x100
[86.892230] x64_sys_call+0x24de/0x2660
[86.892236] do_syscall_64+0x91/0xe90
[86.892243] ? irqentry_exit+0x77/0xb0
[86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0
[86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[86.892261] RIP: 0033:0x7303e1b2725d
[86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
[86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d
[86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c
[86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80
[86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0
[86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710
[86.892304] </TASK>Call asynchronous variant of dma_fence_work_commit() in that case.
v3: Provide more verbose in-line comment (Andi),
- mention target environments in commit message.
--- drivers/gpu/drm/i915/i915_vma.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/i915_vma.c +14 -2
@@ -1595,8 +1595,20 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, err_vma_res:i915_vma_resource_free (vma_res); err_fence: -if (work) -dma_fence_work_commit_imm (&work->base); +if (work) { +/* +* When pinning VMA to GGTT on CHV or BXT with VTD enabled, +* commit VMA binding asynchronously to avoid risk of lock +* inversion among reservation_ww locks held here and +* cpu_hotplug_lock acquired from stop_machine(), which we +* wrap around GGTT updates when running in those environments. +*/ +if (i915_vma_is_ggtt (vma) && +intel_vm_no_concurrent_access_wa (vma->vm->i915)) +dma_fence_work_commit (&work->base); +else +dma_fence_work_commit_imm (&work->base); + } err_rpm:intel_runtime_pm_put (&vma->vm->i915->runtime_pm, wakeref);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 4/247 drm/i915: Fix conversion between clock ticks and nanoseconds
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Umesh Nerlige Ramappa <[email protected]>
[ Upstream commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 ]
When tick values are large, the multiplication by NSEC_PER_SEC is larger than 64 bits and results in bad conversions.
The issue is seen in PMU busyness counters that look like they have wrapped around due to bad conversion. i915 PMU implementation returns monotonically increasing counters. If a count is lesser than previous one, it will only return the larger value until the smaller value catches up. The user will see this as zero delta between two measurements even though the engines are busy.
Fix it by using mul_u64_u32_div()
--- drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/gt/intel_gt_clock_utils.c +2 -2
@@ -205,7 +205,7 @@ static u64 div_u64_roundup(u64 nom, u32 den)u64 intel_gt_clock_interval_to_ns (const struct intel_gt *gt,u64 count) { -return div_u64_roundup (count *NSEC_PER_SEC , gt->clock_frequency); +return mul_u64_u32_div (count,NSEC_PER_SEC , gt->clock_frequency); }u64 intel_gt_pm_interval_to_ns (const struct intel_gt *gt,u64 count)
@@ -215,7 +215,7 @@ u64 intel_gt_pm_interval_to_ns(const struct intel_gt *gt, u64 count)u64 intel_gt_ns_to_clock_interval (const struct intel_gt *gt,u64 ns) { -return div_u64_roundup (gt->clock_frequency * ns,NSEC_PER_SEC ); +return mul_u64_u32_div (ns, gt->clock_frequency,NSEC_PER_SEC ); }u64 intel_gt_ns_to_pm_interval (const struct intel_gt *gt,u64 ns)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 5/247 drm/amdgpu: set default gfx reset masks for gfx6-8
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 90b75e12a6e831c8516498f690058d4165d5a5d6 ]
These were not set so soft recovery was inadvertantly disabled.
--- drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 5 +++++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 5 +++++ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 5 +++++ 3 files changed, 15 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +5 -0
@@ -3103,6 +3103,11 @@ static int gfx_v6_0_sw_init(struct amdgpu_ip_block *ip_block)return r; } + adev->gfx.gfx_supported_reset = +amdgpu_get_soft_full_reset_mask (&adev->gfx.gfx_ring[0 ]); + adev->gfx.compute_supported_reset = +amdgpu_get_soft_full_reset_mask (&adev->gfx.compute_ring[0 ]); +return r; }
drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +5 -0
@@ -4400,6 +4400,11 @@ static int gfx_v7_0_sw_init(struct amdgpu_ip_block *ip_block)gfx_v7_0_gpu_early_init (adev); + adev->gfx.gfx_supported_reset = +amdgpu_get_soft_full_reset_mask (&adev->gfx.gfx_ring[0 ]); + adev->gfx.compute_supported_reset = +amdgpu_get_soft_full_reset_mask (&adev->gfx.compute_ring[0 ]); +return r; }
drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +5 -0
@@ -2024,6 +2024,11 @@ static int gfx_v8_0_sw_init(struct amdgpu_ip_block *ip_block)if (r)return r; + adev->gfx.gfx_supported_reset = +amdgpu_get_soft_full_reset_mask (&adev->gfx.gfx_ring[0 ]); + adev->gfx.compute_supported_reset = +amdgpu_get_soft_full_reset_mask (&adev->gfx.compute_ring[0 ]); +return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 6/247 drm/amd/display: Dont stretch non-native images by default in eDP
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit 3362692fea915ce56345366364a501c629c9ff17 ]
commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native resolutions on eDP") started using the GPU scaler hardware to scale when a non-native resolution was picked on eDP. This scaling was done to fill the screen instead of maintain aspect ratio.
The idea was supposed to be that if a different scaling behavior is preferred then the compositor would request it. The not following aspect ratio behavior however isn't desirable, so adjust it to follow aspect ratio and still try to fill screen.
Note: This will lead to black bars in some cases for non-native resolutions. Compositors can request the previous behavior if desired.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -1
@@ -8003,7 +8003,7 @@ static int dm_encoder_helper_atomic_check(struct drm_encoder *encoder,"mode %dx%d@%dHz is not native, enabling scaling\n" , adjusted_mode->hdisplay, adjusted_mode->vdisplay, drm_mode_vrefresh(adjusted_mode)); - dm_new_connector_state->scaling =RMX_FULL ; + dm_new_connector_state->scaling =RMX_ASPECT ; }return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 7/247 smb: client: fix refcount leak in smb2_set_path_attr
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
[ Upstream commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 ]
Fix refcount leak in smb2_set_path_attr when path conversion fails.
Function cifs_get_writable_path returns cfile with its reference counter cfile->count increased on success. Function smb2_compound_op would decrease the reference counter for cfile, as stated in its comment. By calling smb2_rename_path, the reference counter of cfile would leak if cifs_convert_path_to_utf16 fails in smb2_set_path_attr.
--- fs/smb/client/smb2inode.c | 2 ++ 1 file changed, 2 insertions(+)
fs/smb/client/smb2inode.c +2 -0
@@ -1294,6 +1294,8 @@ static int smb2_set_path_attr(const unsigned int xid, struct cifs_tcon *tcon, smb2_to_name =cifs_convert_path_to_utf16 (to_name, cifs_sb);if (smb2_to_name ==NULL ) { rc = -ENOMEM ; +if (cfile) +cifsFileInfo_put (cfile); goto smb2_rename_path; } in_iov.iov_base = smb2_to_name;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 8/247 iommufd: Make vfio_compats unmap succeed if the range is already empty
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit afb47765f9235181fddc61c8633b5a8cfae29fd2 ]
iommufd returns ENOENT when attempting to unmap a range that is already empty, while vfio type1 returns success. Fix vfio_compat to match.
--- drivers/iommu/iommufd/io_pagetable.c | 12 +++--------- drivers/iommu/iommufd/ioas.c | 4 ++++ tools/testing/selftests/iommu/iommufd.c | 2 ++ 3 files changed, 9 insertions(+), 9 deletions(-)
drivers/iommu/iommufd/io_pagetable.c +3 -9
@@ -707,7 +707,8 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,struct iopt_area *area;unsigned long unmapped_bytes =0 ;unsigned int tries =0 ; -int rc = -ENOENT ; +/* If there are no mapped entries then success */ +int rc =0 ;/* * The domains_rwsem must be held in read mode any time any area->pages
@@ -777,8 +778,6 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start,down_write (&iopt->iova_rwsem); } -if (unmapped_bytes) - rc =0 ; out_unlock_iova:up_write (&iopt->iova_rwsem);
@@ -815,13 +814,8 @@ int iopt_unmap_iova(struct io_pagetable *iopt, unsigned long iova,int iopt_unmap_all (struct io_pagetable *iopt,unsigned long *unmapped) { -int rc; - - rc =iopt_unmap_iova_range (iopt,0 ,ULONG_MAX , unmapped);/* If the IOVAs are empty then unmap all succeeds */ -if (rc == -ENOENT ) -return 0 ; -return rc; +return iopt_unmap_iova_range (iopt,0 ,ULONG_MAX , unmapped); }/* The caller must always free all the nodes in the allowed_iova rb_root. */
drivers/iommu/iommufd/ioas.c +4 -0
@@ -367,6 +367,10 @@ int iommufd_ioas_unmap(struct iommufd_ucmd *ucmd) &unmapped);if (rc) goto out_put; +if (!unmapped) { + rc = -ENOENT ; + goto out_put; + } } cmd->length = unmapped;
tools/testing/selftests/iommu/iommufd.c +2 -0
@@ -2638,6 +2638,8 @@ TEST_F(vfio_compat_mock_domain, map)ASSERT_EQ (0 ,ioctl (self->fd,VFIO_IOMMU_MAP_DMA , &map_cmd));ASSERT_EQ (0 ,ioctl (self->fd,VFIO_IOMMU_UNMAP_DMA , &unmap_cmd));ASSERT_EQ (BUFFER_SIZE , unmap_cmd.size); +/* Unmap of empty is success */ +ASSERT_EQ (0 ,ioctl (self->fd,VFIO_IOMMU_UNMAP_DMA , &unmap_cmd));/* UNMAP_FLAG_ALL requires 0 iova/size */ ASSERT_EQ (0 ,ioctl (self->fd,VFIO_IOMMU_MAP_DMA , &map_cmd));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 9/247 futex: Optimize per-cpu reference counting
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 4cb5ac2626b5704ed712ac1d46b9d89fdfc12c5d ]
Shrikanth noted that the per-cpu reference counter was still some 10% slower than the old immutable option (which removes the reference counting entirely).
Further optimize the per-cpu reference counter by:
- switching from RCU to preempt;
- using __this_cpu_*() since we now have preempt disabled;
- switching from smp_load_acquire() to READ_ONCE().
This is all safe because disabling preemption inhibits the RCU grace period exactly like rcu_read_lock().
Having preemption disabled allows using __this_cpu_*() provided the only access to the variable is in task context -- which is the case here.
Furthermore, since we know changing fph->state to FR_ATOMIC demands a full RCU grace period we can rely on the implied smp_mb() from that to replace the acquire barrier().
This is very similar to the percpu_down_read_internal() fast-path.
The reason this is significant for PowerPC is that it uses the generic this_cpu_*() implementation which relies on local_irq_disable() (the x86 implementation relies on it being a single memop instruction to be IRQ-safe). Switching to preempt_disable() and __this_cpu*() avoids this IRQ state swizzling. Also, PowerPC needs LWSYNC for the ACQUIRE barrier, not having to use explicit barriers safes a bunch.
Combined this reduces the performance gap by half, down to some 5%.
--- kernel/futex/core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
kernel/futex/core.c +6 -6
@@ -1680,10 +1680,10 @@ static bool futex_ref_get(struct futex_private_hash *fph) {struct mm_struct *mm = fph->mm; -guard (rcu)(); +guard (preempt)(); -if (smp_load_acquire (&fph->state) ==FR_PERCPU ) { -this_cpu_inc (*mm->futex_ref); +if (READ_ONCE (fph->state) ==FR_PERCPU ) { +__this_cpu_inc (*mm->futex_ref);return true; }
@@ -1694,10 +1694,10 @@ static bool futex_ref_put(struct futex_private_hash *fph) {struct mm_struct *mm = fph->mm; -guard (rcu)(); +guard (preempt)(); -if (smp_load_acquire (&fph->state) ==FR_PERCPU ) { -this_cpu_dec (*mm->futex_ref); +if (READ_ONCE (fph->state) ==FR_PERCPU ) { +__this_cpu_dec (*mm->futex_ref);return false; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 10/247 drm/amd: Fix suspend failure with secure display TA
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit b09cb2996cdf50cd1ab4020e002c95d742c81313 ]
commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded successfully") attempted to fix extra messages, but failed to port the cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable secure display TA multiple times") to prevent multiple tries.
Add that to the failure handling path even on a quick failure.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +4 -1
@@ -2353,8 +2353,11 @@ static int psp_securedisplay_initialize(struct psp_context *psp)if (!ret && !psp->securedisplay_context.context.resp_status) { psp->securedisplay_context.context.initialized = true;mutex_init (&psp->securedisplay_context.mutex); - }else + }else { +/* don't try again */ + psp->securedisplay_context.context.bin_desc.size_bytes =0 ;return ret; + }mutex_lock (&psp->securedisplay_context.mutex);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 11/247 drm/xe/guc: Synchronize Dead CT worker with unbind
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balasubramani Vivekanandan <[email protected]>
[ Upstream commit 95af8f4fdce8349a5fe75264007f1af2aa1082ea ]
Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation.
--- drivers/gpu/drm/xe/xe_guc_ct.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/xe/xe_guc_ct.c +3 -0
@@ -200,6 +200,9 @@ static void guc_ct_fini(struct drm_device *drm, void *arg) {struct xe_guc_ct *ct = arg; +#if IS_ENABLED (CONFIG_DRM_XE_DEBUG ) +cancel_work_sync (&ct->dead.worker); +#endif ct_exit_safe_mode (ct);destroy_workqueue (ct->g2h_wq);xa_destroy (&ct->fence_lookup);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 12/247 drm/xe: Move declarations under conditional branch
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejas Upadhyay <[email protected]>
[ Upstream commit 9cd27eec872f0b95dcdd811edc39d2d32e4158c8 ]
The xe_device_shutdown() function was needing a few declarations that were only required under a specific condition. This change moves those declarations to be within that conditional branch to avoid unnecessary declarations.
Stable-dep-of: b11a020d914c ("drm/xe: Do clean shutdown also when using flr")
--- drivers/gpu/drm/xe/xe_device.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/xe/xe_device.c +3 -3
@@ -962,12 +962,12 @@ void xe_device_remove(struct xe_device *xe)void xe_device_shutdown (struct xe_device *xe) { -struct xe_gt *gt; -u8 id; -drm_dbg (&xe->drm,"Shutting down device\n" );if (xe_driver_flr_disabled (xe)) { +struct xe_gt *gt; +u8 id; +xe_display_pm_shutdown (xe);xe_irq_suspend (xe);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 13/247 drm/xe: Do clean shutdown also when using flr
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jouni Högander <[email protected]>
[ Upstream commit b11a020d914c3b7628f56a9ea476a5b03679489b ]
Currently Xe driver is triggering flr without any clean-up on shutdown. This is causing random warnings from pending related works as the underlying hardware is reset in the middle of their execution.
Fix this by performing clean shutdown also when using flr.
--- drivers/gpu/drm/xe/xe_device.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/gpu/drm/xe/xe_device.c +9 -9
@@ -962,21 +962,21 @@ void xe_device_remove(struct xe_device *xe)void xe_device_shutdown (struct xe_device *xe) { +struct xe_gt *gt; +u8 id; +drm_dbg (&xe->drm,"Shutting down device\n" ); -if (xe_driver_flr_disabled (xe)) { -struct xe_gt *gt; -u8 id; +xe_display_pm_shutdown (xe); -xe_display_pm_shutdown (xe); +xe_irq_suspend (xe); -xe_irq_suspend (xe); +for_each_gt (gt, xe, id) +xe_gt_shutdown (gt); -for_each_gt (gt, xe, id) -xe_gt_shutdown (gt); +xe_display_pm_shutdown_late (xe); -xe_display_pm_shutdown_late (xe); - }else { +if (!xe_driver_flr_disabled (xe)) {/* BOOM! */ __xe_driver_flr (xe); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 14/247 drm/amd/display: Add pixel_clock to amd_pp_display_configuration
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit b515dcb0dc4e85d8254f5459cfb32fce88dacbfb ]
This commit adds the pixel_clock field to the display config struct so that power management (DPM) can use it.
We currently don't have a proper bandwidth calculation on old GPUs with DCE 6-10 because dce_calcs only supports DCE 11+. So the power management (DPM) on these GPUs may need to make ad-hoc decisions for display based on the pixel clock.
Also rename sym_clock to pixel_clock in dm_pp_single_disp_config to avoid confusion with other code where the sym_clock refers to the DisplayPort symbol clock.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c | 1 + drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c | 2 +- drivers/gpu/drm/amd/display/dc/dm_services_types.h | 2 +- drivers/gpu/drm/amd/include/dm_pp_interface.h | 1 + 4 files changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c +1 -0
@@ -97,6 +97,7 @@ bool dm_pp_apply_display_requirements(const struct dm_pp_single_disp_config *dc_cfg = &pp_display_cfg->disp_configs[i]; adev->pm.pm_display_cfg.displays[i].controller_id = dc_cfg->pipe_idx +1 ; + adev->pm.pm_display_cfg.displays[i].pixel_clock = dc_cfg->pixel_clock; }amdgpu_dpm_display_configuration_change (adev, &adev->pm.pm_display_cfg);
drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c +1 -1
@@ -164,7 +164,7 @@ void dce110_fill_display_configs( stream->link->cur_link_settings.link_rate; cfg->link_settings.link_spread = stream->link->cur_link_settings.link_spread; - cfg->sym_clock = stream->phy_pix_clk; + cfg->pixel_clock = stream->phy_pix_clk;/* Round v_refresh*/ cfg->v_refresh = stream->timing.pix_clk_100hz *100 ; cfg->v_refresh /= stream->timing.h_total;
drivers/gpu/drm/amd/display/dc/dm_services_types.h +1 -1
@@ -127,7 +127,7 @@ struct dm_pp_single_disp_config {uint32_t src_height;uint32_t src_width;uint32_t v_refresh; -uint32_t sym_clock;/* HDMI only */ +uint32_t pixel_clock;/* Pixel clock in KHz (for HDMI only: normalized) */ struct dc_link_settings link_settings;/* DP only */ };
drivers/gpu/drm/amd/include/dm_pp_interface.h +1 -0
@@ -65,6 +65,7 @@ struct single_display_configuration {uint32_t view_resolution_cy;enum amd_pp_display_config_type displayconfigtype;uint32_t vertical_refresh;/* for active display */ +uint32_t pixel_clock;/* Pixel clock in KHz (for HDMI only: normalized) */ };#define MAX_NUM_DISPLAY 32
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 15/247 drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 9d73b107a61b73e7101d4b728ddac3d2c77db111 ]
This commit is necessary for DC to function well with chips that use the legacy power management code, ie. SI and KV. Communicate display information from DC to the legacy PM code.
Currently DC uses pm_display_cfg to communicate power management requirements from the display code to the DPM code. However, the legacy (non-DC) code path used different fields and therefore could not take into account anything from DC.
Change the legacy display code to fill the same pm_display_cfg struct as DC and use the same in the legacy DPM code.
To ease review and reduce churn, this commit does not yet delete the now unneeded code, that is done in the next commit.
v2:
Rebase.
Fix single_display in amdgpu_dpm_pick_power_state.
--- drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 67 +++++++++++++++++++ .../gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h | 2 + drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +- .../gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c | 6 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 65 ++++++------------ .../gpu/drm/amd/pm/powerplay/amd_powerplay.c | 11 +-- 6 files changed, 97 insertions(+), 58 deletions(-)
drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c +67 -0
@@ -100,3 +100,70 @@ u32 amdgpu_dpm_get_vrefresh(struct amdgpu_device *adev)return vrefresh; } + +void amdgpu_dpm_get_display_cfg (struct amdgpu_device *adev) +{ +struct drm_device *ddev =adev_to_drm (adev); +struct amd_pp_display_configuration *cfg = &adev->pm.pm_display_cfg; +struct single_display_configuration *display_cfg; +struct drm_crtc *crtc; +struct amdgpu_crtc *amdgpu_crtc; +struct amdgpu_connector *conn; +int num_crtcs =0 ; +int vrefresh; +u32 vblank_in_pixels, vblank_time_us; + + cfg->min_vblank_time =0xffffffff ;/* if the displays are off, vblank time is max */ + +if (adev->mode_info.num_crtc && adev->mode_info.mode_config_initialized) { +list_for_each_entry (crtc, &ddev->mode_config.crtc_list, head) { + amdgpu_crtc =to_amdgpu_crtc (crtc); + +/* The array should only contain active displays. */ +if (!amdgpu_crtc->enabled) +continue ; + + conn =to_amdgpu_connector (amdgpu_crtc->connector); + display_cfg = &adev->pm.pm_display_cfg.displays[num_crtcs++]; + +if (amdgpu_crtc->hw_mode.clock) { + vrefresh =drm_mode_vrefresh (&amdgpu_crtc->hw_mode); + + vblank_in_pixels = + amdgpu_crtc->hw_mode.crtc_htotal * + (amdgpu_crtc->hw_mode.crtc_vblank_end - + amdgpu_crtc->hw_mode.crtc_vdisplay + + (amdgpu_crtc->v_border *2 )); + + vblank_time_us = + vblank_in_pixels *1000 / amdgpu_crtc->hw_mode.clock; + +/* The legacy (non-DC) code has issues with mclk switching +* with refresh rates over 120 Hz. Disable mclk switching. +*/ +if (vrefresh >120 ) + vblank_time_us =0 ; + +/* Find minimum vblank time. */ +if (vblank_time_us < cfg->min_vblank_time) + cfg->min_vblank_time = vblank_time_us; + +/* Find vertical refresh rate of first active display. */ +if (!cfg->vrefresh) + cfg->vrefresh = vrefresh; + } + +if (amdgpu_crtc->crtc_id < cfg->crtc_index) { +/* Find first active CRTC and its line time. */ + cfg->crtc_index = amdgpu_crtc->crtc_id; + cfg->line_time_in_us = amdgpu_crtc->line_time; + } + + display_cfg->controller_id = amdgpu_crtc->crtc_id; + display_cfg->pixel_clock = conn->pixelclock_for_modeset; + } + } + + cfg->display_clk = adev->clock.default_dispclk; + cfg->num_display = num_crtcs; +}
drivers/gpu/drm/amd/pm/inc/amdgpu_dpm_internal.h +2 -0
@@ -29,4 +29,6 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev);u32 amdgpu_dpm_get_vrefresh (struct amdgpu_device *adev); +void amdgpu_dpm_get_display_cfg (struct amdgpu_device *adev); +#endif
drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c +2 -2
@@ -2299,7 +2299,7 @@ static void kv_apply_state_adjust_rules(struct amdgpu_device *adev,if (pi->sys_info.nb_dpm_enable) { force_high = (mclk >= pi->sys_info.nbp_memory_clock[3 ]) || - pi->video_start || (adev->pm.dpm.new_active_crtc_count >=3 ) || + pi->video_start || (adev->pm.pm_display_cfg.num_display >=3 ) || pi->disable_nb_ps3_in_battery; ps->dpm0_pg_nb_ps_lo = force_high ?0x2 :0x3 ; ps->dpm0_pg_nb_ps_hi =0x2 ;
@@ -2358,7 +2358,7 @@ static int kv_calculate_nbps_level_settings(struct amdgpu_device *adev)return 0 ; force_high = ((mclk >= pi->sys_info.nbp_memory_clock[3 ]) || - (adev->pm.dpm.new_active_crtc_count >=3 ) || pi->video_start); + (adev->pm.pm_display_cfg.num_display >=3 ) || pi->video_start);if (force_high) {for (i = pi->lowest_valid; i <= pi->highest_valid; i++)
drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c +3 -3
@@ -771,8 +771,7 @@ static struct amdgpu_ps *amdgpu_dpm_pick_power_state(struct amdgpu_device *adev,int i;struct amdgpu_ps *ps;u32 ui_class; -bool single_display = (adev->pm.dpm.new_active_crtc_count <2 ) ? - true : false; +bool single_display = adev->pm.pm_display_cfg.num_display <2 ;/* check if the vblank period is too short to adjust the mclk */ if (single_display && adev->powerplay.pp_funcs->vblank_too_short) {
@@ -968,7 +967,8 @@ void amdgpu_legacy_dpm_compute_clocks(void *handle) {struct amdgpu_device *adev = (struct amdgpu_device *)handle; -amdgpu_dpm_get_active_displays (adev); +if (!adev->dc_enabled) +amdgpu_dpm_get_display_cfg (adev);amdgpu_dpm_change_power_state_locked (adev); }
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +22 -43
150 lines not on this page · raw message
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c +1 -10
@@ -1554,16 +1554,7 @@ static void pp_pm_compute_clocks(void *handle)struct amdgpu_device *adev = hwmgr->adev;if (!adev->dc_enabled) { -amdgpu_dpm_get_active_displays (adev); - adev->pm.pm_display_cfg.num_display = adev->pm.dpm.new_active_crtc_count; - adev->pm.pm_display_cfg.vrefresh =amdgpu_dpm_get_vrefresh (adev); - adev->pm.pm_display_cfg.min_vblank_time =amdgpu_dpm_get_vblank_time (adev); -/* we have issues with mclk switching with -* refresh rates over 120 hz on the non-DC code. -*/ -if (adev->pm.pm_display_cfg.vrefresh >120 ) - adev->pm.pm_display_cfg.min_vblank_time =0 ; - +amdgpu_dpm_get_display_cfg (adev);pp_display_configuration_change (handle, &adev->pm.pm_display_cfg); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 16/247 drm/amd/display: Disable fastboot on DCE 6 too
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 7495962cbceb967e095233a5673ea71f3bcdee7e ]
It already didn't work on DCE 8,
so there is no reason to assume it would on DCE 6.
--- drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +2 -4
@@ -1923,10 +1923,8 @@ void dce110_enable_accelerated_mode(struct dc *dc, struct dc_state *context)get_edp_streams (context, edp_streams, &edp_stream_num); -// Check fastboot support, disable on DCE8 because of blank screens -if (edp_num && edp_stream_num && dc->ctx->dce_version !=DCE_VERSION_8_0 && - dc->ctx->dce_version !=DCE_VERSION_8_1 && - dc->ctx->dce_version !=DCE_VERSION_8_3 ) { +/* Check fastboot support, disable on DCE 6-8 because of blank screens */ +if (edp_num && edp_stream_num && dc->ctx->dce_version <DCE_VERSION_10_0 ) {for (i =0 ; i < edp_num; i++) { edp_link = edp_links[i];if (edp_link != edp_streams[0 ]->link)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 17/247 drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a ]
On various SI GPUs, a flickering can be observed near the bottom edge of the screen when using a single 4K 60Hz monitor over DP. Disabling MCLK switching works around this problem.
--- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +5 -0
@@ -3500,6 +3500,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,* for these GPUs to calculate bandwidth requirements. */ if (high_pixelclock_count) { +/* Work around flickering lines at the bottom edge +* of the screen when using a single 4K 60Hz monitor. +*/ + disable_mclk_switching = true; +/* On Oland, we observe some flickering when two 4K 60Hz * displays are connected, possibly because voltage is too low. * Raise the voltage by requiring a higher SCLK.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 18/247 drm/amd: Disable ASPM on SI
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 7bdd91abf0cb3ea78160e2e78fb58b12f6a38d55 ]
Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4. It's unclear if this is a platform-specific or GPU-specific issue. Disable ASPM on SI for the time being.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +7 -0
@@ -1880,6 +1880,13 @@ static bool amdgpu_device_pcie_dynamic_switching_supported(struct amdgpu_devicestatic bool amdgpu_device_aspm_support_quirk (struct amdgpu_device *adev) { +/* Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4. +* It's unclear if this is a platform-specific or GPU-specific issue. +* Disable ASPM on SI for the time being. +*/ +if (adev->family ==AMDGPU_FAMILY_SI ) +return true; +#if IS_ENABLED (CONFIG_X86 )struct cpuinfo_x86 *c = &cpu_data (0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 19/247 arm64: kprobes: check the return value of set_memory_rox()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shi <[email protected]>
[ Upstream commit 0ec364c0c95fc85bcbc88f1a9a06ebe83c88e18c ]
Since commit a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full"), __change_memory_common has more chance to fail due to memory allocation failure when splitting page table. So check the return value of set_memory_rox(), then bail out if it fails otherwise we may have RW memory mapping for kprobes insn page.
--- arch/arm64/kernel/probes/kprobes.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/arm64/kernel/probes/kprobes.c +4 -1
@@ -49,7 +49,10 @@ void *alloc_insn_page(void) addr =execmem_alloc (EXECMEM_KPROBES ,PAGE_SIZE );if (!addr)return NULL ; -set_memory_rox ((unsigned long )addr,1 ); +if (set_memory_rox ((unsigned long )addr,1 )) { +execmem_free (addr); +return NULL ; + }return addr; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/247 compiler_types: Move unused static inline functions warning to W=2
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
Per Nathan, clang catches unused "static inline" functions in C files since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build").
Quoted 8 lines · Linus
So I entirely ignore W=1 issues, because I think so many of the extra warnings are bogus.
But if this one in particular is causing more problems than most - some teams do seem to use W=1 as part of their test builds - it's fine to send me a patch that just moves bad warnings to W=2.
And if anybody uses W=2 for their test builds, that's THEIR problem..
Here is the change to bump the warning from W=1 to W=2.
--- include/linux/compiler_types.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/linux/compiler_types.h +2 -3
@@ -250,10 +250,9 @@ struct ftrace_likely_data {/* * GCC does not warn about unused static inline functions for -Wunused-function. * Suppress the warning in clang as well by using __maybe_unused, but enable it -* for W=1 build. This will allow clang to find unused functions. Remove the -* __inline_maybe_unused entirely after fixing most of -Wunused-function warnings. +* for W=2 build. This will allow clang to find unused functions. */ -#ifdef KBUILD_EXTRA_WARN1 +#ifdef KBUILD_EXTRA_WARN2 #define __inline_maybe_unused#else #define __inline_maybe_unused __maybe_unused
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/247 riscv: Build loader.bin exclusively for Canaan K210
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Jiang <[email protected]>
[ Upstream commit 3ad1b71fdc5707d14332d9ae710a237de936be9b ]
According to the explanation in commit ef10bdf9c3e6 ("riscv:Kconfig.socs: Split ARCH_CANAAN and SOC_CANAAN_K210"), loader.bin is a special feature of the Canaan K210 and is not applicable to other SoCs.
--- arch/riscv/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/Makefile +1 -1
@@ -166,7 +166,7 @@ boot-image-$(CONFIG_KERNEL_LZO) := Image.lzo boot-image-$(CONFIG_KERNEL_ZSTD) := Image.zst boot-image-$(CONFIG_KERNEL_XZ) := Image.xz ifdef CONFIG_RISCV_M_MODE -boot-image-$(CONFIG_ARCH_CANAAN) := loader.bin +boot-image-$(CONFIG_SOC_CANAAN_K210) := loader.bin endif boot-image-$(CONFIG_EFI_ZBOOT) := vmlinuz.efi boot-image-$(CONFIG_XIP_KERNEL) := xipImage
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/247 RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danil Skrebenkov <[email protected]>
[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
openSBI v1.7 adds harts checks for ipi operations. Especially it adds comparison between hmask passed as an argument from linux and mask of online harts (from openSBI side). If they don't fit each other the error occurs.
When cpu is offline, cpu_online_mask is explicitly cleared in __cpu_disable. However, there is no explicit clearing of mm_cpumask. mm_cpumask is used for rfence operations that call openSBI RFENCE extension which uses ipi to remote harts. If hart is offline there may be error if mask of linux is not as mask of online harts in openSBI.
this patch adds explicit clearing of mm_cpumask for offline hart.
--- arch/riscv/kernel/cpu-hotplug.c | 1 + 1 file changed, 1 insertion(+)
arch/riscv/kernel/cpu-hotplug.c +1 -0
@@ -54,6 +54,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu)pr_notice ("CPU%u: off\n" , cpu); +clear_tasks_mm_cpumask (cpu);/* Verify from the firmware if the cpu is really stopped*/ if (cpu_ops->cpu_is_stopped) ret = cpu_ops->cpu_is_stopped (cpu);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/247 riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Gao <[email protected]>
[ Upstream commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e ]
Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose to boot from acpi then disable FDT"), let's not do DT hardware probing if ACPI is enabled in early boot. This avoids errors caused by repeated driver probing.
--- arch/riscv/kernel/setup.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/riscv/kernel/setup.c +5 -2
@@ -330,11 +330,14 @@ void __init setup_arch(char **cmdline_p)/* Parse the ACPI tables for possible boot-time configuration */ acpi_boot_table_init (); +if (acpi_disabled) {#if IS_ENABLED (CONFIG_BUILTIN_DTB ) -unflatten_and_copy_device_tree (); +unflatten_and_copy_device_tree ();#else -unflatten_device_tree (); +unflatten_device_tree ();#endif + } +misc_mem_init ();init_resources ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/247 fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Albershteyn <[email protected]>
[ Upstream commit d90ad28e8aa482e397150e22f3762173d918a724 ]
These syscalls call to vfs_fileattr_get/set functions which return ENOIOCTLCMD if filesystem doesn't support setting file attribute on an inode. For syscalls EOPNOTSUPP would be more appropriate return error.
--- fs/file_attr.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/file_attr.c +4 -0
@@ -416,6 +416,8 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename, } error =vfs_fileattr_get (filepath.dentry, &fa); +if (error == -ENOIOCTLCMD || error == -ENOTTY ) + error = -EOPNOTSUPP ;if (error)return error;
@@ -483,6 +485,8 @@ SYSCALL_DEFINE5(file_setattr, int, dfd, const char __user *, filename,if (!error) { error =vfs_fileattr_set (mnt_idmap (filepath.mnt), filepath.dentry, &fa); +if (error == -ENOIOCTLCMD || error == -ENOTTY ) + error = -EOPNOTSUPP ;mnt_drop_write (filepath.mnt); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/247 ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit ee70bacef1c6050e4836409927294d744dbcfa72 ]
The interrupt handler offloads the microphone detection logic to nau8821_jdet_work(), which implies a sleep operation. However, before being able to process any subsequent hotplug event, the interrupt handler needs to wait for any prior scheduled work to complete.
Move the sleep out of jdet_work by converting it to a delayed work. This eliminates the undesired blocking in the interrupt handler when attempting to cancel a recently scheduled work item and should help reducing transient input reports that might confuse user-space.
--- sound/soc/codecs/nau8821.c | 22 ++++++++++++---------- sound/soc/codecs/nau8821.h | 2 +- 2 files changed, 13 insertions(+), 11 deletions(-)
sound/soc/codecs/nau8821.c +12 -10
@@ -1104,16 +1104,12 @@ static void nau8821_eject_jack(struct nau8821 *nau8821)static void nau8821_jdet_work (struct work_struct *work) {struct nau8821 *nau8821 = - container_of(work, struct nau8821, jdet_work); + container_of(work, struct nau8821, jdet_work.work);struct snd_soc_dapm_context *dapm = nau8821->dapm;struct snd_soc_component *component =snd_soc_dapm_to_component (dapm);struct regmap *regmap = nau8821->regmap;int jack_status_reg, mic_detected, event =0 , event_mask =0 ; -snd_soc_component_force_enable_pin (component,"MICBIAS" ); -snd_soc_dapm_sync (dapm); -msleep (20 ); -regmap_read (regmap,NAU8821_R58_I2C_DEVICE_ID , &jack_status_reg); mic_detected = !(jack_status_reg &NAU8821_KEYDET );if (mic_detected) {
@@ -1146,6 +1142,7 @@ static void nau8821_jdet_work(struct work_struct *work)snd_soc_component_disable_pin (component,"MICBIAS" );snd_soc_dapm_sync (dapm); } + event_mask |=SND_JACK_HEADSET ;snd_soc_jack_report (nau8821->jack, event, event_mask); }
@@ -1194,6 +1191,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data) {struct nau8821 *nau8821 = (struct nau8821 *)data;struct regmap *regmap = nau8821->regmap; +struct snd_soc_component *component;int active_irq, event =0 , event_mask =0 ;if (regmap_read (regmap,NAU8821_R10_IRQ_STATUS , &active_irq)) {
@@ -1205,7 +1203,7 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)if ((active_irq &NAU8821_JACK_EJECT_IRQ_MASK ) ==NAU8821_JACK_EJECT_DETECTED ) { -cancel_work_sync (&nau8821->jdet_work); +cancel_delayed_work_sync (&nau8821->jdet_work);regmap_update_bits (regmap,NAU8821_R71_ANALOG_ADC_1 ,NAU8821_MICDET_MASK ,NAU8821_MICDET_DIS );nau8821_eject_jack (nau8821);
@@ -1219,12 +1217,15 @@ static irqreturn_t nau8821_interrupt(int irq, void *data)nau8821_irq_status_clear (regmap,NAU8821_KEY_RELEASE_IRQ ); }else if ((active_irq &NAU8821_JACK_INSERT_IRQ_MASK ) ==NAU8821_JACK_INSERT_DETECTED ) { -cancel_work_sync (&nau8821->jdet_work); +cancel_delayed_work_sync (&nau8821->jdet_work);regmap_update_bits (regmap,NAU8821_R71_ANALOG_ADC_1 ,NAU8821_MICDET_MASK ,NAU8821_MICDET_EN );if (nau8821_is_jack_inserted (regmap)) { -/* detect microphone and jack type */ -schedule_work (&nau8821->jdet_work); +/* Detect microphone and jack type */ + component =snd_soc_dapm_to_component (nau8821->dapm); +snd_soc_component_force_enable_pin (component,"MICBIAS" ); +snd_soc_dapm_sync (nau8821->dapm); +schedule_delayed_work (&nau8821->jdet_work,msecs_to_jiffies (20 ));/* Turn off insertion interruption at manual mode */ nau8821_setup_inserted_irq (nau8821); }else {
@@ -1661,7 +1662,8 @@ int nau8821_enable_jack_detect(struct snd_soc_component *component, nau8821->jack = jack;/* Initiate jack detection work queue */ -INIT_WORK (&nau8821->jdet_work, nau8821_jdet_work); +INIT_DELAYED_WORK (&nau8821->jdet_work, nau8821_jdet_work); + ret =devm_request_threaded_irq (nau8821->dev, nau8821->irq,NULL , nau8821_interrupt,IRQF_TRIGGER_LOW |IRQF_ONESHOT ,"nau8821" , nau8821);
sound/soc/codecs/nau8821.h +1 -1
@@ -561,7 +561,7 @@ struct nau8821 {struct regmap *regmap;struct snd_soc_dapm_context *dapm;struct snd_soc_jack *jack; -struct work_struct jdet_work; +struct delayed_work jdet_work;int irq;int clk_id;int micbias_voltage;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/247 drm/amdgpu: remove two invalid BUG_ON()s
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit 5d55ed19d4190d2c210ac05ac7a53f800a8c6fe5 ]
Those can be triggered trivially by userspace.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 -- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 -- 2 files changed, 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +0 -2
@@ -5864,8 +5864,6 @@ static void gfx_v11_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,unsigned vmid =AMDGPU_JOB_GET_VMID (job);u32 header, control =0 ; -BUG_ON (ib->flags &AMDGPU_IB_FLAG_CE ); - header =PACKET3 (PACKET3_INDIRECT_BUFFER ,2 ); control |= ib->length_dw | (vmid <<24 );
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +0 -2
@@ -4421,8 +4421,6 @@ static void gfx_v12_0_ring_emit_ib_gfx(struct amdgpu_ring *ring,unsigned vmid =AMDGPU_JOB_GET_VMID (job);u32 header, control =0 ; -BUG_ON (ib->flags &AMDGPU_IB_FLAG_CE ); - header =PACKET3 (PACKET3_INDIRECT_BUFFER ,2 ); control |= ib->length_dw | (vmid <<24 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/247 drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit 33cc891b56b93cad1a83263eaf2e417436f70c82 ]
Otherwise accessing them can cause a crash.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +3 -0
@@ -234,6 +234,9 @@ static umode_t amdgpu_vram_attrs_is_visible(struct kobject *kobj, !adev->gmc.vram_vendor)return 0 ; +if (!ttm_resource_manager_used (&adev->mman.vram_mgr.manager)) +return 0 ; +return attr->mode; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/247 drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse.Zhang <[email protected]>
[ Upstream commit 883f309add55060233bf11c1ea6947140372920f ]
Previously, APU platforms (and other scenarios with uninitialized VRAM managers) triggered a NULL pointer dereference in ttm_resource_manager_usage(). The root cause is not that the struct ttm_resource_manager *man pointer itself is NULL, but that man->bdev (the backing device pointer within the manager) remains uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully set up VRAM manager structures. When ttm_resource_manager_usage() attempts to acquire man->bdev->lru_lock, it dereferences the NULL man->bdev, leading to a kernel OOPS.
1. **amdgpu_cs.c**: Extend the existing bandwidth control check in amdgpu_cs_get_threshold_for_moves() to include a check for ttm_resource_manager_used(). If the manager is not used (uninitialized bdev), return 0 for migration thresholds immediately—skipping VRAM-specific logic that would trigger the NULL dereference.
2. **amdgpu_kms.c**: Update the AMDGPU_INFO_VRAM_USAGE ioctl and memory info reporting to use a conditional: if the manager is used, return the real VRAM usage; otherwise, return 0. This avoids accessing man->bdev when it is NULL.
3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function) data write path. Use ttm_resource_manager_used() to check validity: if the manager is usable, calculate fb_usage from VRAM usage; otherwise, set fb_usage to 0 (APUs have no discrete framebuffer to report).
This approach is more robust than APU-specific checks because it:
- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
- Aligns with TTM's design by using its native helper function,
- Preserves correct behavior for discrete GPUs (which have fully initialized man->bdev and pass the ttm_resource_manager_used() check).
v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 7 ++++--- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 4 ++-- 3 files changed, 7 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +1 -1
@@ -714,7 +714,7 @@ static void amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev,*/ const s64 us_upper_bound =200000 ; -if (!adev->mm_stats.log2_max_MBps) { +if ((!adev->mm_stats.log2_max_MBps) || !ttm_resource_manager_used (&adev->mman.vram_mgr.manager)) { *max_bytes =0 ; *max_vis_bytes =0 ;return ;
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +4 -3
@@ -758,7 +758,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) ui64 =atomic64_read (&adev->num_vram_cpu_page_faults);return copy_to_user (out, &ui64,min (size,8u )) ? -EFAULT :0 ;case AMDGPU_INFO_VRAM_USAGE : - ui64 =ttm_resource_manager_usage (&adev->mman.vram_mgr.manager); + ui64 =ttm_resource_manager_used (&adev->mman.vram_mgr.manager) ? +ttm_resource_manager_usage (&adev->mman.vram_mgr.manager) :0 ;return copy_to_user (out, &ui64,min (size,8u )) ? -EFAULT :0 ;case AMDGPU_INFO_VIS_VRAM_USAGE : ui64 =amdgpu_vram_mgr_vis_usage (&adev->mman.vram_mgr);
@@ -804,8 +805,8 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) mem.vram.usable_heap_size = adev->gmc.real_vram_size -atomic64_read (&adev->vram_pin_size) -AMDGPU_VM_RESERVED_VRAM ; - mem.vram.heap_usage = -ttm_resource_manager_usage (vram_man); + mem.vram.heap_usage =ttm_resource_manager_used (&adev->mman.vram_mgr.manager) ? +ttm_resource_manager_usage (vram_man) :0 ; mem.vram.max_allocation = mem.vram.usable_heap_size *3 /4 ; mem.cpu_accessible_vram.total_heap_size =
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +2 -2
@@ -598,8 +598,8 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) vf2pf_info->driver_cert =0 ; vf2pf_info->os_info.all =0 ; - vf2pf_info->fb_usage = -ttm_resource_manager_usage (&adev->mman.vram_mgr.manager) >>20 ; + vf2pf_info->fb_usage =ttm_resource_manager_used (&adev->mman.vram_mgr.manager) ? +ttm_resource_manager_usage (&adev->mman.vram_mgr.manager) >>20 :0 ; vf2pf_info->fb_vis_usage =amdgpu_vram_mgr_vis_usage (&adev->mman.vram_mgr) >>20 ; vf2pf_info->fb_size = adev->gmc.real_vram_size >>20 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/247 NFS4: Fix state renewals missing after boot
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <[email protected]>
[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
Since the last renewal time was initialized to 0 and jiffies start counting at -5 minutes, any clients connected in the first 5 minutes after a reboot would have their renewal timer set to a very long interval. If the connection was idle, this would result in the client state timing out on the server and the next call to the server would return NFS4ERR_BADSESSION.
Fix this by initializing the last renewal time to the current jiffies instead of 0.
--- fs/nfs/nfs4client.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/nfs4client.c +1 -0
@@ -222,6 +222,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) clp->cl_state =1 <<NFS4CLNT_LEASE_EXPIRED ; clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion]; clp->cl_mig_gen =1 ; + clp->cl_last_renewal = jiffies;#if IS_ENABLED (CONFIG_NFS_V4_1 )init_waitqueue_head (&clp->cl_lock_waitq);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 30/247 drm/amdkfd: fix suspend/resume all calls in mes based eviction path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Kim <[email protected]>
[ Upstream commit 079ae5118e1f0dcf5b1ab68ffdb5760b06ed79a2 ]
Suspend/resume all gangs should be done with the device lock is held.
--- .../drm/amd/amdkfd/kfd_device_queue_manager.c | 73 ++++++------------- 1 file changed, 21 insertions(+), 52 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +21 -52
@@ -1209,6 +1209,15 @@ static int evict_process_queues_cpsch(struct device_queue_manager *dqm,pr_debug_ratelimited ("Evicting process pid %d queues\n" , pdd->process->lead_thread->pid); +if (dqm->dev->kfd->shared_resources.enable_mes) { + pdd->last_evict_timestamp =get_jiffies_64 (); + retval =suspend_all_queues_mes (dqm); +if (retval) { +dev_err (dev,"Suspending all queues failed" ); + goto out; + } + } +/* Mark all queues as evicted. Deactivate all active queues on * the qpd. */
@@ -1221,23 +1230,27 @@ static int evict_process_queues_cpsch(struct device_queue_manager *dqm,decrement_queue_count (dqm, qpd, q);if (dqm->dev->kfd->shared_resources.enable_mes) { -int err; - - err =remove_queue_mes (dqm, q, qpd); -if (err) { + retval =remove_queue_mes (dqm, q, qpd); +if (retval) {dev_err (dev,"Failed to evict queue %d\n" , q->properties.queue_id); - retval = err; + goto out; } } } - pdd->last_evict_timestamp =get_jiffies_64 (); -if (!dqm->dev->kfd->shared_resources.enable_mes) + +if (!dqm->dev->kfd->shared_resources.enable_mes) { + pdd->last_evict_timestamp =get_jiffies_64 (); retval =execute_queues_cpsch (dqm, qpd->is_debug ?KFD_UNMAP_QUEUES_FILTER_ALL_QUEUES :KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES ,0 ,USE_DEFAULT_GRACE_PERIOD ); + }else { + retval =resume_all_queues_mes (dqm); +if (retval) +dev_err (dev,"Resuming all queues failed" ); + } out:dqm_unlock (dqm);
@@ -3098,61 +3111,17 @@ int kfd_dqm_suspend_bad_queue_mes(struct kfd_node *knode, u32 pasid, u32 doorbelreturn ret; } -static int kfd_dqm_evict_pasid_mes (struct device_queue_manager *dqm, -struct qcm_process_device *qpd) -{ -struct device *dev = dqm->dev->adev->dev; -int ret =0 ; - -/* Check if process is already evicted */ -dqm_lock (dqm); -if (qpd->evicted) { -/* Increment the evicted count to make sure the -* process stays evicted before its terminated. -*/ - qpd->evicted++; -dqm_unlock (dqm); - goto out; - } -dqm_unlock (dqm); - - ret =suspend_all_queues_mes (dqm); -if (ret) { -dev_err (dev,"Suspending all queues failed" ); - goto out; - } - - ret = dqm->ops.evict_process_queues (dqm, qpd); -if (ret) { -dev_err (dev,"Evicting process queues failed" ); - goto out; - } - - ret =resume_all_queues_mes (dqm); -if (ret) -dev_err (dev,"Resuming all queues failed" ); - -out: -return ret; -} -int kfd_evict_process_device (struct kfd_process_device *pdd) {struct device_queue_manager *dqm;struct kfd_process *p; -int ret =0 ; p = pdd->process; dqm = pdd->dev->dqm;WARN (debug_evictions,"Evicting pid %d" , p->lead_thread->pid); -if (dqm->dev->kfd->shared_resources.enable_mes) - ret =kfd_dqm_evict_pasid_mes (dqm, &pdd->qpd); -else - ret = dqm->ops.evict_process_queues (dqm, &pdd->qpd); - -return ret; +return dqm->ops.evict_process_queues (dqm, &pdd->qpd); } int reserve_debug_trap_vmid(struct device_queue_manager *dqm,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/247 NFS4: Apply delay_retrans to async operations
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <[email protected]>
[ Upstream commit 7a84394f02ab1985ebbe0a8d6f6d69bd040de4b3 ]
The setting of delay_retrans is applied to synchronous RPC operations because the retransmit count is stored in same struct nfs4_exception that is passed each time an error is checked. However, for asynchronous operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct nfs4_exception is made on the stack each time the task callback is invoked. This means that the retransmit count is always zero and thus delay_retrans never takes effect.
Apply delay_retrans to these operations by tracking and updating their retransmit count.
--- fs/nfs/nfs4proc.c | 13 +++++++++++++ include/linux/nfs_xdr.h | 1 + 2 files changed, 14 insertions(+)
fs/nfs/nfs4proc.c +13 -0
@@ -3636,6 +3636,7 @@ struct nfs4_closedata { } lr;struct nfs_fattr fattr;unsigned long timestamp; +unsigned short retrans; };static void nfs4_free_closedata (void *data)
@@ -3664,6 +3665,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) .state = state, .inode = calldata->inode, .stateid = &calldata->arg.stateid, + .retrans = calldata->retrans, };if (!nfs4_sequence_done (task, &calldata->res.seq_res))
@@ -3711,6 +3713,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)default : task->tk_status =nfs4_async_handle_exception (task, server, task->tk_status, &exception); + calldata->retrans = exception.retrans;if (exception.retry) goto out_restart; }
@@ -5593,9 +5596,11 @@ static int nfs4_read_done_cb(struct rpc_task *task, struct nfs_pgio_header *hdr) .inode = hdr->inode, .state = hdr->args.context->state, .stateid = &hdr->args.stateid, + .retrans = hdr->retrans, }; task->tk_status =nfs4_async_handle_exception (task, server, task->tk_status, &exception); + hdr->retrans = exception.retrans;if (exception.retry) {rpc_restart_call_prepare (task);return -EAGAIN ;
@@ -5709,10 +5714,12 @@ static int nfs4_write_done_cb(struct rpc_task *task, .inode = hdr->inode, .state = hdr->args.context->state, .stateid = &hdr->args.stateid, + .retrans = hdr->retrans, }; task->tk_status =nfs4_async_handle_exception (task,NFS_SERVER (inode), task->tk_status, &exception); + hdr->retrans = exception.retrans;if (exception.retry) {rpc_restart_call_prepare (task);return -EAGAIN ;
@@ -6726,6 +6733,7 @@ struct nfs4_delegreturndata {struct nfs_fh fh;nfs4_stateid stateid;unsigned long timestamp; +unsigned short retrans;struct {struct nfs4_layoutreturn_args arg;struct nfs4_layoutreturn_res res;
@@ -6746,6 +6754,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) .inode = data->inode, .stateid = &data->stateid, .task_is_privileged = data->args.seq_args.sa_privileged, + .retrans = data->retrans, };if (!nfs4_sequence_done (task, &data->res.seq_res))
@@ -6817,6 +6826,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) task->tk_status =nfs4_async_handle_exception (task, data->res.server, task->tk_status, &exception); + data->retrans = exception.retrans;if (exception.retry) goto out_restart; }
@@ -7093,6 +7103,7 @@ struct nfs4_unlockdata {struct file_lock fl;struct nfs_server *server;unsigned long timestamp; +unsigned short retrans; }; static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
@@ -7147,6 +7158,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)struct nfs4_exception exception = { .inode = calldata->lsp->ls_state->inode, .stateid = &calldata->arg.stateid, + .retrans = calldata->retrans, };if (!nfs4_sequence_done (task, &calldata->res.seq_res))
@@ -7180,6 +7192,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data) task->tk_status =nfs4_async_handle_exception (task, calldata->server, task->tk_status, &exception); + calldata->retrans = exception.retrans;if (exception.retry)rpc_restart_call_prepare (task); }
include/linux/nfs_xdr.h +1 -0
@@ -1659,6 +1659,7 @@ struct nfs_pgio_header {void *netfs;#endif +unsigned short retrans;int pnfs_error;int error;/* merge with pnfs_error */ unsigned int good_bytes;/* boundary of good data */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/247 HID: intel-thc-hid: intel-quickspi: Add ARL PCI Device Ids
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Tamboli <[email protected]>
[ Upstream commit 50f1f782f8d621a90108340c632bcb6ab4307d2e ]
Add the missing PCI ID for the quickspi device used on the Lenovo Yoga Pro 9i 16IAH10.
--- drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 6 ++++++ drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 ++ 2 files changed, 8 insertions(+)
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c +6 -0
@@ -33,6 +33,10 @@ struct quickspi_driver_data ptl = { .max_packet_size_value = MAX_PACKET_SIZE_VALUE_LNL, }; +struct quickspi_driver_data arl = { + .max_packet_size_value =MAX_PACKET_SIZE_VALUE_MTL , +}; +/* THC QuickSPI ACPI method to get device properties */ /* HIDSPI Method: {6e2ac436-0fcf-41af-a265-b32a220dcfab} */ static guid_t hidspi_guid =
@@ -978,6 +982,8 @@ static const struct pci_device_id quickspi_pci_tbl[] = { {PCI_DEVICE_DATA(INTEL, THC_PTL_U_DEVICE_ID_SPI_PORT2, &ptl), }, {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT1, &ptl), }, {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT2, &ptl), }, + {PCI_DEVICE_DATA(INTEL, THC_ARL_DEVICE_ID_SPI_PORT1, &arl), }, + {PCI_DEVICE_DATA(INTEL, THC_ARL_DEVICE_ID_SPI_PORT2, &arl), }, {} };MODULE_DEVICE_TABLE (pci, quickspi_pci_tbl);
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h +2 -0
@@ -21,6 +21,8 @@#define PCI_DEVICE_ID_INTEL_THC_PTL_U_DEVICE_ID_SPI_PORT2 0xE44B#define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT1 0x4D49#define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT2 0x4D4B +#define PCI_DEVICE_ID_INTEL_THC_ARL_DEVICE_ID_SPI_PORT1 0x7749 +#define PCI_DEVICE_ID_INTEL_THC_ARL_DEVICE_ID_SPI_PORT2 0x774B/* HIDSPI special ACPI parameters DSM methods */ #define ACPI_QUICKSPI_REVISION_NUM 2
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/247 HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Lobb <[email protected]>
[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
The Cooler Master Mice Dongle includes a vendor defined HID interface alongside its mouse interface. Not polling it will cause the mouse to stop responding to polls on any interface once woken up again after going into power saving mode.
Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and the Dongle's PID.
--- drivers/hid/hid-ids.h | 3 +++ drivers/hid/hid-quirks.c | 1 + 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +3 -0
@@ -342,6 +342,9 @@#define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500#define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff +#define USB_VENDOR_ID_COOLER_MASTER 0x2516 +#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7 +#define USB_VENDOR_ID_CORSAIR 0x1b1c#define USB_DEVICE_ID_CORSAIR_K90 0x1b02#define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
drivers/hid/hid-quirks.c +1 -0
@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/247 ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jedrzej Jagielski <[email protected]>
[ Upstream commit f7f97cbc03a470ce405d48dedb7f135713caa0fa ]
Update supported API version and provide handler for IXGBE_VF_GET_PF_LINK_STATE cmd.
Simply put stored values of link speed and link_up from adapter context.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 5 +++ .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 42 +++++++++++++++++++ 2 files changed, 47 insertions(+)
drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h +5 -0
@@ -50,6 +50,8 @@ enum ixgbe_pfvf_api_rev { ixgbe_mbox_api_12,/* API version 1.2, linux/freebsd VF driver */ ixgbe_mbox_api_13,/* API version 1.3, linux/freebsd VF driver */ ixgbe_mbox_api_14,/* API version 1.4, linux/freebsd VF driver */ + ixgbe_mbox_api_15,/* API version 1.5, linux/freebsd VF driver */ + ixgbe_mbox_api_16,/* API version 1.6, linux/freebsd VF driver */ /* This value should always be last */ ixgbe_mbox_api_unknown, /* indicates that API version is not known */ };
@@ -86,6 +88,9 @@ enum ixgbe_pfvf_api_rev {#define IXGBE_VF_GET_LINK_STATE 0x10/* get vf link state */ +/* mailbox API, version 1.6 VF requests */ +#define IXGBE_VF_GET_PF_LINK_STATE 0x11/* request PF to send link info */ +/* length of permanent address message returned from PF */ #define IXGBE_VF_PERMADDR_MSG_LEN 4/* word in permanent address message with the current multicast type */
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +42 -0
96 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/247 HID: nintendo: Wait longer for initial probe
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vicki Pfau <[email protected]>
[ Upstream commit b73bc6a51f0c0066912c7e181acee41091c70fe6 ]
Some third-party controllers, such as the PB Tails CHOC, won't always respond quickly on startup. Since this packet is needed for probe, and only once during probe, let's just wait an extra second, which makes connecting consistent.
--- drivers/hid/hid-nintendo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-nintendo.c +1 -1
@@ -2420,7 +2420,7 @@ static int joycon_read_info(struct joycon_ctlr *ctlr)struct joycon_input_report *report; req.subcmd_id =JC_SUBCMD_REQ_DEV_INFO ; - ret =joycon_send_subcmd (ctlr, &req,0 ,HZ ); + ret =joycon_send_subcmd (ctlr, &req,0 ,2 *HZ );if (ret) {hid_err (ctlr->hdev,"Failed to get joycon info; ret=%d\n" , ret);return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/247 NFS: check if suid/sgid was cleared after a write as needed
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <[email protected]>
[ Upstream commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 ]
I noticed xfstests generic/193 and generic/355 started failing against knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE").
I ran those same tests against ONTAP (which has had write delegation support for a lot longer than knfsd) and they fail there too... so while it's a new failure against knfsd, it isn't an entirely new failure.
Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation doesn't keep the inode from being revalidated to fetch the updated mode.
--- fs/nfs/write.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/write.c +2 -1
@@ -1521,7 +1521,8 @@ static int nfs_writeback_done(struct rpc_task *task,/* Deal with the suid/sgid bit corner case */ if (nfs_should_remove_suid (inode)) {spin_lock (&inode->i_lock); -nfs_set_cache_invalid (inode,NFS_INO_INVALID_MODE ); +nfs_set_cache_invalid (inode,NFS_INO_INVALID_MODE + |NFS_INO_REVAL_FORCED );spin_unlock (&inode->i_lock); }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/247 HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Makarenko <[email protected]>
[ Upstream commit 1141ed52348d3df82d3fd2316128b3fc6203a68c ]
This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick. This device reboots itself every 8-10 seconds if it is not polled.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -1435,6 +1435,7 @@#define USB_VENDOR_ID_VRS 0x0483#define USB_DEVICE_ID_VRS_DFP 0xa355 +#define USB_DEVICE_ID_VRS_R295 0xa44c#define USB_VENDOR_ID_VTL 0x0306#define USB_DEVICE_ID_VTL_MULTITOUCH_FF3F 0xff3f
drivers/hid/hid-quirks.c +1 -0
@@ -207,6 +207,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_R295), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/247 exfat: fix improper check of dentry.stream.valid_size
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaehun Gou <[email protected]>
[ Upstream commit 82ebecdc74ff555daf70b811d854b1f32a296bea ]
We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls — SYS_openat, SYS_ftruncate, and SYS_pwrite64 — can cause the kernel to hang.
Root cause analysis shows that the size validation code in exfat_find() does not check whether dentry.stream.valid_size is negative. As a result, the system calls mentioned above can succeed and eventually trigger the DoS issue.
This patch adds a check for negative dentry.stream.valid_size to prevent this vulnerability.
--- fs/exfat/namei.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/exfat/namei.c +5 -1
@@ -642,10 +642,14 @@ static int exfat_find(struct inode *dir, struct qstr *qname, info->type =exfat_get_entry_type (ep); info->attr =le16_to_cpu (ep->dentry.file.attr); - info->size =le64_to_cpu (ep2->dentry.stream.valid_size); info->valid_size =le64_to_cpu (ep2->dentry.stream.valid_size); info->size =le64_to_cpu (ep2->dentry.stream.size); +if (info->valid_size <0 ) { +exfat_fs_error (sb,"data valid size is invalid(%lld)" , info->valid_size); +return -EIO ; + } +if (unlikely (EXFAT_B_TO_CLU_ROUND_UP (info->size, sbi) > sbi->used_clusters)) {exfat_fs_error (sb,"data size is invalid(%lld)" , info->size);return -EIO ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/247 io_uring: fix unexpected placement on same size resizing
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <[email protected]>
[ Upstream commit 437c23357d897f5b5b7d297c477da44b56654d46 ]
There might be many reasons why a user is resizing a ring, e.g. moving to huge pages or for some memory compaction using IORING_SETUP_NO_MMAP. Don't bypass resizing, the user will definitely be surprised seeing 0 while the rings weren't actually moved to a new place.
--- io_uring/register.c | 7 ------- 1 file changed, 7 deletions(-)
io_uring/register.c +0 -7
@@ -426,13 +426,6 @@ static int io_register_resize_rings(struct io_ring_ctx *ctx, void __user *arg)if (unlikely (ret))return ret; -/* nothing to do, but copy params back */ -if (p.sq_entries == ctx->sq_entries && p.cq_entries == ctx->cq_entries) { -if (copy_to_user (arg, &p,sizeof (p))) -return -EFAULT ; -return 0 ; - } - size =rings_size (p.flags, p.sq_entries, p.cq_entries, &sq_array_offset);if (size ==SIZE_MAX )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/247 smb/server: fix possible memory leak in smb2_read()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <[email protected]>
[ Upstream commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 ]
Memory leak occurs when ksmbd_vfs_read() fails. Fix this by adding the missing kvfree().
--- fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/server/smb2pdu.c +1 -0
@@ -6826,6 +6826,7 @@ int smb2_read(struct ksmbd_work *work) nbytes =ksmbd_vfs_read (work, fp, length, &offset, aux_payload_buf);if (nbytes <0 ) { +kvfree (aux_payload_buf); err = nbytes; goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/247 smb/server: fix possible refcount leak in smb2_sess_setup()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhangGuoDong <[email protected]>
[ Upstream commit 379510a815cb2e64eb0a379cb62295d6ade65df0 ]
Reference count of ksmbd_session will leak when session need reconnect. Fix this by adding the missing ksmbd_user_session_put().
--- fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+)
fs/smb/server/smb2pdu.c +1 -0
@@ -1805,6 +1805,7 @@ int smb2_sess_setup(struct ksmbd_work *work)if (ksmbd_conn_need_reconnect (conn)) { rc = -EFAULT ; +ksmbd_user_session_put (sess); sess =NULL ; goto out_err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/247 HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hayhurst <[email protected]>
[ Upstream commit ed80cc4667ac997b84546e6d35f0a0ae525d239c ]
The Logitech G502 Hero Wireless's high resolution scrolling resets after being unplugged without notifying the driver, causing extremely slow scrolling.
The only indication of this is a battery update packet, so add a quirk to detect when the device is unplugged and re-enable the scrolling.
--- drivers/hid/hid-logitech-hidpp.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/hid/hid-logitech-hidpp.c +21 -0
@@ -75,6 +75,7 @@ MODULE_PARM_DESC(disable_tap_to_click,#define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(27)#define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(28)#define HIDPP_QUIRK_WIRELESS_STATUS BIT(29) +#define HIDPP_QUIRK_RESET_HI_RES_SCROLL BIT(30)/* These are just aliases for now */ #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS
@@ -193,6 +194,7 @@ struct hidpp_device {void *private_data;struct work_struct work; +struct work_struct reset_hi_res_work;struct kfifo delayed_work_fifo;struct input_dev *delayed_input;
@@ -3836,6 +3838,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,struct hidpp_report *answer = hidpp->send_receive_buf;struct hidpp_report *report = (struct hidpp_report *)data;int ret; +int last_online;/* * If the mutex is locked then we have a pending answer from a
@@ -3877,6 +3880,7 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data, "See: https://gitlab.freedesktop.org/jwrdegoede/logitech-27mhz-keyboard-encryption-setup/\n"); } + last_online = hidpp->battery.online;if (hidpp->capabilities &HIDPP_CAPABILITY_HIDPP20_BATTERY ) { ret =hidpp20_battery_event_1000 (hidpp, data, size);if (ret !=0 )
@@ -3901,6 +3905,11 @@ static int hidpp_raw_hidpp_event(struct hidpp_device *hidpp, u8 *data,return ret; } +if (hidpp->quirks &HIDPP_QUIRK_RESET_HI_RES_SCROLL ) { +if (last_online ==0 && hidpp->battery.online ==1 ) +schedule_work (&hidpp->reset_hi_res_work); + } +if (hidpp->quirks &HIDPP_QUIRK_HIDPP_WHEELS ) { ret =hidpp10_wheel_raw_event (hidpp, data, size);if (ret !=0 )
@@ -4274,6 +4283,13 @@ static void hidpp_connect_event(struct work_struct *work) hidpp->delayed_input = input; } +static void hidpp_reset_hi_res_handler (struct work_struct *work) +{ + struct hidpp_device *hidpp = container_of(work, struct hidpp_device, reset_hi_res_work); + +hi_res_scroll_enable (hidpp); +} + static DEVICE_ATTR(builtin_power_supply, 0000, NULL, NULL);static struct attribute *sysfs_attrs[] = {
@@ -4404,6 +4420,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) }INIT_WORK (&hidpp->work, hidpp_connect_event); +INIT_WORK (&hidpp->reset_hi_res_work, hidpp_reset_hi_res_handler);mutex_init (&hidpp->send_mutex);init_waitqueue_head (&hidpp->wait);
@@ -4499,6 +4516,7 @@ static void hidpp_remove(struct hid_device *hdev)hid_hw_stop (hdev);cancel_work_sync (&hidpp->work); +cancel_work_sync (&hidpp->reset_hi_res_work);mutex_destroy (&hidpp->send_mutex); }
@@ -4546,6 +4564,9 @@ static const struct hid_device_id hidpp_devices[] = { {/* Keyboard MX5500 (Bluetooth-receiver in HID proxy mode) */ LDJ_DEVICE(0xb30b), .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, + { /* Logitech G502 Lightspeed Wireless Gaming Mouse */ + LDJ_DEVICE(0x407f), + .driver_data = HIDPP_QUIRK_RESET_HI_RES_SCROLL }, { LDJ_DEVICE(HID_ANY_ID) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/247 ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sharique Mohammad <[email protected]>
[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they are turned on or off, the required startup or shutdown sequences must be taken care by the max98090_shdn_event.
--- sound/soc/codecs/max98090.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/codecs/max98090.c +4 -2
@@ -1234,9 +1234,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {SND_SOC_DAPM_INPUT ("DMIC4" ),SND_SOC_DAPM_SUPPLY ("DMIC3_ENA" ,M98090_REG_DIGITAL_MIC_ENABLE , -M98090_DIGMIC3_SHIFT ,0 ,NULL ,0 ), +M98090_DIGMIC3_SHIFT ,0 , max98090_shdn_event, +SND_SOC_DAPM_POST_PMU ),SND_SOC_DAPM_SUPPLY ("DMIC4_ENA" ,M98090_REG_DIGITAL_MIC_ENABLE , - M98090_DIGMIC4_SHIFT, 0, NULL, 0), +M98090_DIGMIC4_SHIFT ,0 , max98090_shdn_event, + SND_SOC_DAPM_POST_PMU), }; static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/247 ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawn Gardner <[email protected]>
[ Upstream commit 2a786348004b34c5f61235d51c40c1c718b1f8f9 ]
This laptop uses the ALC285 codec, fixed by enabling the ALC285_FIXUP_HP_MUTE_LED quirk
--- sound/hda/codecs/realtek/alc269.c | 1 + 1 file changed, 1 insertion(+)
sound/hda/codecs/realtek/alc269.c +1 -0
@@ -6399,6 +6399,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x854a ,"HP EliteBook 830 G6" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x85c6 ,"HP Pavilion x360 Convertible 14-dy1xxx" ,ALC295_FIXUP_HP_MUTE_LED_COEFBIT11 ),SND_PCI_QUIRK (0x103c ,0x85de ,"HP Envy x360 13-ar0xxx" ,ALC285_FIXUP_HP_ENVY_X360 ), +SND_PCI_QUIRK (0x103c ,0x8603 ,"HP Omen 17-cb0xxx" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x860c ,"HP ZBook 17 G6" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x860f ,"HP ZBook 15 G6" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/247 ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jedrzej Jagielski <[email protected]>
[ Upstream commit 823be089f9c8ab136ba382b516aedd3f7ac854bd ]
Send to VF information about features supported by the PF driver.
Increase API version to 1.7.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h | 10 +++++ .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 37 +++++++++++++++++++ 2 files changed, 47 insertions(+)
drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h +10 -0
@@ -52,6 +52,7 @@ enum ixgbe_pfvf_api_rev { ixgbe_mbox_api_14,/* API version 1.4, linux/freebsd VF driver */ ixgbe_mbox_api_15,/* API version 1.5, linux/freebsd VF driver */ ixgbe_mbox_api_16,/* API version 1.6, linux/freebsd VF driver */ + ixgbe_mbox_api_17,/* API version 1.7, linux/freebsd VF driver */ /* This value should always be last */ ixgbe_mbox_api_unknown, /* indicates that API version is not known */ };
@@ -91,6 +92,9 @@ enum ixgbe_pfvf_api_rev {/* mailbox API, version 1.6 VF requests */ #define IXGBE_VF_GET_PF_LINK_STATE 0x11/* request PF to send link info */ +/* mailbox API, version 1.7 VF requests */ +#define IXGBE_VF_FEATURES_NEGOTIATE 0x12/* get features supported by PF */ +/* length of permanent address message returned from PF */ #define IXGBE_VF_PERMADDR_MSG_LEN 4/* word in permanent address message with the current multicast type */
@@ -101,6 +105,12 @@ enum ixgbe_pfvf_api_rev {#define IXGBE_VF_MBX_INIT_TIMEOUT 2000/* number of retries on mailbox */ #define IXGBE_VF_MBX_INIT_DELAY 500/* microseconds between retries */ +/* features negotiated between PF/VF */ +#define IXGBEVF_PF_SUP_IPSEC BIT(0) +#define IXGBEVF_PF_SUP_ESX_MBX BIT(1) + +#define IXGBE_SUPPORTED_FEATURES IXGBEVF_PF_SUP_IPSEC +struct ixgbe_hw ;int ixgbe_read_mbx (struct ixgbe_hw *,u32 *,u16 ,u16 );
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +37 -0
@@ -511,6 +511,7 @@ static int ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 max_frame, u32 vfcase ixgbe_mbox_api_13:case ixgbe_mbox_api_14:case ixgbe_mbox_api_16: +case ixgbe_mbox_api_17:/* Version 1.1 supports jumbo frames on VFs if PF has * jumbo frames enabled which means legacy VFs are * disabled
@@ -1048,6 +1049,7 @@ static int ixgbe_negotiate_vf_api(struct ixgbe_adapter *adapter,case ixgbe_mbox_api_13:case ixgbe_mbox_api_14:case ixgbe_mbox_api_16: +case ixgbe_mbox_api_17: adapter->vfinfo[vf].vf_api = api;return 0 ;default :
@@ -1075,6 +1077,7 @@ static int ixgbe_get_vf_queues(struct ixgbe_adapter *adapter,case ixgbe_mbox_api_13:case ixgbe_mbox_api_14:case ixgbe_mbox_api_16: +case ixgbe_mbox_api_17:break ;default :return -1 ;
@@ -1115,6 +1118,7 @@ static int ixgbe_get_vf_reta(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)/* verify the PF is supporting the correct API */ switch (adapter->vfinfo[vf].vf_api) { +case ixgbe_mbox_api_17:case ixgbe_mbox_api_16:case ixgbe_mbox_api_14:case ixgbe_mbox_api_13:
@@ -1149,6 +1153,7 @@ static int ixgbe_get_vf_rss_key(struct ixgbe_adapter *adapter,/* verify the PF is supporting the correct API */ switch (adapter->vfinfo[vf].vf_api) { +case ixgbe_mbox_api_17:case ixgbe_mbox_api_16:case ixgbe_mbox_api_14:case ixgbe_mbox_api_13:
@@ -1180,6 +1185,7 @@ static int ixgbe_update_vf_xcast_mode(struct ixgbe_adapter *adapter,case ixgbe_mbox_api_13:case ixgbe_mbox_api_14:case ixgbe_mbox_api_16: +case ixgbe_mbox_api_17:break ;default :return -EOPNOTSUPP ;
@@ -1251,6 +1257,7 @@ static int ixgbe_get_vf_link_state(struct ixgbe_adapter *adapter,case ixgbe_mbox_api_13:case ixgbe_mbox_api_14:case ixgbe_mbox_api_16: +case ixgbe_mbox_api_17:break ;default :return -EOPNOTSUPP ;
@@ -1278,6 +1285,7 @@ static int ixgbe_send_vf_link_status(struct ixgbe_adapter *adapter,switch (adapter->vfinfo[vf].vf_api) {case ixgbe_mbox_api_16: +case ixgbe_mbox_api_17:if (hw->mac.type != ixgbe_mac_e610)return -EOPNOTSUPP ;break ;
@@ -1293,6 +1301,32 @@ static int ixgbe_send_vf_link_status(struct ixgbe_adapter *adapter,return 0 ; } +/** +* ixgbe_negotiate_vf_features - negotiate supported features with VF driver +* @adapter: pointer to adapter struct +* @msgbuf: pointer to message buffers +* @vf: VF identifier +* +* Return: 0 on success or -EOPNOTSUPP when operation is not supported. +*/ +static int ixgbe_negotiate_vf_features (struct ixgbe_adapter *adapter, +u32 *msgbuf,u32 vf) +{ +u32 features = msgbuf[1 ]; + +switch (adapter->vfinfo[vf].vf_api) { +case ixgbe_mbox_api_17: +break ; +default : +return -EOPNOTSUPP ; + } + + features &=IXGBE_SUPPORTED_FEATURES ; + msgbuf[1 ] = features; + +return 0 ; +} +static int ixgbe_rcv_msg_from_vf (struct ixgbe_adapter *adapter,u32 vf) {u32 mbx_size =IXGBE_VFMAILBOX_SIZE ;
@@ -1370,6 +1404,9 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf)case IXGBE_VF_GET_PF_LINK_STATE : retval =ixgbe_send_vf_link_status (adapter, msgbuf, vf);break ; +case IXGBE_VF_FEATURES_NEGOTIATE : + retval =ixgbe_negotiate_vf_features (adapter, msgbuf, vf); +break ;default :e_err (drv,"Unhandled Msg %8.8x\n" , msgbuf[0 ]); retval = -EIO ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/247 wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Escande <[email protected]>
[ Upstream commit 9065b968752334f972e0d48e50c4463a172fc2a7 ]
When reporting tx completion using ieee80211_tx_status_xxx() family of functions, the status part of the struct ieee80211_tx_info nested in the skb is used to report things like transmit rates & retry count to mac80211
On the TX data path, this is correctly memset to 0 before calling ieee80211_tx_status_ext(), but on the tx mgmt path this was not done.
This leads to mac80211 treating garbage values as valid transmit counters (like tx retries for example) and accounting them as real statistics that makes their way to userland via station dump.
The same issue was resolved in ath12k by commit 9903c0986f78 ("wifi:
ath12k: Add memset and update default rate value in wmi tx completion")
Tested-on: QCN9074 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/wmi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/ath/ath11k/wmi.c +3 -0
@@ -5961,6 +5961,9 @@ static int wmi_process_mgmt_tx_comp(struct ath11k *ar,dma_unmap_single (ar->ab->dev, skb_cb->paddr, msdu->len,DMA_TO_DEVICE ); info =IEEE80211_SKB_CB (msdu); +memset (&info->status,0 ,sizeof (info->status)); + info->status.rates[0 ].idx =-1 ; +if ((!(info->flags &IEEE80211_TX_CTL_NO_ACK )) && !tx_compl_param->status) { info->flags |=IEEE80211_TX_STAT_ACK ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/247 erofs: avoid infinite loop due to incomplete zstd-compressed data
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit f2a12cc3b97f062186568a7b94ddb7aa2ef68140 ]
Currently, the decompression logic incorrectly spins if compressed data is truncated in crafted (deliberately corrupted) images.
--- fs/erofs/decompressor_zstd.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
fs/erofs/decompressor_zstd.c +7 -4
@@ -172,7 +172,6 @@ static int z_erofs_zstd_decompress(struct z_erofs_decompress_req *rq, dctx.bounce = strm->bounce; do { - dctx.avail_out = out_buf.size - out_buf.pos; dctx.inbuf_sz = in_buf.size; dctx.inbuf_pos = in_buf.pos; err = z_erofs_stream_switch_bufs(&dctx, &out_buf.dst,
@@ -188,14 +187,18 @@ static int z_erofs_zstd_decompress(struct z_erofs_decompress_req *rq, in_buf.pos = dctx.inbuf_pos; zerr =zstd_decompress_stream (stream, &out_buf, &in_buf); -if (zstd_is_error (zerr) || (!zerr && rq->outputsize)) { + dctx.avail_out = out_buf.size - out_buf.pos; +if (zstd_is_error (zerr) || + ((rq->outputsize + dctx.avail_out) && (!zerr || (zerr >0 && + !(rq->inputsize + in_buf.size - in_buf.pos))))) {erofs_err (sb,"failed to decompress in[%u] out[%u]: %s" , rq->inputsize, rq->outputsize, - zerr ?zstd_get_error_name (zerr) :"unexpected end of stream" ); +zstd_is_error (zerr) ?zstd_get_error_name (zerr) : +"unexpected end of stream" ); err = -EFSCORRUPTED ;break ; } - }while (rq->outputsize || out_buf.pos < out_buf.size); + }while (rq->outputsize + dctx.avail_out);if (dctx.kout)kunmap_local (dctx.kout);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/247 selftests: net: local_termination: Wait for interfaces to come up
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
[ Upstream commit 57531b3416448d1ced36a2a974a4085ec43d57b0 ]
It seems that most of the tests prepare the interfaces once before the test run (setup_prepare()), rely on setup_wait() to wait for link and only then run the test(s).
local_termination brings the physical interfaces down and up during test run but never wait for them to come up. If the auto-negotiation takes some seconds, first test packets are being lost, which leads to false-negative test results.
Use setup_wait() in run_test() to make sure auto-negotiation has been completed after all simple_if_init() calls on physical interfaces and test packets will not be lost because of the race against link establishment.
--- tools/testing/selftests/net/forwarding/local_termination.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/local_termination.sh +2 -0
@@ -176,6 +176,8 @@ run_test() local rcv_dmac=$(mac_get $rcv_if_name) local should_receive + setup_wait + tcpdump_start $rcv_if_name mc_route_prepare $send_if_name
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/247 net: fec: correct rx_bytes statistic for the case SHIFT16 is set
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit ad17e7e92a7c52ce70bb764813fcf99464f96903 ]
Two additional bytes in front of each frame received into the RX FIFO if SHIFT16 is set, so we need to subtract the extra two bytes from pkt_len to correct the statistic of rx_bytes.
--- drivers/net/ethernet/freescale/fec_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/freescale/fec_main.c +2 -0
@@ -1820,6 +1820,8 @@ fec_enet_rx_queue(struct net_device *ndev, u16 queue_id, int budget) ndev->stats.rx_packets++; pkt_len =fec16_to_cpu (bdp->cbd_datlen); ndev->stats.rx_bytes += pkt_len; +if (fep->quirks &FEC_QUIRK_HAS_RACC ) + ndev->stats.rx_bytes -=2 ; index =fec_enet_get_bd_index (bdp, &rxq->bd); page = rxq->rx_skb_info[index].page;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/247 net: phy: micrel: Introduce lanphy_modify_page_reg
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit a0de636ed7a264a329c6a9c7d50727af02138536 ]
As the name suggests this function modifies the register in an extended page. It has the same parameters as phy_modify_mmd. This function was introduce because there are many places in the code where the registers was read then the value was modified and written back. So replace all this code with this function to make it clear.
Stable-dep-of: 96a9178a29a6 ("net: phy: micrel: lan8814 fix reset of the QSGMII interface")
--- drivers/net/phy/micrel.c | 231 ++++++++++++++++++++------------------- 1 file changed, 116 insertions(+), 115 deletions(-)
drivers/net/phy/micrel.c +116 -115
@@ -2840,6 +2840,27 @@ static int lanphy_write_page_reg(struct phy_device *phydev, int page, u16 addr,return val; } +static int lanphy_modify_page_reg (struct phy_device *phydev,int page,u16 addr, +u16 mask,u16 set) +{ +int ret; + +phy_lock_mdio_bus (phydev); +__phy_write (phydev,LAN_EXT_PAGE_ACCESS_CONTROL , page); +__phy_write (phydev,LAN_EXT_PAGE_ACCESS_ADDRESS_DATA , addr); +__phy_write (phydev,LAN_EXT_PAGE_ACCESS_CONTROL , + (page |LAN_EXT_PAGE_ACCESS_CTRL_EP_FUNC )); + ret =__phy_modify_changed (phydev,LAN_EXT_PAGE_ACCESS_ADDRESS_DATA , + mask, set); +phy_unlock_mdio_bus (phydev); + +if (ret <0 ) +phydev_err (phydev,"__phy_modify_changed() failed: %pe\n" , +ERR_PTR (ret)); + +return ret; +} +static int lan8814_config_ts_intr (struct phy_device *phydev,bool enable) {u16 val =0 ;
@@ -2928,7 +2949,6 @@ static int lan8814_hwtstamp(struct mii_timestamper *mii_ts,struct lan8814_ptp_rx_ts *rx_ts, *tmp;int txcfg =0 , rxcfg =0 ;int pkt_ts_enable; -int tx_mod; ptp_priv->hwts_tx_type = config->tx_type; ptp_priv->rx_filter = config->rx_filter;
@@ -2975,13 +2995,14 @@ static int lan8814_hwtstamp(struct mii_timestamper *mii_ts,lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_RX_TIMESTAMP_EN , pkt_ts_enable);lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_TIMESTAMP_EN , pkt_ts_enable); - tx_mod =lanphy_read_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD );if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ONESTEP_SYNC ) { -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , - tx_mod |PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); +lanphy_modify_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , +PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ , +PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); }else if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ON ) { -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , - tx_mod & ~PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); +lanphy_modify_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , +PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ , +0 ); }if (config->rx_filter !=HWTSTAMP_FILTER_NONE )
@@ -3384,73 +3405,66 @@ static void lan8814_ptp_set_reload(struct phy_device *phydev, int event,static void lan8814_ptp_enable_event (struct phy_device *phydev,int event,int pulse_width) { -u16 val; - - val =lanphy_read_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG ); -/* Set the pulse width of the event */ - val &= ~(LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_MASK (event)); -/* Make sure that the target clock will be incremented each time when +/* Set the pulse width of the event, +* Make sure that the target clock will be incremented each time when * local time reaches or pass it +* Set the polarity high */ - val |=LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_SET (event, pulse_width); - val &= ~(LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event)); -/* Set the polarity high */ - val |=LAN8814_PTP_GENERAL_CONFIG_POLARITY_X (event); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , +LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_MASK (event) | +LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_SET (event, pulse_width) | +LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event) | +LAN8814_PTP_GENERAL_CONFIG_POLARITY_X (event), +LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_SET (event, pulse_width) | +LAN8814_PTP_GENERAL_CONFIG_POLARITY_X (event)); }static void lan8814_ptp_disable_event (struct phy_device *phydev,int event) { -u16 val; -/* Set target to too far in the future, effectively disabling it */ lan8814_ptp_set_target (phydev, event,0xFFFFFFFF ,0 );/* And then reload once it recheas the target */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG ); - val |=LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , +LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event), +LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event)); }static void lan8814_ptp_perout_off (struct phy_device *phydev,int pin) { -u16 val; -/* Disable gpio alternate function, * 1: select as gpio, * 0: select alt func */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin)); - val |=LAN8814_GPIO_EN_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +LAN8814_GPIO_EN_BIT (pin), +LAN8814_GPIO_EN_BIT (pin)); - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin)); - val &= ~LAN8814_GPIO_DIR_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +LAN8814_GPIO_DIR_BIT (pin), +0 ); - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin)); - val &= ~LAN8814_GPIO_BUF_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), +LAN8814_GPIO_BUF_BIT (pin), +0 ); }static void lan8814_ptp_perout_on (struct phy_device *phydev,int pin) { -int val; -/* Set as gpio output */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin)); - val |=LAN8814_GPIO_DIR_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +LAN8814_GPIO_DIR_BIT (pin), +LAN8814_GPIO_DIR_BIT (pin));/* Enable gpio 0:for alternate function, 1:gpio */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin)); - val &= ~LAN8814_GPIO_EN_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +LAN8814_GPIO_EN_BIT (pin), +0 );/* Set buffer type to push pull */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin)); - val |=LAN8814_GPIO_BUF_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), +LAN8814_GPIO_BUF_BIT (pin), +LAN8814_GPIO_BUF_BIT (pin)); } static int lan8814_ptp_perout(struct ptp_clock_info *ptpci,
@@ -3565,61 +3579,59 @@ static int lan8814_ptp_perout(struct ptp_clock_info *ptpci,static void lan8814_ptp_extts_on (struct phy_device *phydev,int pin,u32 flags) { -u16 tmp; -/* Set as gpio input */ - tmp =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin)); - tmp &= ~LAN8814_GPIO_DIR_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), tmp); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +LAN8814_GPIO_DIR_BIT (pin), +0 );/* Map the pin to ltc pin 0 of the capture map registers */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO ); - tmp |= pin; -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , + pin, + pin);/* Enable capture on the edges of the ltc pin */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_EN );if (flags &PTP_RISING_EDGE ) - tmp |=PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ), +PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ));if (flags &PTP_FALLING_EDGE ) - tmp |=PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ); -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ), +PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ));/* Enable interrupt top interrupt */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_COMMON_INT_ENA ); - tmp |=PTP_COMMON_INT_ENA_GPIO_CAP_EN ; -lanphy_write_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , +PTP_COMMON_INT_ENA_GPIO_CAP_EN , +PTP_COMMON_INT_ENA_GPIO_CAP_EN ); }static void lan8814_ptp_extts_off (struct phy_device *phydev,int pin) { -u16 tmp; -/* Set as gpio out */ - tmp =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin)); - tmp |=LAN8814_GPIO_DIR_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), tmp); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +LAN8814_GPIO_DIR_BIT (pin), +LAN8814_GPIO_DIR_BIT (pin));/* Enable alternate, 0:for alternate function, 1:gpio */ - tmp =lanphy_read_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin)); - tmp &= ~LAN8814_GPIO_EN_BIT (pin); -lanphy_write_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), tmp); +lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +LAN8814_GPIO_EN_BIT (pin), +0 );/* Clear the mapping of pin to registers 0 of the capture registers */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO ); - tmp &= ~GENMASK (3 ,0 ); -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , +GENMASK (3 ,0 ), +0 );/* Disable capture on both of the edges */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_EN ); - tmp &= ~PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (pin); - tmp &= ~PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (pin); -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (pin) | +PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (pin), +0 );/* Disable interrupt top interrupt */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_COMMON_INT_ENA ); - tmp &= ~PTP_COMMON_INT_ENA_GPIO_CAP_EN ; -lanphy_write_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , +PTP_COMMON_INT_ENA_GPIO_CAP_EN , +0 ); } static int lan8814_ptp_extts(struct ptp_clock_info *ptpci,
@@ -3859,9 +3871,9 @@ static int lan8814_gpio_process_cap(struct lan8814_shared_priv *shared)/* This is 0 because whatever was the input pin it was mapped it to * ltc gpio pin 0 */ - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_SEL ); - tmp |=PTP_GPIO_SEL_GPIO_SEL (0 ); -lanphy_write_page_reg (phydev,4 ,PTP_GPIO_SEL , tmp); +lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_SEL , +PTP_GPIO_SEL_GPIO_SEL (0 ), +PTP_GPIO_SEL_GPIO_SEL (0 )); tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_STS ); if (!(tmp & PTP_GPIO_CAP_STS_PTP_GPIO_RE_STS(0)) &&
@@ -3908,13 +3920,10 @@ static int lan8814_handle_gpio_interrupt(struct phy_device *phydev, u16 status)static int lan8804_config_init (struct phy_device *phydev) { -int val; -/* MDI-X setting for swap A,B transmit */ - val =lanphy_read_page_reg (phydev,2 ,LAN8804_ALIGN_SWAP ); - val &= ~LAN8804_ALIGN_TX_A_B_SWAP_MASK ; - val |=LAN8804_ALIGN_TX_A_B_SWAP ; -lanphy_write_page_reg (phydev,2 ,LAN8804_ALIGN_SWAP , val); +lanphy_modify_page_reg (phydev,2 ,LAN8804_ALIGN_SWAP , +LAN8804_ALIGN_TX_A_B_SWAP_MASK , +LAN8804_ALIGN_TX_A_B_SWAP );/* Make sure that the PHY will not stop generating the clock when the * link partner goes down
@@ -4056,7 +4065,6 @@ static void lan8814_ptp_init(struct phy_device *phydev) {struct kszphy_priv *priv = phydev->priv;struct kszphy_ptp_priv *ptp_priv = &priv->ptp_priv; -u32 temp;if (!IS_ENABLED (CONFIG_PTP_1588_CLOCK ) || !IS_ENABLED (CONFIG_NETWORK_PHY_TIMESTAMPING ))
@@ -4064,13 +4072,13 @@ static void lan8814_ptp_init(struct phy_device *phydev)lanphy_write_page_reg (phydev,5 ,TSU_HARD_RESET ,TSU_HARD_RESET_ ); - temp =lanphy_read_page_reg (phydev,5 ,PTP_TX_MOD ); - temp |=PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ; -lanphy_write_page_reg (phydev,5 ,PTP_TX_MOD , temp); +lanphy_modify_page_reg (phydev,5 ,PTP_TX_MOD , +PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ , +PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ); - temp =lanphy_read_page_reg (phydev,5 ,PTP_RX_MOD ); - temp |=PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ; -lanphy_write_page_reg (phydev,5 ,PTP_RX_MOD , temp); +lanphy_modify_page_reg (phydev,5 ,PTP_RX_MOD , +PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ , +PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ );lanphy_write_page_reg (phydev,5 ,PTP_RX_PARSE_CONFIG ,0 );lanphy_write_page_reg (phydev,5 ,PTP_TX_PARSE_CONFIG ,0 );
@@ -4196,23 +4204,21 @@ static void lan8814_setup_led(struct phy_device *phydev, int val)static int lan8814_config_init (struct phy_device *phydev) {struct kszphy_priv *lan8814 = phydev->priv; -int val;/* Reset the PHY */ - val =lanphy_read_page_reg (phydev,4 ,LAN8814_QSGMII_SOFT_RESET ); - val |=LAN8814_QSGMII_SOFT_RESET_BIT ; -lanphy_write_page_reg (phydev,4 ,LAN8814_QSGMII_SOFT_RESET , val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_QSGMII_SOFT_RESET , +LAN8814_QSGMII_SOFT_RESET_BIT , +LAN8814_QSGMII_SOFT_RESET_BIT );/* Disable ANEG with QSGMII PCS Host side */ - val =lanphy_read_page_reg (phydev,5 ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG ); - val &= ~LAN8814_QSGMII_PCS1G_ANEG_CONFIG_ANEG_ENA ; -lanphy_write_page_reg (phydev,5 ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG , val); +lanphy_modify_page_reg (phydev,4 ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG , +LAN8814_QSGMII_PCS1G_ANEG_CONFIG_ANEG_ENA , +0 );/* MDI-X setting for swap A,B transmit */ - val =lanphy_read_page_reg (phydev,2 ,LAN8814_ALIGN_SWAP ); - val &= ~LAN8814_ALIGN_TX_A_B_SWAP_MASK ; - val |=LAN8814_ALIGN_TX_A_B_SWAP ; -lanphy_write_page_reg (phydev,2 ,LAN8814_ALIGN_SWAP , val); +lanphy_modify_page_reg (phydev,2 ,LAN8814_ALIGN_SWAP , +LAN8814_ALIGN_TX_A_B_SWAP_MASK , +LAN8814_ALIGN_TX_A_B_SWAP );if (lan8814->led_mode >=0 )lan8814_setup_led (phydev, lan8814->led_mode);
@@ -4243,29 +4249,24 @@ static int lan8814_release_coma_mode(struct phy_device *phydev)static void lan8814_clear_2psp_bit (struct phy_device *phydev) { -u16 val; -/* It was noticed that when traffic is passing through the PHY and the * cable is removed then the LED was still one even though there is no * link */ - val =lanphy_read_page_reg (phydev,2 ,LAN8814_EEE_STATE ); - val &= ~LAN8814_EEE_STATE_MASK2P5P ; -lanphy_write_page_reg (phydev,2 ,LAN8814_EEE_STATE , val); +lanphy_modify_page_reg (phydev,2 ,LAN8814_EEE_STATE , +LAN8814_EEE_STATE_MASK2P5P , +0 ); }static void lan8814_update_meas_time (struct phy_device *phydev) { -u16 val; -/* By setting the measure time to a value of 0xb this will allow cables * longer than 100m to be used. This configuration can be used * regardless of the mode of operation of the PHY */ - val =lanphy_read_page_reg (phydev,1 ,LAN8814_PD_CONTROLS ); - val &= ~LAN8814_PD_CONTROLS_PD_MEAS_TIME_MASK ; - val |=LAN8814_PD_CONTROLS_PD_MEAS_TIME_VAL ; -lanphy_write_page_reg (phydev,1 ,LAN8814_PD_CONTROLS , val); +lanphy_modify_page_reg (phydev,1 ,LAN8814_PD_CONTROLS , +LAN8814_PD_CONTROLS_PD_MEAS_TIME_MASK , +LAN8814_PD_CONTROLS_PD_MEAS_TIME_VAL ); }static int lan8814_probe (struct phy_device *phydev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/247 net: phy: micrel: Replace hardcoded pages with defines
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit d471793a9b67bbe3d7198ff695004190fd7b6bc7 ]
The functions lan_*_page_reg gets as a second parameter the page where the register is. In all the functions the page was hardcoded. Replace the hardcoded values with defines to make it more clear what are those parameters.
Stable-dep-of: 96a9178a29a6 ("net: phy: micrel: lan8814 fix reset of the QSGMII interface")
--- drivers/net/phy/micrel.c | 342 ++++++++++++++++++++++++++------------- 1 file changed, 233 insertions(+), 109 deletions(-)
drivers/net/phy/micrel.c +233 -109
@@ -2790,6 +2790,52 @@ static int ksz886x_cable_test_get_status(struct phy_device *phydev,return ret; } +/** +* LAN8814_PAGE_AFE_PMA - Selects Extended Page 1. +* +* This page appears to control the Analog Front-End (AFE) and Physical +* Medium Attachment (PMA) layers. It is used to access registers like +* LAN8814_PD_CONTROLS and LAN8814_LINK_QUALITY. +*/ +#define LAN8814_PAGE_AFE_PMA 1 + +/** +* LAN8814_PAGE_PCS_DIGITAL - Selects Extended Page 2. +* +* This page seems dedicated to the Physical Coding Sublayer (PCS) and other +* digital logic. It is used for MDI-X alignment (LAN8814_ALIGN_SWAP) and EEE +* state (LAN8814_EEE_STATE) in the LAN8814, and is repurposed for statistics +* and self-test counters in the LAN8842. +*/ +#define LAN8814_PAGE_PCS_DIGITAL 2 + +/** +* LAN8814_PAGE_COMMON_REGS - Selects Extended Page 4. +* +* This page contains device-common registers that affect the entire chip. +* It includes controls for chip-level resets, strap status, GPIO, +* QSGMII, the shared 1588 PTP block, and the PVT monitor. +*/ +#define LAN8814_PAGE_COMMON_REGS 4 + +/** +* LAN8814_PAGE_PORT_REGS - Selects Extended Page 5. +* +* This page contains port-specific registers that must be accessed +* on a per-port basis. It includes controls for port LEDs, QSGMII PCS, +* rate adaptation FIFOs, and the per-port 1588 TSU block. +*/ +#define LAN8814_PAGE_PORT_REGS 5 + +/** +* LAN8814_PAGE_SYSTEM_CTRL - Selects Extended Page 31. +* +* This page appears to hold fundamental system or global controls. In the +* driver, it is used by the related LAN8804 to access the +* LAN8814_CLOCK_MANAGEMENT register. +*/ +#define LAN8814_PAGE_SYSTEM_CTRL 31 +#define LAN_EXT_PAGE_ACCESS_CONTROL 0x16#define LAN_EXT_PAGE_ACCESS_ADDRESS_DATA 0x17#define LAN_EXT_PAGE_ACCESS_CTRL_EP_FUNC 0x4000
@@ -2871,35 +2917,46 @@ static int lan8814_config_ts_intr(struct phy_device *phydev, bool enable)PTP_TSU_INT_EN_PTP_RX_TS_EN_ |PTP_TSU_INT_EN_PTP_RX_TS_OVRFL_EN_ ; -return lanphy_write_page_reg (phydev,5 ,PTP_TSU_INT_EN , val); +return lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TSU_INT_EN , val); }static void lan8814_ptp_rx_ts_get (struct phy_device *phydev,u32 *seconds,u32 *nano_seconds,u16 *seq_id) { - *seconds =lanphy_read_page_reg (phydev,5 ,PTP_RX_INGRESS_SEC_HI ); + *seconds =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_INGRESS_SEC_HI ); *seconds = (*seconds <<16 ) | -lanphy_read_page_reg (phydev,5 ,PTP_RX_INGRESS_SEC_LO ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_INGRESS_SEC_LO ); - *nano_seconds =lanphy_read_page_reg (phydev,5 ,PTP_RX_INGRESS_NS_HI ); + *nano_seconds =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_INGRESS_NS_HI ); *nano_seconds = ((*nano_seconds &0x3fff ) <<16 ) | -lanphy_read_page_reg (phydev,5 ,PTP_RX_INGRESS_NS_LO ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_INGRESS_NS_LO ); - *seq_id =lanphy_read_page_reg (phydev,5 ,PTP_RX_MSG_HEADER2 ); + *seq_id =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_MSG_HEADER2 ); }static void lan8814_ptp_tx_ts_get (struct phy_device *phydev,u32 *seconds,u32 *nano_seconds,u16 *seq_id) { - *seconds =lanphy_read_page_reg (phydev,5 ,PTP_TX_EGRESS_SEC_HI ); + *seconds =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_EGRESS_SEC_HI ); *seconds = *seconds <<16 | -lanphy_read_page_reg (phydev,5 ,PTP_TX_EGRESS_SEC_LO ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_EGRESS_SEC_LO ); - *nano_seconds =lanphy_read_page_reg (phydev,5 ,PTP_TX_EGRESS_NS_HI ); + *nano_seconds =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_EGRESS_NS_HI ); *nano_seconds = ((*nano_seconds &0x3fff ) <<16 ) | -lanphy_read_page_reg (phydev,5 ,PTP_TX_EGRESS_NS_LO ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_EGRESS_NS_LO ); - *seq_id =lanphy_read_page_reg (phydev,5 ,PTP_TX_MSG_HEADER2 ); + *seq_id =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_MSG_HEADER2 ); }static int lan8814_ts_info (struct mii_timestamper *mii_ts,struct kernel_ethtool_ts_info *info)
@@ -2933,11 +2990,11 @@ static void lan8814_flush_fifo(struct phy_device *phydev, bool egress)int i;for (i =0 ; i <FIFO_SIZE ; ++i) -lanphy_read_page_reg (phydev,5 , +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , egress ?PTP_TX_MSG_HEADER2 :PTP_RX_MSG_HEADER2 );/* Read to clear overflow status bit */ -lanphy_read_page_reg (phydev,5 ,PTP_TSU_INT_STS ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_TSU_INT_STS ); } static int lan8814_hwtstamp(struct mii_timestamper *mii_ts,
@@ -2987,20 +3044,26 @@ static int lan8814_hwtstamp(struct mii_timestamper *mii_ts, rxcfg |=PTP_RX_PARSE_CONFIG_IPV4_EN_ |PTP_RX_PARSE_CONFIG_IPV6_EN_ ; txcfg |=PTP_TX_PARSE_CONFIG_IPV4_EN_ |PTP_TX_PARSE_CONFIG_IPV6_EN_ ; } -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_RX_PARSE_CONFIG , rxcfg); -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_PARSE_CONFIG , txcfg); +lanphy_write_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_PARSE_CONFIG , rxcfg); +lanphy_write_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_PARSE_CONFIG , txcfg); pkt_ts_enable =PTP_TIMESTAMP_EN_SYNC_ |PTP_TIMESTAMP_EN_DREQ_ |PTP_TIMESTAMP_EN_PDREQ_ |PTP_TIMESTAMP_EN_PDRES_ ; -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_RX_TIMESTAMP_EN , pkt_ts_enable); -lanphy_write_page_reg (ptp_priv->phydev,5 ,PTP_TX_TIMESTAMP_EN , pkt_ts_enable); +lanphy_write_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_TIMESTAMP_EN , pkt_ts_enable); +lanphy_write_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_TIMESTAMP_EN , pkt_ts_enable);if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ONESTEP_SYNC ) { -lanphy_modify_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , +lanphy_modify_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_MOD ,PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ,PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ); }else if (ptp_priv->hwts_tx_type ==HWTSTAMP_TX_ON ) { -lanphy_modify_page_reg (ptp_priv->phydev,5 ,PTP_TX_MOD , +lanphy_modify_page_reg (ptp_priv->phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_MOD ,PTP_TX_MOD_TX_PTP_SYNC_TS_INSERT_ ,0 ); }
@@ -3124,29 +3187,41 @@ static bool lan8814_rxtstamp(struct mii_timestamper *mii_ts, struct sk_buff *skbstatic void lan8814_ptp_clock_set (struct phy_device *phydev,time64_t sec,u32 nsec) { -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_SEC_LO ,lower_16_bits (sec)); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_SEC_MID ,upper_16_bits (sec)); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_SEC_HI ,upper_32_bits (sec)); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_NS_LO ,lower_16_bits (nsec)); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_SET_NS_HI ,upper_16_bits (nsec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_SEC_LO ,lower_16_bits (sec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_SEC_MID ,upper_16_bits (sec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_SEC_HI ,upper_32_bits (sec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_NS_LO ,lower_16_bits (nsec)); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_SET_NS_HI ,upper_16_bits (nsec)); -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL ,PTP_CMD_CTL_PTP_CLOCK_LOAD_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CMD_CTL , +PTP_CMD_CTL_PTP_CLOCK_LOAD_ ); }static void lan8814_ptp_clock_get (struct phy_device *phydev,time64_t *sec,u32 *nsec) { -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL ,PTP_CMD_CTL_PTP_CLOCK_READ_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CMD_CTL , +PTP_CMD_CTL_PTP_CLOCK_READ_ ); - *sec =lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_SEC_HI ); + *sec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_SEC_HI ); *sec <<=16 ; - *sec |=lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_SEC_MID ); + *sec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_SEC_MID ); *sec <<=16 ; - *sec |=lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_SEC_LO ); + *sec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_SEC_LO ); - *nsec =lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_NS_HI ); + *nsec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_NS_HI ); *nsec <<=16 ; - *nsec |=lanphy_read_page_reg (phydev,4 ,PTP_CLOCK_READ_NS_LO ); + *nsec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CLOCK_READ_NS_LO ); } static int lan8814_ptpci_gettime64(struct ptp_clock_info *ptpci,
@@ -3185,14 +3260,18 @@ static void lan8814_ptp_set_target(struct phy_device *phydev, int event, s64 start_sec, u32 start_nsec) {/* Set the start time */ - lanphy_write_page_reg(phydev, 4, LAN8814_PTP_CLOCK_TARGET_SEC_LO(event), +lanphy_write_page_reg (phydev ,LAN8814_PAGE_COMMON_REGS , +LAN8814_PTP_CLOCK_TARGET_SEC_LO (event ),lower_16_bits (start_sec )); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_CLOCK_TARGET_SEC_HI (event), +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_PTP_CLOCK_TARGET_SEC_HI (event),upper_16_bits (start_sec)); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_CLOCK_TARGET_NS_LO (event), +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_PTP_CLOCK_TARGET_NS_LO (event),lower_16_bits (start_nsec)); -lanphy_write_page_reg (phydev,4 ,LAN8814_PTP_CLOCK_TARGET_NS_HI (event), +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_PTP_CLOCK_TARGET_NS_HI (event),upper_16_bits (start_nsec) &0x3fff ); }
@@ -3290,9 +3369,11 @@ static void lan8814_ptp_clock_step(struct phy_device *phydev, adjustment_value_lo = adjustment_value &0xffff ; adjustment_value_hi = (adjustment_value >>16 ) &0x3fff ; -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_LO , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_LO , adjustment_value_lo); -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_HI , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_HI ,PTP_LTC_STEP_ADJ_DIR_ | adjustment_value_hi); seconds -= ((s32 )adjustment_value);
@@ -3310,9 +3391,11 @@ static void lan8814_ptp_clock_step(struct phy_device *phydev, adjustment_value_lo = adjustment_value &0xffff ; adjustment_value_hi = (adjustment_value >>16 ) &0x3fff ; -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_LO , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_LO , adjustment_value_lo); -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_HI , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_HI , adjustment_value_hi); seconds += ((s32 )adjustment_value);
@@ -3320,8 +3403,8 @@ static void lan8814_ptp_clock_step(struct phy_device *phydev, set_seconds += adjustment_value;lan8814_ptp_update_target (phydev, set_seconds); } -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL , -PTP_CMD_CTL_PTP_LTC_STEP_SEC_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_CMD_CTL ,PTP_CMD_CTL_PTP_LTC_STEP_SEC_ ); }if (nano_seconds) {u16 nano_seconds_lo;
@@ -3330,12 +3413,14 @@ static void lan8814_ptp_clock_step(struct phy_device *phydev, nano_seconds_lo = nano_seconds &0xffff ; nano_seconds_hi = (nano_seconds >>16 ) &0x3fff ; -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_LO , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_LO , nano_seconds_lo); -lanphy_write_page_reg (phydev,4 ,PTP_LTC_STEP_ADJ_HI , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_LTC_STEP_ADJ_HI ,PTP_LTC_STEP_ADJ_DIR_ | nano_seconds_hi); -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CMD_CTL ,PTP_CMD_CTL_PTP_LTC_STEP_NSEC_ ); } }
@@ -3377,8 +3462,10 @@ static int lan8814_ptpci_adjfine(struct ptp_clock_info *ptpci, long scaled_ppm) kszphy_rate_adj_hi |=PTP_CLOCK_RATE_ADJ_DIR_ ;mutex_lock (&shared->shared_lock); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_RATE_ADJ_HI , kszphy_rate_adj_hi); -lanphy_write_page_reg (phydev,4 ,PTP_CLOCK_RATE_ADJ_LO , kszphy_rate_adj_lo); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CLOCK_RATE_ADJ_HI , + kszphy_rate_adj_hi); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CLOCK_RATE_ADJ_LO , + kszphy_rate_adj_lo);mutex_unlock (&shared->shared_lock);return 0 ;
@@ -3387,17 +3474,17 @@ static int lan8814_ptpci_adjfine(struct ptp_clock_info *ptpci, long scaled_ppm)static void lan8814_ptp_set_reload (struct phy_device *phydev,int event,s64 period_sec,u32 period_nsec) { -lanphy_write_page_reg (phydev,4 , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_CLOCK_TARGET_RELOAD_SEC_LO (event),lower_16_bits (period_sec)); -lanphy_write_page_reg (phydev,4 , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_CLOCK_TARGET_RELOAD_SEC_HI (event),upper_16_bits (period_sec)); -lanphy_write_page_reg (phydev,4 , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_CLOCK_TARGET_RELOAD_NS_LO (event),lower_16_bits (period_nsec)); -lanphy_write_page_reg (phydev,4 , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_CLOCK_TARGET_RELOAD_NS_HI (event),upper_16_bits (period_nsec) &0x3fff ); }
@@ -3410,7 +3497,7 @@ static void lan8814_ptp_enable_event(struct phy_device *phydev, int event,* local time reaches or pass it * Set the polarity high */ - lanphy_modify_page_reg(phydev, 4, LAN8814_PTP_GENERAL_CONFIG, + lanphy_modify_page_reg(phydev, LAN8814_PAGE_COMMON_REGS, LAN8814_PTP_GENERAL_CONFIG, LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_MASK(event) | LAN8814_PTP_GENERAL_CONFIG_LTC_EVENT_SET(event, pulse_width) | LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X(event) |
@@ -3425,7 +3512,7 @@ static void lan8814_ptp_disable_event(struct phy_device *phydev, int event)lan8814_ptp_set_target (phydev, event,0xFFFFFFFF ,0 );/* And then reload once it recheas the target */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_PTP_GENERAL_CONFIG , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_PTP_GENERAL_CONFIG ,LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event),LAN8814_PTP_GENERAL_CONFIG_RELOAD_ADD_X (event)); }
@@ -3436,15 +3523,18 @@ static void lan8814_ptp_perout_off(struct phy_device *phydev, int pin)* 1: select as gpio, * 0: select alt func */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_EN_ADDR (pin),LAN8814_GPIO_EN_BIT (pin),LAN8814_GPIO_EN_BIT (pin)); -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_DIR_ADDR (pin),LAN8814_GPIO_DIR_BIT (pin),0 ); -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_BUF_ADDR (pin),LAN8814_GPIO_BUF_BIT (pin),0 ); }
@@ -3452,17 +3542,20 @@ static void lan8814_ptp_perout_off(struct phy_device *phydev, int pin)static void lan8814_ptp_perout_on (struct phy_device *phydev,int pin) {/* Set as gpio output */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_DIR_ADDR (pin),LAN8814_GPIO_DIR_BIT (pin),LAN8814_GPIO_DIR_BIT (pin));/* Enable gpio 0:for alternate function, 1:gpio */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_EN_ADDR (pin),LAN8814_GPIO_EN_BIT (pin),0 );/* Set buffer type to push pull */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_BUF_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_BUF_ADDR (pin),LAN8814_GPIO_BUF_BIT (pin),LAN8814_GPIO_BUF_BIT (pin)); }
@@ -3580,27 +3673,29 @@ static int lan8814_ptp_perout(struct ptp_clock_info *ptpci,static void lan8814_ptp_extts_on (struct phy_device *phydev,int pin,u32 flags) {/* Set as gpio input */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_DIR_ADDR (pin),LAN8814_GPIO_DIR_BIT (pin),0 );/* Map the pin to ltc pin 0 of the capture map registers */ -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , - pin, - pin); +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_MAP_LO , pin, pin);/* Enable capture on the edges of the ltc pin */ if (flags &PTP_RISING_EDGE ) -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_EN ,PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ),PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (0 ));if (flags &PTP_FALLING_EDGE ) -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_EN ,PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ),PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (0 ));/* Enable interrupt top interrupt */ -lanphy_modify_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_COMMON_INT_ENA ,PTP_COMMON_INT_ENA_GPIO_CAP_EN ,PTP_COMMON_INT_ENA_GPIO_CAP_EN ); }
@@ -3608,28 +3703,31 @@ static void lan8814_ptp_extts_on(struct phy_device *phydev, int pin, u32 flags)static void lan8814_ptp_extts_off (struct phy_device *phydev,int pin) {/* Set as gpio out */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_DIR_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_DIR_ADDR (pin),LAN8814_GPIO_DIR_BIT (pin),LAN8814_GPIO_DIR_BIT (pin));/* Enable alternate, 0:for alternate function, 1:gpio */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_GPIO_EN_ADDR (pin), +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_GPIO_EN_ADDR (pin),LAN8814_GPIO_EN_BIT (pin),0 );/* Clear the mapping of pin to registers 0 of the capture registers */ -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_MAP_LO , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_MAP_LO ,GENMASK (3 ,0 ),0 );/* Disable capture on both of the edges */ -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_CAP_EN , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_GPIO_CAP_EN ,PTP_GPIO_CAP_EN_GPIO_RE_CAPTURE_ENABLE (pin) |PTP_GPIO_CAP_EN_GPIO_FE_CAPTURE_ENABLE (pin),0 );/* Disable interrupt top interrupt */ -lanphy_modify_page_reg (phydev,4 ,PTP_COMMON_INT_ENA , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_COMMON_INT_ENA ,PTP_COMMON_INT_ENA_GPIO_CAP_EN ,0 ); }
@@ -3761,7 +3859,8 @@ static void lan8814_get_tx_ts(struct kszphy_ptp_priv *ptp_priv)/* If other timestamps are available in the FIFO, * process them. */ - reg =lanphy_read_page_reg (phydev,5 ,PTP_CAP_INFO ); + reg =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_CAP_INFO ); }while (PTP_CAP_INFO_TX_TS_CNT_GET_ (reg) >0 ); }
@@ -3834,7 +3933,8 @@ static void lan8814_get_rx_ts(struct kszphy_ptp_priv *ptp_priv)/* If other timestamps are available in the FIFO, * process them. */ - reg =lanphy_read_page_reg (phydev,5 ,PTP_CAP_INFO ); + reg =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_CAP_INFO ); }while (PTP_CAP_INFO_RX_TS_CNT_GET_ (reg) >0 ); }
@@ -3871,31 +3971,40 @@ static int lan8814_gpio_process_cap(struct lan8814_shared_priv *shared)/* This is 0 because whatever was the input pin it was mapped it to * ltc gpio pin 0 */ -lanphy_modify_page_reg (phydev,4 ,PTP_GPIO_SEL , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_GPIO_SEL ,PTP_GPIO_SEL_GPIO_SEL (0 ),PTP_GPIO_SEL_GPIO_SEL (0 )); - tmp =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_CAP_STS ); + tmp =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_CAP_STS );if (!(tmp &PTP_GPIO_CAP_STS_PTP_GPIO_RE_STS (0 )) && !(tmp &PTP_GPIO_CAP_STS_PTP_GPIO_FE_STS (0 )))return -1 ;if (tmp &BIT (0 )) { - sec =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_SEC_HI_CAP ); + sec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_SEC_HI_CAP ); sec <<=16 ; - sec |=lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_SEC_LO_CAP ); + sec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_SEC_LO_CAP ); - nsec =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_NS_HI_CAP ) &0x3fff ; + nsec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_NS_HI_CAP ) &0x3fff ; nsec <<=16 ; - nsec |=lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_NS_LO_CAP ); + nsec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_NS_LO_CAP ); }else { - sec =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_FE_LTC_SEC_HI_CAP ); + sec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_FE_LTC_SEC_HI_CAP ); sec <<=16 ; - sec |=lanphy_read_page_reg (phydev,4 ,PTP_GPIO_FE_LTC_SEC_LO_CAP ); + sec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_FE_LTC_SEC_LO_CAP ); - nsec =lanphy_read_page_reg (phydev,4 ,PTP_GPIO_FE_LTC_NS_HI_CAP ) &0x3fff ; + nsec =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_FE_LTC_NS_HI_CAP ) &0x3fff ; nsec <<=16 ; - nsec |=lanphy_read_page_reg (phydev,4 ,PTP_GPIO_RE_LTC_NS_LO_CAP ); + nsec |=lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +PTP_GPIO_RE_LTC_NS_LO_CAP ); } ptp_event.index =0 ;
@@ -3921,15 +4030,16 @@ static int lan8814_handle_gpio_interrupt(struct phy_device *phydev, u16 status)static int lan8804_config_init (struct phy_device *phydev) {/* MDI-X setting for swap A,B transmit */ -lanphy_modify_page_reg (phydev,2 ,LAN8804_ALIGN_SWAP , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PCS_DIGITAL ,LAN8804_ALIGN_SWAP ,LAN8804_ALIGN_TX_A_B_SWAP_MASK ,LAN8804_ALIGN_TX_A_B_SWAP );/* Make sure that the PHY will not stop generating the clock when the * link partner goes down */ -lanphy_write_page_reg (phydev,31 ,LAN8814_CLOCK_MANAGEMENT ,0x27e ); -lanphy_read_page_reg (phydev,1 ,LAN8814_LINK_QUALITY ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_SYSTEM_CTRL , +LAN8814_CLOCK_MANAGEMENT ,0x27e ); +lanphy_read_page_reg (phydev,LAN8814_PAGE_AFE_PMA ,LAN8814_LINK_QUALITY );return 0 ; }
@@ -4011,7 +4121,8 @@ static irqreturn_t lan8814_handle_interrupt(struct phy_device *phydev) }while (true) { - irq_status =lanphy_read_page_reg (phydev,5 ,PTP_TSU_INT_STS ); + irq_status =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TSU_INT_STS );if (!irq_status)break ;
@@ -4039,7 +4150,7 @@ static int lan8814_config_intr(struct phy_device *phydev) {int err; -lanphy_write_page_reg (phydev,4 ,LAN8814_INTR_CTRL_REG , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,LAN8814_INTR_CTRL_REG ,LAN8814_INTR_CTRL_REG_POLARITY |LAN8814_INTR_CTRL_REG_INTR_ENABLE );
@@ -4070,29 +4181,36 @@ static void lan8814_ptp_init(struct phy_device *phydev) !IS_ENABLED(CONFIG_NETWORK_PHY_TIMESTAMPING)) return; -lanphy_write_page_reg (phydev,5 ,TSU_HARD_RESET ,TSU_HARD_RESET_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +TSU_HARD_RESET ,TSU_HARD_RESET_ ); -lanphy_modify_page_reg (phydev,5 ,PTP_TX_MOD , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_TX_MOD ,PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ,PTP_TX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ); -lanphy_modify_page_reg (phydev,5 ,PTP_RX_MOD , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_RX_MOD ,PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ,PTP_RX_MOD_BAD_UDPV4_CHKSUM_FORCE_FCS_DIS_ ); -lanphy_write_page_reg (phydev,5 ,PTP_RX_PARSE_CONFIG ,0 ); -lanphy_write_page_reg (phydev,5 ,PTP_TX_PARSE_CONFIG ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_PARSE_CONFIG ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_PARSE_CONFIG ,0 );/* Removing default registers configs related to L2 and IP */ -lanphy_write_page_reg (phydev,5 ,PTP_TX_PARSE_L2_ADDR_EN ,0 ); -lanphy_write_page_reg (phydev,5 ,PTP_RX_PARSE_L2_ADDR_EN ,0 ); -lanphy_write_page_reg (phydev,5 ,PTP_TX_PARSE_IP_ADDR_EN ,0 ); -lanphy_write_page_reg (phydev,5 ,PTP_RX_PARSE_IP_ADDR_EN ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_PARSE_L2_ADDR_EN ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_PARSE_L2_ADDR_EN ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_TX_PARSE_IP_ADDR_EN ,0 ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +PTP_RX_PARSE_IP_ADDR_EN ,0 );/* Disable checking for minorVersionPTP field */ -lanphy_write_page_reg (phydev,5 ,PTP_RX_VERSION , +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_RX_VERSION ,PTP_MAX_VERSION (0xff ) |PTP_MIN_VERSION (0x0 )); -lanphy_write_page_reg (phydev,5 ,PTP_TX_VERSION , +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS ,PTP_TX_VERSION ,PTP_MAX_VERSION (0xff ) |PTP_MIN_VERSION (0x0 ));skb_queue_head_init (&ptp_priv->tx_queue);
@@ -4177,12 +4295,14 @@ static int lan8814_ptp_probe_once(struct phy_device *phydev)/* The EP.4 is shared between all the PHYs in the package and also it * can be accessed by any of the PHYs */ -lanphy_write_page_reg (phydev,4 ,LTC_HARD_RESET ,LTC_HARD_RESET_ ); -lanphy_write_page_reg (phydev,4 ,PTP_OPERATING_MODE , +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LTC_HARD_RESET ,LTC_HARD_RESET_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_OPERATING_MODE ,PTP_OPERATING_MODE_STANDALONE_ );/* Enable ptp to run LTC clock for ptp and gpio 1PPS operation */ -lanphy_write_page_reg (phydev,4 ,PTP_CMD_CTL ,PTP_CMD_CTL_PTP_ENABLE_ ); +lanphy_write_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,PTP_CMD_CTL , +PTP_CMD_CTL_PTP_ENABLE_ );return 0 ; }
@@ -4191,14 +4311,16 @@ static void lan8814_setup_led(struct phy_device *phydev, int val) {int temp; - temp =lanphy_read_page_reg (phydev,5 ,LAN8814_LED_CTRL_1 ); + temp =lanphy_read_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +LAN8814_LED_CTRL_1 );if (val) temp |=LAN8814_LED_CTRL_1_KSZ9031_LED_MODE_ ;else temp &= ~LAN8814_LED_CTRL_1_KSZ9031_LED_MODE_ ; -lanphy_write_page_reg (phydev,5 ,LAN8814_LED_CTRL_1 , temp); +lanphy_write_page_reg (phydev,LAN8814_PAGE_PORT_REGS , +LAN8814_LED_CTRL_1 , temp); }static int lan8814_config_init (struct phy_device *phydev)
@@ -4206,17 +4328,19 @@ static int lan8814_config_init(struct phy_device *phydev)struct kszphy_priv *lan8814 = phydev->priv;/* Reset the PHY */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_QSGMII_SOFT_RESET , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_QSGMII_SOFT_RESET ,LAN8814_QSGMII_SOFT_RESET_BIT ,LAN8814_QSGMII_SOFT_RESET_BIT );/* Disable ANEG with QSGMII PCS Host side */ -lanphy_modify_page_reg (phydev,4 ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_QSGMII_PCS1G_ANEG_CONFIG ,LAN8814_QSGMII_PCS1G_ANEG_CONFIG_ANEG_ENA ,0 );/* MDI-X setting for swap A,B transmit */ -lanphy_modify_page_reg (phydev,2 ,LAN8814_ALIGN_SWAP , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PCS_DIGITAL ,LAN8814_ALIGN_SWAP ,LAN8814_ALIGN_TX_A_B_SWAP_MASK ,LAN8814_ALIGN_TX_A_B_SWAP );
@@ -4253,7 +4377,7 @@ static void lan8814_clear_2psp_bit(struct phy_device *phydev)* cable is removed then the LED was still one even though there is no * link */ -lanphy_modify_page_reg (phydev,2 ,LAN8814_EEE_STATE , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_PCS_DIGITAL ,LAN8814_EEE_STATE ,LAN8814_EEE_STATE_MASK2P5P ,0 ); }
@@ -4264,7 +4388,7 @@ static void lan8814_update_meas_time(struct phy_device *phydev)* longer than 100m to be used. This configuration can be used * regardless of the mode of operation of the PHY */ -lanphy_modify_page_reg (phydev,1 ,LAN8814_PD_CONTROLS , +lanphy_modify_page_reg (phydev,LAN8814_PAGE_AFE_PMA ,LAN8814_PD_CONTROLS ,LAN8814_PD_CONTROLS_PD_MEAS_TIME_MASK ,LAN8814_PD_CONTROLS_PD_MEAS_TIME_VAL ); }
@@ -4289,7 +4413,7 @@ static int lan8814_probe(struct phy_device *phydev)/* Strap-in value for PHY address, below register read gives starting * phy address value */ - addr =lanphy_read_page_reg (phydev,4 ,0 ) &0x1F ; + addr =lanphy_read_page_reg (phydev,LAN8814_PAGE_COMMON_REGS ,0 ) &0x1F ;devm_phy_package_join (&phydev->mdio.dev, phydev, addr,sizeof (struct lan8814_shared_priv ));
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/247 net: phy: micrel: lan8814 fix reset of the QSGMII interface
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit 96a9178a29a6b84bb632ebeb4e84cf61191c73d5 ]
The lan8814 is a quad-phy and it is using QSGMII towards the MAC. The problem is that everytime when one of the ports is configured then the PCS is reseted for all the PHYs. Meaning that the other ports can loose traffic until the link is establish again.
To fix this, do the reset one time for the entire PHY package.
--- drivers/net/phy/micrel.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/phy/micrel.c +6 -6
@@ -4327,12 +4327,6 @@ static int lan8814_config_init(struct phy_device *phydev) {struct kszphy_priv *lan8814 = phydev->priv; -/* Reset the PHY */ -lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , -LAN8814_QSGMII_SOFT_RESET , -LAN8814_QSGMII_SOFT_RESET_BIT , -LAN8814_QSGMII_SOFT_RESET_BIT ); -/* Disable ANEG with QSGMII PCS Host side */ lanphy_modify_page_reg(phydev, LAN8814_PAGE_COMMON_REGS, LAN8814_QSGMII_PCS1G_ANEG_CONFIG,
@@ -4418,6 +4412,12 @@ static int lan8814_probe(struct phy_device *phydev) addr, sizeof(struct lan8814_shared_priv));if (phy_package_init_once (phydev)) { +/* Reset the PHY */ +lanphy_modify_page_reg (phydev,LAN8814_PAGE_COMMON_REGS , +LAN8814_QSGMII_SOFT_RESET , +LAN8814_QSGMII_SOFT_RESET_BIT , +LAN8814_QSGMII_SOFT_RESET_BIT ); + err =lan8814_release_coma_mode (phydev);if (err)return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 53/247 rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <[email protected]>
[ Upstream commit fe4b3a34e9a9654d98d274218dac0270779db0ae ]
It's used to work around an objtool issue since commit abb2a5572264 ("LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference"), but it's then passed to bindgen and cause an error because Clang does not have this option.
--- rust/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
rust/Makefile +1 -1
@@ -299,7 +299,7 @@ bindgen_skip_c_flags := -mno-fp-ret-in-387 -mpreferred-stack-boundary=% \ -fno-inline-functions-called-once -fsanitize=bounds-strict \ -fstrict-flex-arrays=% -fmin-function-alignment=% \ -fzero-init-padding-bits=% -mno-fdpic \ - --param=% --param asan-% + --param=% --param asan-% -fno-isolate-erroneous-paths-dereference # Derived from `scripts/Makefile.clang`. BINDGEN_TARGET_x86 := x86_64-linux-gnu
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 54/247 NFSD: Skip close replay processing if XDR encoding fails
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit ff8141e49cf70d2d093a5228f5299ce188de6142 ]
The replay logic added by commit 9411b1d4c7df ("nfsd4: cleanup handling of nfsv4.0 closed stateid's") cannot be done if encoding failed due to a short send buffer; there's no guarantee that the operation encoder has actually encoded the data that is being copied to the replay cache.
--- fs/nfsd/nfs4xdr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/nfsd/nfs4xdr.c +1 -2
@@ -5928,8 +5928,7 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)*/ warn_on_nonidempotent_op (op);xdr_truncate_encode (xdr, op_status_offset +XDR_UNIT ); - } -if (so) { + }else if (so) {int len = xdr->buf->len - (op_status_offset +XDR_UNIT ); so->so_replay.rp_status = op->status;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 55/247 Bluetooth: MGMT: cancel mesh send timer when hdev removed
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 55fb52ffdd62850d667ebed842815e072d3c9961 ]
mesh_send_done timer is not canceled when hdev is removed, which causes crash if the timer triggers after hdev is gone.
Cancel the timer when MGMT removes the hdev, like other MGMT timers.
Should fix the BUG: sporadically seen by BlueZ test bot (in "Mesh - Send cancel - 1" test).
Log:
------
BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0 ... Freed by task 36: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x43/0x70 kfree+0x103/0x500 device_release+0x9a/0x210 kobject_put+0x100/0x1e0 vhci_release+0x18b/0x240
------
--- net/bluetooth/mgmt.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/mgmt.c +1 -0
@@ -9497,6 +9497,7 @@ void mgmt_index_removed(struct hci_dev *hdev)cancel_delayed_work_sync (&hdev->discov_off);cancel_delayed_work_sync (&hdev->service_cache);cancel_delayed_work_sync (&hdev->rpa_expired); +cancel_delayed_work_sync (&hdev->mesh_send_done); }void mgmt_power_on (struct hci_dev *hdev,int err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 56/247 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <[email protected]>
[ Upstream commit 23d22f2f71768034d6ef86168213843fc49bf550 ]
There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF.
Fix by moving the accesses to btusb data to before the data is free'd.
--- drivers/bluetooth/btusb.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/bluetooth/btusb.c +6 -7
@@ -4361,6 +4361,11 @@ static void btusb_disconnect(struct usb_interface *intf)hci_unregister_dev (hdev); +if (data->oob_wake_irq) +device_init_wakeup (&data->udev->dev, false); +if (data->reset_gpio) +gpiod_put (data->reset_gpio); +if (intf == data->intf) {if (data->isoc)usb_driver_release_interface (&btusb_driver, data->isoc);
@@ -4371,17 +4376,11 @@ static void btusb_disconnect(struct usb_interface *intf)usb_driver_release_interface (&btusb_driver, data->diag);usb_driver_release_interface (&btusb_driver, data->intf); }else if (intf == data->diag) { -usb_driver_release_interface (&btusb_driver, data->intf);if (data->isoc)usb_driver_release_interface (&btusb_driver, data->isoc); +usb_driver_release_interface (&btusb_driver, data->intf); } -if (data->oob_wake_irq) -device_init_wakeup (&data->udev->dev, false); - -if (data->reset_gpio) -gpiod_put (data->reset_gpio); -hci_free_dev (hdev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 57/247 Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 3b78f50918276ab28fb22eac9aa49401ac436a3b ]
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace: <IRQ> ... packet_rcv (net/packet/af_packet.c:2152) ... <TASK>
__local_bh_enable_ip (kernel/softirq.c:407)netif_rx (net/core/dev.c:5648)chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------
--- net/bluetooth/6lowpan.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/6lowpan.c +1 -0
@@ -289,6 +289,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev, local_skb->pkt_type =PACKET_HOST ; local_skb->dev = dev; +skb_reset_mac_header (local_skb);skb_set_transport_header (local_skb,sizeof (struct ipv6hdr ));if (give_skb_to_upper (local_skb, dev) !=NET_RX_SUCCESS ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 58/247 Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit b454505bf57a2e4f5d49951d4deb03730a9348d9 ]
Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types, e.g. debugfs "connect" command takes the former, and "disconnect" and "connect" to already connected device take the latter. This is due to using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le which take different dst_type values.
Fix address type passed to hci_conn_hash_lookup_le().
Retain the debugfs API difference between "connect" and "disconnect" commands since it's been like this since 2015 and nobody apparently complained.
--- net/bluetooth/6lowpan.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-)
net/bluetooth/6lowpan.c +24 -4
@@ -957,10 +957,11 @@ static struct l2cap_chan *bt_6lowpan_listen(void) }static int get_l2cap_conn (char *buf,bdaddr_t *addr,u8 *addr_type, -struct l2cap_conn **conn) +struct l2cap_conn **conn,bool disconnect) {struct hci_conn *hcon;struct hci_dev *hdev; +int le_addr_type;int n; n = sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu",
@@ -971,13 +972,32 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,if (n <7 )return -EINVAL ; +if (disconnect) { +/* The "disconnect" debugfs command has used different address +* type constants than "connect" since 2015. Let's retain that +* for now even though it's obviously buggy... +*/ + *addr_type +=1 ; + } + +switch (*addr_type) { +case BDADDR_LE_PUBLIC : + le_addr_type =ADDR_LE_DEV_PUBLIC ; +break ; +case BDADDR_LE_RANDOM : + le_addr_type =ADDR_LE_DEV_RANDOM ; +break ; +default : +return -EINVAL ; + } +/* The LE_PUBLIC address type is ignored because of BDADDR_ANY */ hdev =hci_get_route (addr,BDADDR_ANY ,BDADDR_LE_PUBLIC );if (!hdev)return -ENOENT ;hci_dev_lock (hdev); - hcon =hci_conn_hash_lookup_le (hdev, addr, *addr_type); + hcon =hci_conn_hash_lookup_le (hdev, addr, le_addr_type);hci_dev_unlock (hdev);hci_dev_put (hdev);
@@ -1104,7 +1124,7 @@ static ssize_t lowpan_control_write(struct file *fp, buf[buf_size] ='\0' ;if (memcmp (buf,"connect " ,8 ) ==0 ) { - ret =get_l2cap_conn (&buf[8 ], &addr, &addr_type, &conn); + ret =get_l2cap_conn (&buf[8 ], &addr, &addr_type, &conn, false);if (ret == -EINVAL )return ret;
@@ -1141,7 +1161,7 @@ static ssize_t lowpan_control_write(struct file *fp, }if (memcmp (buf,"disconnect " ,11 ) ==0 ) { - ret =get_l2cap_conn (&buf[11 ], &addr, &addr_type, &conn); + ret =get_l2cap_conn (&buf[11 ], &addr, &addr_type, &conn, true);if (ret <0 )return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 59/247 Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit 98454bc812f3611551e4b1f81732da4aa7b9597e ]
disconnect_all_peers() calls sleeping function (l2cap_chan_close) under spinlock. Holding the lock doesn't actually do any good -- we work on a local copy of the list, and the lock doesn't protect against peer->chan having already been freed.
Fix by taking refcounts of peer->chan instead. Clean up the code and old comments a bit.
Take devices_lock instead of RCU, because the kfree_rcu(); l2cap_chan_put(); construct in chan_close_cb() does not guarantee peer->chan is necessarily valid in RCU.
Also take l2cap_chan_lock() which is required for l2cap_chan_close().
Log: (bluez 6lowpan-tester Client Connect - Disable)
------
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 ... <TASK>
...l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495)
...
? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809)do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068)
------
--- net/bluetooth/6lowpan.c | 68 ++++++++++++++++++++++++++--------------- 1 file changed, 43 insertions(+), 25 deletions(-)
net/bluetooth/6lowpan.c +43 -25
@@ -53,6 +53,11 @@ static bool enable_6lowpan;static struct l2cap_chan *listen_chan;static DEFINE_MUTEX (set_lock); +enum { +LOWPAN_PEER_CLOSING , +LOWPAN_PEER_MAXBITS +}; +struct lowpan_peer {struct list_head list;struct rcu_head rcu;
@@ -61,6 +66,8 @@ struct lowpan_peer {/* peer addresses in various formats */ unsigned char lladdr[ETH_ALEN ];struct in6_addr peer_addr; + +DECLARE_BITMAP (flags,LOWPAN_PEER_MAXBITS ); };struct lowpan_btle_dev {
@@ -1014,41 +1021,52 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,static void disconnect_all_peers (void ) {struct lowpan_btle_dev *entry; -struct lowpan_peer *peer, *tmp_peer, *new_peer; -struct list_head peers; - -INIT_LIST_HEAD (&peers); +struct lowpan_peer *peer; +int nchans; -/* We make a separate list of peers as the close_cb() will -* modify the device peers list so it is better not to mess -* with the same list at the same time. +/* l2cap_chan_close() cannot be called from RCU, and lock ordering +* chan->lock > devices_lock prevents taking write side lock, so copy +* then close. */ rcu_read_lock (); +list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) +list_for_each_entry_rcu (peer, &entry->peers, list) +clear_bit (LOWPAN_PEER_CLOSING , peer->flags); +rcu_read_unlock (); -list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) { -list_for_each_entry_rcu (peer, &entry->peers, list) { - new_peer =kmalloc (sizeof (*new_peer),GFP_ATOMIC ); -if (!new_peer) -break ; +do { +struct l2cap_chan *chans[32 ]; +int i; - new_peer->chan = peer->chan; -INIT_LIST_HEAD (&new_peer->list); + nchans =0 ; -list_add (&new_peer->list, &peers); - } - } +spin_lock (&devices_lock); -rcu_read_unlock (); +list_for_each_entry_rcu (entry, &bt_6lowpan_devices, list) { +list_for_each_entry_rcu (peer, &entry->peers, list) { +if (test_and_set_bit (LOWPAN_PEER_CLOSING , + peer->flags)) +continue ; -spin_lock (&devices_lock); -list_for_each_entry_safe (peer, tmp_peer, &peers, list) { -l2cap_chan_close (peer->chan,ENOENT ); +l2cap_chan_hold (peer->chan); + chans[nchans++] = peer->chan; -list_del_rcu (&peer->list); -kfree_rcu (peer, rcu); - } -spin_unlock (&devices_lock); +if (nchans >=ARRAY_SIZE (chans)) + goto done; + } + } + +done: +spin_unlock (&devices_lock); + +for (i =0 ; i < nchans; ++i) { +l2cap_chan_lock (chans[i]); +l2cap_chan_close (chans[i],ENOENT ); +l2cap_chan_unlock (chans[i]); +l2cap_chan_put (chans[i]); + } + }while (nchans); }struct set_enable {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 60/247 Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 41bf23338a501e745c398e0faee948dd05d0be98 ]
Contrary to what was stated on d36349ea73d8 ("Bluetooth: hci_conn:
Fix running bis_cleanup for hci_conn->type PA_LINK") the PA_LINK does in fact needs to run bis_cleanup in order to terminate the PA Sync, since that is bond to the listening socket which is the entity that controls the lifetime of PA Sync, so if it is closed/released the PA Sync shall be terminated, terminating the PA Sync shall not result in the BIG Sync being terminated since once the later is established it doesn't depend on the former anymore.
If the use user wants to reconnect/rebind a number of BIS(s) it shall keep the socket open until it no longer needs the PA Sync, which means it retains full control of the lifetime of both PA and BIG Syncs.
--- net/bluetooth/hci_conn.c | 33 +++++++++++++++++++-------------- net/bluetooth/hci_event.c | 7 +------ net/bluetooth/hci_sync.c | 2 +- 3 files changed, 21 insertions(+), 21 deletions(-)
net/bluetooth/hci_conn.c +19 -14
@@ -769,21 +769,23 @@ static void find_bis(struct hci_conn *conn, void *data) d->count++; } -static int hci_le_big_terminate (struct hci_dev *hdev,u8 big,struct hci_conn *conn) +static int hci_le_big_terminate (struct hci_dev *hdev,struct hci_conn *conn) {struct iso_list_data *d;int ret; -bt_dev_dbg (hdev,"big 0x%2.2x sync_handle 0x%4.4x" , big, conn->sync_handle); +bt_dev_dbg (hdev,"hcon %p big 0x%2.2x sync_handle 0x%4.4x" , conn, + conn->iso_qos.bcast.big, conn->sync_handle); d =kzalloc (sizeof (*d),GFP_KERNEL );if (!d)return -ENOMEM ; - d->big = big; + d->big = conn->iso_qos.bcast.big; d->sync_handle = conn->sync_handle; -if (test_and_clear_bit (HCI_CONN_PA_SYNC , &conn->flags)) { +if (conn->type ==PA_LINK && +test_and_clear_bit (HCI_CONN_PA_SYNC , &conn->flags)) {hci_conn_hash_list_flag (hdev, find_bis,PA_LINK ,HCI_CONN_PA_SYNC , d);
@@ -801,6 +803,9 @@ static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, struct hci_conn *c d->big_sync_term = true; } +if (!d->pa_sync_term && !d->big_sync_term) +return 0 ; + ret =hci_cmd_sync_queue (hdev, big_terminate_sync, d, terminate_big_destroy);if (ret)
@@ -852,8 +857,7 @@ static void bis_cleanup(struct hci_conn *conn)hci_le_terminate_big (hdev, conn); }else { -hci_le_big_terminate (hdev, conn->iso_qos.bcast.big, - conn); +hci_le_big_terminate (hdev, conn); } }
@@ -995,19 +999,20 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu;break ;case CIS_LINK : -case BIS_LINK : -case PA_LINK :/* conn->src should reflect the local identity address */ hci_copy_identity_address (hdev, &conn->src, &conn->src_type); -/* set proper cleanup function */ -if (!bacmp (dst,BDADDR_ANY )) - conn->cleanup = bis_cleanup; -else if (conn->role ==HCI_ROLE_MASTER ) +if (conn->role ==HCI_ROLE_MASTER ) conn->cleanup = cis_cleanup; - conn->mtu = hdev->iso_mtu ? hdev->iso_mtu : - hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; + conn->mtu = hdev->iso_mtu; +break ; +case PA_LINK : +case BIS_LINK : +/* conn->src should reflect the local identity address */ +hci_copy_identity_address (hdev, &conn->src, &conn->src_type); + conn->cleanup = bis_cleanup; + conn->mtu = hdev->iso_mtu;break ;case SCO_LINK :if (lmp_esco_capable (hdev))
net/bluetooth/hci_event.c +1 -6
@@ -7011,14 +7011,9 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,continue ; } -if (ev->status !=0x42 ) { +if (ev->status !=0x42 )/* Mark PA sync as established */ set_bit (HCI_CONN_PA_SYNC , &bis->flags); -/* Reset cleanup callback of PA Sync so it doesn't -* terminate the sync when deleting the connection. -*/ - conn->cleanup =NULL ; - } bis->sync_handle = conn->sync_handle; bis->iso_qos.bcast.big = ev->handle;
net/bluetooth/hci_sync.c +1 -1
@@ -6999,7 +6999,7 @@ static void create_pa_complete(struct hci_dev *hdev, void *data, int err)hci_dev_lock (hdev); -if (!hci_conn_valid (hdev, conn)) +if (hci_conn_valid (hdev, conn))clear_bit (HCI_CONN_CREATE_PA_SYNC , &conn->flags);if (!err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 61/247 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 1534ff77757e44bcc4b98d0196bc5c0052fce5fa ]
syzbot reported a possible shift-out-of-bounds [1]
Blamed commit added rto_alpha_max and rto_beta_max set to 1000.
It is unclear if some sctp users are setting very large rto_alpha and/or rto_beta.
In order to prevent user regression, perform the test at run time.
Also add READ_ONCE() annotations as sysctl values can change under us.
[1]
UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type 'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]
--- net/sctp/transport.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/sctp/transport.c +9 -4
@@ -495,6 +495,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)if (tp->rttvar || tp->srtt) {struct net *net = tp->asoc->base.net; +unsigned int rto_beta, rto_alpha;/* 6.3.1 C3) When a new RTT measurement R' is made, set * RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'| * SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
@@ -506,10 +507,14 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)* For example, assuming the default value of RTO.Alpha of * 1/8, rto_alpha would be expressed as 3. */ - tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta) - + (((__u32 )abs ((__s64 )tp->srtt - (__s64 )rtt)) >> net->sctp.rto_beta); - tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha) - + (rtt >> net->sctp.rto_alpha); + rto_beta =READ_ONCE (net->sctp.rto_beta); +if (rto_beta <32 ) + tp->rttvar = tp->rttvar - (tp->rttvar >> rto_beta) + + (((__u32 )abs ((__s64 )tp->srtt - (__s64 )rtt)) >> rto_beta); + rto_alpha =READ_ONCE (net->sctp.rto_alpha); +if (rto_alpha <32 ) + tp->srtt = tp->srtt - (tp->srtt >> rto_alpha) + + (rtt >> rto_alpha); }else {/* 6.3.1 C2) When the first RTT measurement R is made, set * SRTT <- R, RTTVAR <- R/2.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 62/247 net: dsa: tag_brcm: do not mark link local traffic as offloaded
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <[email protected]>
[ Upstream commit 762e7e174da91cf4babfe77e45bc6b67334b1503 ]
Broadcom switches locally terminate link local traffic and do not forward it, so we should not mark it as offloaded.
In some situations we still want/need to flood this traffic, e.g. if STP is disabled, or it is explicitly enabled via the group_fwd_mask. But if the skb is marked as offloaded, the kernel will assume this was already done in hardware, and the packets never reach other bridge ports.
So ensure that link local traffic is never marked as offloaded, so that the kernel can forward/flood these packets in software if needed.
Since the local termination in not configurable, check the destination MAC, and never mark packets as offloaded if it is a link local ether address.
While modern switches set the tag reason code to BRCM_EG_RC_PROT_TERM for trapped link local traffic, they also set it for link local traffic that is flooded (01:80:c2:00:00:10 to 01:80:c2:00:00:2f), so we cannot use it and need to look at the destination address for them as well.
--- net/dsa/tag_brcm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/dsa/tag_brcm.c +4 -2
@@ -176,7 +176,8 @@ static struct sk_buff *brcm_tag_rcv_ll(struct sk_buff *skb,/* Remove Broadcom tag and update checksum */ skb_pull_rcsum (skb,BRCM_TAG_LEN ); -dsa_default_offload_fwd_mark (skb); +if (likely (!is_link_local_ether_addr (eth_hdr (skb)->h_dest))) +dsa_default_offload_fwd_mark (skb);return skb; }
@@ -250,7 +251,8 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb,/* Remove Broadcom tag and update checksum */ skb_pull_rcsum (skb, len); -dsa_default_offload_fwd_mark (skb); +if (likely (!is_link_local_ether_addr (eth_hdr (skb)->h_dest))) +dsa_default_offload_fwd_mark (skb);dsa_strip_etype_header (skb, len);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 63/247 net/smc: fix mismatch between CLC header and proposal
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <[email protected]>
[ Upstream commit ec33f2e5a2d0dbbfd71435209aee812fdc9369b8 ]
The current CLC proposal message construction uses a mix of ini->smc_type_v1/v2 and pclc_base->hdr.typev1/v2 to decide whether to include optional extensions (IPv6 prefix extension for v1, and v2 extension). This leads to a critical inconsistency: when smc_clc_prfx_set() fails - for example, in IPv6-only environments with only link-local addresses, or when the local IP address and the outgoing interface’s network address are not in the same subnet.
As a result, the proposal message is assembled using the stale ini->smc_type_v1 value—causing the IPv6 prefix extension to be included even though the header indicates v1 is not supported. The peer then receives a malformed CLC proposal where the header type does not match the payload, and immediately resets the connection.
The fix ensures consistency between the CLC header flags and the actual payload by synchronizing ini->smc_type_v1 with pclc_base->hdr.typev1 when prefix setup fails.
--- net/smc/smc_clc.c | 1 + 1 file changed, 1 insertion(+)
net/smc/smc_clc.c +1 -0
@@ -890,6 +890,7 @@ int smc_clc_send_proposal(struct smc_sock *smc, struct smc_init_info *ini)return SMC_CLC_DECL_CNFERR ; } pclc_base->hdr.typev1 =SMC_TYPE_N ; + ini->smc_type_v1 =SMC_TYPE_N ; }else { pclc_base->iparea_offset =htons (sizeof (*pclc_smcd)); plen += sizeof(*pclc_prfx) +
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 64/247 net/handshake: Fix memory leak in tls_handshake_accept()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 3072f00bba764082fa41b3c3a2a7b013335353d2 ]
In tls_handshake_accept(), a netlink message is allocated using genlmsg_new(). In the error handling path, genlmsg_cancel() is called to cancel the message construction, but the message itself is not freed. This leads to a memory leak.
Fix this by calling nlmsg_free() in the error path after genlmsg_cancel() to release the allocated memory.
--- net/handshake/tlshd.c | 1 + 1 file changed, 1 insertion(+)
net/handshake/tlshd.c +1 -0
@@ -259,6 +259,7 @@ static int tls_handshake_accept(struct handshake_req *req, out_cancel:genlmsg_cancel (msg, hdr); +nlmsg_free (msg); out:return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 65/247 net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aksh Garg <[email protected]>
[ Upstream commit 49b3916465176a5abcb29a0e464825f553d55d58 ]
The CPSW module uses the MAC_VERIFY_CNT bit field in the CPSW_PN_IET_VERIFY_REG_k register to set the verify/response timeout count. This register specifies the number of clock cycles to wait before resending a verify packet if the verification fails.
The verify/response timeout count, as being set by the function am65_cpsw_iet_set_verify_timeout_count() is hardcoded for 125MHz clock frequency, which varies based on PHY mode and link speed.
The respective clock frequencies are as follows:
- RGMII mode:
* 1000 Mbps: 125 MHz
* 100 Mbps: 25 MHz
* 10 Mbps: 2.5 MHz
- QSGMII/SGMII mode: 125 MHz (all speeds)
Fix this by adding logic to calculate the correct timeout counts based on the actual PHY interface mode and link speed.
--- drivers/net/ethernet/ti/am65-cpsw-qos.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/am65-cpsw-qos.c +23 -1
@@ -276,9 +276,31 @@ static int am65_cpsw_iet_set_verify_timeout_count(struct am65_cpsw_port *port)/* The number of wireside clocks contained in the verify * timeout counter. The default is 0x1312d0 * (10ms at 125Mhz in 1G mode). +* The frequency of the clock depends on the link speed +* and the PHY interface. */ - val =125 *HZ_PER_MHZ ;/* assuming 125MHz wireside clock */ +switch (port->slave.phy_if) { +case PHY_INTERFACE_MODE_RGMII : +case PHY_INTERFACE_MODE_RGMII_ID : +case PHY_INTERFACE_MODE_RGMII_RXID : +case PHY_INTERFACE_MODE_RGMII_TXID : +if (port->qos.link_speed ==SPEED_1000 ) + val =125 *HZ_PER_MHZ ;/* 125 MHz at 1000Mbps*/ +else if (port->qos.link_speed ==SPEED_100 ) + val =25 *HZ_PER_MHZ ;/* 25 MHz at 100Mbps*/ +else + val = (25 *HZ_PER_MHZ ) /10 ;/* 2.5 MHz at 10Mbps*/ +break ; + +case PHY_INTERFACE_MODE_QSGMII : +case PHY_INTERFACE_MODE_SGMII : + val =125 *HZ_PER_MHZ ;/* 125 MHz */ +break ; +default : +netdev_err (port->ndev,"selected mode does not supported IET\n" ); +return -EOPNOTSUPP ; + } val /=MILLIHZ_PER_HZ ;/* count per ms timeout */ val *= verify_time_ms;/* count for timeout ms */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 66/247 net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aksh Garg <[email protected]>
[ Upstream commit d4b00d132d7cb70a74bc039c91c1d6120943c71b ]
The am65_cpsw_iet_verify_wait() function attempts verification 20 times, toggling the AM65_CPSW_PN_IET_MAC_LINKFAIL bit in each iteration. When the LINKFAIL bit transitions from 1 to 0, the MAC merge layer initiates the verification process and waits for the timeout configured in MAC_VERIFY_CNT before automatically retransmitting. The MAC_VERIFY_CNT register is configured according to the user-defined verify/response timeout in am65_cpsw_iet_set_verify_timeout_count(). As per IEEE 802.3 Clause 99, the hardware performs this automatic retry up to 3 times.
Current implementation toggles LINKFAIL after the user-configured verify/response timeout in each iteration, forcing the hardware to restart verification instead of respecting the MAC_VERIFY_CNT timeout. This bypasses the hardware's automatic retry mechanism.
Fix this by moving the LINKFAIL bit toggle outside the retry loop and reducing the retry count from 20 to 3. The software now only monitors the status register while the hardware autonomously handles the 3 verification attempts at proper MAC_VERIFY_CNT intervals.
--- drivers/net/ethernet/ti/am65-cpsw-qos.c | 27 +++++++++++++------------ 1 file changed, 14 insertions(+), 13 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-qos.c +14 -13
@@ -317,20 +317,21 @@ static int am65_cpsw_iet_verify_wait(struct am65_cpsw_port *port)u32 ctrl, status;int try; - try =20 ; - do { - /* Reset the verify state machine by writing 1 - * to LINKFAIL - */ - ctrl = readl(port->port_base + AM65_CPSW_PN_REG_IET_CTRL); - ctrl |= AM65_CPSW_PN_IET_MAC_LINKFAIL; - writel(ctrl, port->port_base + AM65_CPSW_PN_REG_IET_CTRL); + try =3 ; - /* Clear MAC_LINKFAIL bit to start Verify. */ - ctrl = readl(port->port_base + AM65_CPSW_PN_REG_IET_CTRL); - ctrl &= ~AM65_CPSW_PN_IET_MAC_LINKFAIL; - writel(ctrl, port->port_base + AM65_CPSW_PN_REG_IET_CTRL); +/* Reset the verify state machine by writing 1 +* to LINKFAIL +*/ + ctrl =readl (port->port_base +AM65_CPSW_PN_REG_IET_CTRL ); + ctrl |=AM65_CPSW_PN_IET_MAC_LINKFAIL ; +writel (ctrl, port->port_base +AM65_CPSW_PN_REG_IET_CTRL ); +/* Clear MAC_LINKFAIL bit to start Verify. */ + ctrl =readl (port->port_base +AM65_CPSW_PN_REG_IET_CTRL ); + ctrl &= ~AM65_CPSW_PN_IET_MAC_LINKFAIL ; +writel (ctrl, port->port_base +AM65_CPSW_PN_REG_IET_CTRL ); + + do { msleep(port->qos.iet.verify_time_ms); status = readl(port->port_base + AM65_CPSW_PN_REG_IET_STATUS);
@@ -352,7 +353,7 @@ static int am65_cpsw_iet_verify_wait(struct am65_cpsw_port *port)netdev_dbg (port->ndev,"MAC Merge verify error\n" );return -ENODEV ; } - }while (try-- >0 ); + }while (--try >0 );netdev_dbg (port->ndev,"MAC Merge verify timeout\n" );return -ETIMEDOUT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 67/247 tipc: Fix use-after-free in tipc_mon_reinit_self().
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 0725e6afb55128be21a2ca36e9674f573ccec173 ]
syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0]
The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL.
tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work().
Let's hold RTNL in tipc_net_finalize_work().
[0]:
BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989
CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events tipc_net_finalize_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568
kasan_check_byte include/linux/kasan.h:399 [inline]
lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]
rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]
rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244
rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243
write_lock_bh include/linux/rwlock_rt.h:99 [inline]
tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718
tipc_net_finalize+0x115/0x190 net/tipc/net.c:140
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6089:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657
tipc_enable_bearer net/tipc/bearer.c:357 [inline]
__tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047
__tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]
tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393
tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]
tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:729
____sys_sendmsg+0x508/0x820 net/socket.c:2614
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
__sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline]
__se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6088:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free mm/slub.c:4695 [inline]
kfree+0x195/0x550 mm/slub.c:4894
tipc_l2_device_event+0x380/0x650 net/tipc/bearer.c:-1
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
unregister_netdevice_many_notify+0x14d7/0x1fe0 net/core/dev.c:12166
unregister_netdevice_many net/core/dev.c:12229 [inline]
unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12073
unregister_netdevice include/linux/netdevice.h:3385 [inline]
__tun_detach+0xe4d/0x1620 drivers/net/tun.c:621
tun_detach drivers/net/tun.c:637 [inline]
tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3433
__fput+0x458/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f--- net/tipc/net.c | 2 ++ 1 file changed, 2 insertions(+)
net/tipc/net.c +2 -0
@@ -145,7 +145,9 @@ void tipc_net_finalize_work(struct work_struct *work) { struct tipc_net *tn = container_of(work, struct tipc_net, work); +rtnl_lock ();tipc_net_finalize (tipc_link_net (tn->bcl), tn->trial_addr); +rtnl_unlock (); }void tipc_net_stop (struct net *net)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 68/247 net: mdio: fix resource leak in mdiobus_register_device()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Buday Csaba <[email protected]>
[ Upstream commit e6ca8f533ed41129fcf052297718f417f021cc7d ]
Fix a possible leak in mdiobus_register_device() when both a reset-gpio and a reset-controller are present.
Clean up the already claimed reset-gpio, when the registration of the reset-controller fails, so when an error code is returned, the device retains its state before the registration attempt.
--- drivers/net/phy/mdio_bus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/phy/mdio_bus.c +4 -1
@@ -73,8 +73,11 @@ int mdiobus_register_device(struct mdio_device *mdiodev)return err; err =mdiobus_register_reset (mdiodev); -if (err) +if (err) { +gpiod_put (mdiodev->reset_gpio); + mdiodev->reset_gpio =NULL ;return err; + }/* Assert the reset signal */ mdio_device_reset (mdiodev,1 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 69/247 wifi: mac80211: skip rate verification for not captured PSDUs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <[email protected]>
[ Upstream commit 7fe0d21f5633af8c3fab9f0ef0706c6156623484 ]
If for example the sniffer did not follow any AIDs in an MU frame, then some of the information may not be filled in or is even expected to be invalid. As an example, in that case it is expected that Nss is zero.
--- net/mac80211/rx.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/mac80211/rx.c +7 -3
@@ -5352,10 +5352,14 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,if (WARN_ON (!local->started)) goto drop; -if (likely (!(status->flag &RX_FLAG_FAILED_PLCP_CRC ))) { +if (likely (!(status->flag &RX_FLAG_FAILED_PLCP_CRC ) && + !(status->flag &RX_FLAG_NO_PSDU && + status->zero_length_psdu_type == +IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED ))) {/* -* Validate the rate, unless a PLCP error means that -* we probably can't have a valid rate here anyway. +* Validate the rate, unless there was a PLCP error which may +* have an invalid rate or the PSDU was not capture and may be +* missing rate information. */ switch (status->encoding) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 70/247 af_unix: Initialise scc_index in unix_add_edge().
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 60e6489f8e3b086bd1130ad4450a2c112e863791 ]
Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3
Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC.
At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices.
unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight.
3-c decrements sk-A's file refcnt to 1.
Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:
sk-A -> sk-B (-> sk-C)
sk-X -> sk-X
This is totally fine. All of them are not yet close()d and should be grouped into different SCCs.
However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead.
unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! &&
sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree
^-- 1 in-flight count for sk-B
-> sk-A is dead !?
The problem is that unix_add_edge() does not initialise scc_index.
Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c.
Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index.
This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.
--- net/unix/garbage.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
net/unix/garbage.c +11 -3
@@ -145,6 +145,7 @@ enum unix_vertex_index { };static unsigned long unix_vertex_unvisited_index =UNIX_VERTEX_INDEX_MARK1 ; +static unsigned long unix_vertex_max_scc_index =UNIX_VERTEX_INDEX_START ;static void unix_add_edge (struct scm_fp_list *fpl,struct unix_edge *edge) {
@@ -153,6 +154,7 @@ static void unix_add_edge(struct scm_fp_list *fpl, struct unix_edge *edge)if (!vertex) { vertex =list_first_entry (&fpl->vertices,typeof (*vertex), entry); vertex->index = unix_vertex_unvisited_index; + vertex->scc_index = ++unix_vertex_max_scc_index; vertex->out_degree =0 ;INIT_LIST_HEAD (&vertex->edges);INIT_LIST_HEAD (&vertex->scc_entry);
@@ -489,10 +491,15 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde scc_dead =unix_vertex_dead (v); } -if (scc_dead) +if (scc_dead) {unix_collect_skb (&scc, hitlist); -else if (!unix_graph_maybe_cyclic) - unix_graph_maybe_cyclic =unix_scc_cyclic (&scc); + }else { +if (unix_vertex_max_scc_index < vertex->scc_index) + unix_vertex_max_scc_index = vertex->scc_index; + +if (!unix_graph_maybe_cyclic) + unix_graph_maybe_cyclic =unix_scc_cyclic (&scc); + }list_del (&scc); }
@@ -507,6 +514,7 @@ static void unix_walk_scc(struct sk_buff_head *hitlist)unsigned long last_index =UNIX_VERTEX_INDEX_START ; unix_graph_maybe_cyclic = false; + unix_vertex_max_scc_index =UNIX_VERTEX_INDEX_START ;/* Visit every vertex exactly once. * __unix_walk_scc() moves visited vertices to unix_visited_vertices.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 71/247 Bluetooth: hci_event: Fix not handling PA Sync Lost event
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 485e0626e58768f3c53ba61ab9e09d6b60a455f4 ]
This handles PA Sync Lost event which previously was assumed to be handled with BIG Sync Lost but their lifetime are not the same thus why there are 2 different events to inform when each sync is lost.
--- include/net/bluetooth/hci.h | 5 ++++ net/bluetooth/hci_event.c | 49 ++++++++++++++++++++++++++----------- 2 files changed, 40 insertions(+), 14 deletions(-)
include/net/bluetooth/hci.h +5 -0
@@ -2782,6 +2782,11 @@ struct hci_ev_le_per_adv_report {__u8 data[]; } __packed; +#define HCI_EV_LE_PA_SYNC_LOST 0x10 +struct hci_ev_le_pa_sync_lost { +__le16 handle; +} __packed; +#define LE_PA_DATA_COMPLETE 0x00#define LE_PA_DATA_MORE_TO_COME 0x01#define LE_PA_DATA_TRUNCATED 0x02
net/bluetooth/hci_event.c +35 -14
76 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 72/247 net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranganath V N <[email protected]>
[ Upstream commit 62b656e43eaeae445a39cd8021a4f47065af4389 ]
In tcf_connmark_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace.
Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied.
--- net/sched/act_connmark.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/sched/act_connmark.c +7 -5
@@ -195,13 +195,15 @@ static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,const struct tcf_connmark_info *ci =to_connmark (a);unsigned char *b =skb_tail_pointer (skb);const struct tcf_connmark_parms *parms; -struct tc_connmark opt = { - .index = ci->tcf_index, - .refcnt =refcount_read (&ci->tcf_refcnt) - ref, - .bindcnt =atomic_read (&ci->tcf_bindcnt) - bind, - }; +struct tc_connmark opt;struct tcf_t t; +memset (&opt,0 ,sizeof (opt)); + + opt.index = ci->tcf_index; + opt.refcnt =refcount_read (&ci->tcf_refcnt) - ref; + opt.bindcnt =atomic_read (&ci->tcf_bindcnt) - bind; +rcu_read_lock (); parms =rcu_dereference (ci->parms);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 73/247 net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranganath V N <[email protected]>
[ Upstream commit ce50039be49eea9b4cd8873ca6eccded1b4a130a ]
Fix a KMSAN kernel-infoleak detected by the syzbot .
[net?] KMSAN: kernel-infoleak in __skb_datagram_iter
In tcf_ife_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace.
Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied.
This change silences the KMSAN report and prevents potential information leaks from the kernel memory.
This fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures no infoleak.
--- net/sched/act_ife.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/sched/act_ife.c +7 -5
@@ -644,13 +644,15 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind,unsigned char *b =skb_tail_pointer (skb);struct tcf_ife_info *ife =to_ife (a);struct tcf_ife_params *p; -struct tc_ife opt = { - .index = ife->tcf_index, - .refcnt =refcount_read (&ife->tcf_refcnt) - ref, - .bindcnt =atomic_read (&ife->tcf_bindcnt) - bind, - }; +struct tc_ife opt;struct tcf_t t; +memset (&opt,0 ,sizeof (opt)); + + opt.index = ife->tcf_index, + opt.refcnt =refcount_read (&ife->tcf_refcnt) - ref, + opt.bindcnt =atomic_read (&ife->tcf_bindcnt) - bind, +spin_lock_bh (&ife->tcf_lock); opt.action = ife->tcf_action; p = rcu_dereference_protected(ife->params,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 74/247 net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit 0bcd5b3b50cc1fcbf775479322cc37c15d35a489 ]
Assign the return value of mlx5_eswitch_block_mode() to 'err' before checking it to avoid returning an uninitialized error code.
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +2 -1
@@ -804,7 +804,8 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, goto err_xfrm; } -if (mlx5_eswitch_block_mode (priv->mdev)) + err =mlx5_eswitch_block_mode (priv->mdev); +if (err) goto unblock_ipsec; if (x->props.mode == XFRM_MODE_TUNNEL &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 75/247 net/mlx5e: Fix maxrate wraparound in threshold between units
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit a7bf4d5063c7837096aab2853224eb23628514d9 ]
The previous calculation used roundup() which caused an overflow for rates between 25.5Gbps and 26Gbps.
For example, a rate of 25.6Gbps would result in using 100Mbps units with value of 256, which would overflow the 8 bits field.
Simplify the upper_limit_mbps calculation by removing the unnecessary roundup, and adjust the comparison to use <= to correctly handle the boundary condition.
--- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +3 -2
@@ -595,18 +595,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,struct mlx5_core_dev *mdev = priv->mdev;u8 max_bw_value[IEEE_8021QAZ_MAX_TCS ];u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS ]; -__u64 upper_limit_mbps =roundup (255 *MLX5E_100MB ,MLX5E_1GB ); +__u64 upper_limit_mbps;int i;memset (max_bw_value,0 ,sizeof (max_bw_value));memset (max_bw_unit,0 ,sizeof (max_bw_unit)); + upper_limit_mbps =255 *MLX5E_100MB ;for (i =0 ; i <=mlx5_max_tc (mdev); i++) {if (!maxrate->tc_maxrate[i]) { max_bw_unit[i] =MLX5_BW_NO_LIMIT ;continue ; } -if (maxrate->tc_maxrate[i] < upper_limit_mbps) { +if (maxrate->tc_maxrate[i] <= upper_limit_mbps) { max_bw_value[i] =div_u64 (maxrate->tc_maxrate[i],MLX5E_100MB ); max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] :1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 76/247 net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 43b27d1bd88a4bce34ec2437d103acfae9655f9e ]
Add validation to reject rates exceeding 255 Gbps that would overflow the 8 bits max bandwidth field.
--- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +9 -1
@@ -596,11 +596,13 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,u8 max_bw_value[IEEE_8021QAZ_MAX_TCS ];u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS ];__u64 upper_limit_mbps; +__u64 upper_limit_gbps;int i;memset (max_bw_value,0 ,sizeof (max_bw_value));memset (max_bw_unit,0 ,sizeof (max_bw_unit)); upper_limit_mbps =255 *MLX5E_100MB ; + upper_limit_gbps =255 *MLX5E_1GB ;for (i =0 ; i <=mlx5_max_tc (mdev); i++) {if (!maxrate->tc_maxrate[i]) {
@@ -612,10 +614,16 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, MLX5E_100MB); max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] :1 ; max_bw_unit[i] =MLX5_100_MBPS_UNIT ; - }else { + }else if (max_bw_value[i] <= upper_limit_gbps) { max_bw_value[i] =div_u64 (maxrate->tc_maxrate[i],MLX5E_1GB ); max_bw_unit[i] =MLX5_GBPS_UNIT ; + }else { +netdev_err (netdev, +"tc_%d maxrate %llu Kbps exceeds limit %llu\n" , + i, maxrate->tc_maxrate[i], + upper_limit_gbps); +return -EINVAL ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 77/247 net/mlx5e: Fix potentially misleading debug message
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <[email protected]>
[ Upstream commit 9fcc2b6c10523f7e75db6387946c86fcf19dc97e ]
Change the debug message to print the correct units instead of always assuming Gbps, as the value can be in either 100 Mbps or 1 Gbps units.
--- .../net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +16 -2
@@ -598,6 +598,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,__u64 upper_limit_mbps;__u64 upper_limit_gbps;int i; +struct { +int scale; +const char *units_str; + } units[] = { + [MLX5_100_MBPS_UNIT ] = { + .scale =100 , + .units_str ="Mbps" , + }, + [MLX5_GBPS_UNIT ] = { + .scale =1 , + .units_str ="Gbps" , + }, + };memset (max_bw_value,0 ,sizeof (max_bw_value));memset (max_bw_unit,0 ,sizeof (max_bw_unit));
@@ -628,8 +641,9 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, }for (i =0 ; i <IEEE_8021QAZ_MAX_TCS ; i++) { -netdev_dbg (netdev,"%s: tc_%d <=> max_bw %d Gbps\n" , - __func__, i, max_bw_value[i]); +netdev_dbg (netdev,"%s: tc_%d <=> max_bw %u %s\n" , __func__, i, + max_bw_value[i] * units[max_bw_unit[i]].scale, + units[max_bw_unit[i]].units_str); }return mlx5_modify_port_ets_rate_limit (mdev, max_bw_value, max_bw_unit);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 78/247 net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit 917449e7c3cdc7a0dfe429de997e39098d9cdd20 ]
Also convert it to a simple define.
Stable-dep-of: e5eba42f0134 ("mlx5: Fix default values in create CQ")
--- drivers/net/ethernet/mellanox/mlx5/core/eq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eq.c +2 -4
@@ -32,9 +32,7 @@ enum { MLX5_EQ_STATE_ALWAYS_ARMED = 0xb, }; -enum { -MLX5_EQ_DOORBEL_OFFSET =0x40 , -}; +#define MLX5_EQ_DOORBELL_OFFSET 0x40/* budget must be smaller than MLX5_NUM_SPARE_EQE to guarantee that we update * the ci before we polled all the entries in the EQ. MLX5_NUM_SPARE_EQE is
@@ -322,7 +320,7 @@ create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, eq->eqn =MLX5_GET (create_eq_out, out, eq_number); eq->irqn =pci_irq_vector (dev->pdev, vecidx); eq->dev = dev; - eq->doorbell = priv->uar->map +MLX5_EQ_DOORBEL_OFFSET ; + eq->doorbell = priv->uar->map +MLX5_EQ_DOORBELL_OFFSET ; err =mlx5_debug_eq_add (dev, eq);if (err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 79/247 net/mlx5: Store the global doorbell in mlx5_priv
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit aa4595d0ada65d5d44fa924a42a87c175d9d88e3 ]
The global doorbell is used for more than just Ethernet resources, so move it out of mlx5e_hw_objs into a common place (mlx5_priv), to avoid non-Ethernet modules (e.g. HWS, ASO) depending on Ethernet structs.
Use this opportunity to consolidate it with the 'uar' pointer already there, which was used as an RX doorbell. Underneath the 'uar' pointer is identical to 'bfreg->up', so store a single resource and use that instead.
For CQ doorbells, care is taken to always use bfreg->up->index instead of bfreg->index, which may refer to a subsequent UAR page from the same ALLOC_UAR batch on some NICs.
This paves the way for cleanly supporting multiple doorbells in the Ethernet driver.
Stable-dep-of: e5eba42f0134 ("mlx5: Fix default values in create CQ")
--- drivers/infiniband/hw/mlx5/cq.c | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/cq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_common.c | 11 +---------- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++----- drivers/net/ethernet/mellanox/mlx5/core/eq.c | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c | 8 ++++---- drivers/net/ethernet/mellanox/mlx5/core/main.c | 11 +++++------ .../ethernet/mellanox/mlx5/core/steering/hws/send.c | 8 ++++---- drivers/net/ethernet/mellanox/mlx5/core/wc.c | 4 ++-- include/linux/mlx5/driver.h | 3 +-- 12 files changed, 29 insertions(+), 40 deletions(-)
drivers/infiniband/hw/mlx5/cq.c +2 -2
@@ -648,7 +648,7 @@ int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags) {struct mlx5_core_dev *mdev =to_mdev (ibcq->device)->mdev;struct mlx5_ib_cq *cq =to_mcq (ibcq); -void __iomem *uar_page = mdev->priv.uar->map; +void __iomem *uar_page = mdev->priv.bfreg.up->map;unsigned long irq_flags;int ret =0 ;
@@ -923,7 +923,7 @@ static int create_cq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq, cq->buf.frag_buf.page_shift - MLX5_ADAPTER_PAGE_SHIFT); - *index = dev->mdev->priv.uar->index; + *index = dev->mdev->priv.bfreg.up->index;return 0 ;
drivers/net/ethernet/mellanox/mlx5/core/cq.c +1 -1
@@ -145,7 +145,7 @@ int mlx5_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq,mlx5_core_dbg (dev,"failed adding CP 0x%x to debug file system\n" , cq->cqn); - cq->uar = dev->priv.uar; + cq->uar = dev->priv.bfreg.up; cq->irqn = eq->core.irqn;return 0 ;
drivers/net/ethernet/mellanox/mlx5/core/en/params.c +1 -1
@@ -810,7 +810,7 @@ static void mlx5e_build_common_cq_param(struct mlx5_core_dev *mdev, {void *cqc = param->cqc; -MLX5_SET (cqc, cqc, uar_page, mdev->priv.uar->index); +MLX5_SET (cqc, cqc, uar_page, mdev->priv.bfreg.up->index);if (MLX5_CAP_GEN (mdev, cqe_128_always) &&cache_line_size () >=128 )MLX5_SET (cqc, cqc, cqe_sz,CQE_STRIDE_128_PAD ); }
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +1 -1
@@ -334,7 +334,7 @@ static int mlx5e_ptp_alloc_txqsq(struct mlx5e_ptp *c, int txq_ix, sq->mdev = mdev; sq->ch_ix =MLX5E_PTP_CHANNEL_IX ; sq->txq_ix = txq_ix; - sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; + sq->uar_map = mdev->priv.bfreg.map; sq->min_inline_mode = params->tx_min_inline_mode; sq->hw_mtu =MLX5E_SW2HW_MTU (params, params->sw_mtu); sq->stats = &c->priv->ptp_stats.sq[tc];
drivers/net/ethernet/mellanox/mlx5/core/en_common.c +1 -10
@@ -163,17 +163,11 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) goto err_dealloc_transport_domain; } - err =mlx5_alloc_bfreg (mdev, &res->bfreg, false, false); -if (err) { -mlx5_core_err (mdev,"alloc bfreg failed, %d\n" , err); - goto err_destroy_mkey; - } -if (create_tises) { err =mlx5e_create_tises (mdev, res->tisn);if (err) {mlx5_core_err (mdev,"alloc tises failed, %d\n" , err); - goto err_destroy_bfreg; + goto err_destroy_mkey; } res->tisn_valid = true; }
@@ -190,8 +184,6 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises)return 0 ; -err_destroy_bfreg: -mlx5_free_bfreg (mdev, &res->bfreg); err_destroy_mkey:mlx5_core_destroy_mkey (mdev, res->mkey); err_dealloc_transport_domain:
@@ -209,7 +201,6 @@ void mlx5e_destroy_mdev_resources(struct mlx5_core_dev *mdev) mdev->mlx5e_res.dek_priv =NULL ;if (res->tisn_valid)mlx5e_destroy_tises (mdev, res->tisn); -mlx5_free_bfreg (mdev, &res->bfreg);mlx5_core_destroy_mkey (mdev, res->mkey);mlx5_core_dealloc_transport_domain (mdev, res->td.tdn);mlx5_core_dealloc_pd (mdev, res->pdn);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +5 -5
@@ -1551,7 +1551,7 @@ static int mlx5e_alloc_xdpsq(struct mlx5e_channel *c, sq->pdev = c->pdev; sq->mkey_be = c->mkey_be; sq->channel = c; - sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; + sq->uar_map = mdev->priv.bfreg.map; sq->min_inline_mode = params->tx_min_inline_mode; sq->hw_mtu =MLX5E_SW2HW_MTU (params, params->sw_mtu) -ETH_FCS_LEN ; sq->xsk_pool = xsk_pool;
@@ -1636,7 +1636,7 @@ static int mlx5e_alloc_icosq(struct mlx5e_channel *c,int err; sq->channel = c; - sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; + sq->uar_map = mdev->priv.bfreg.map; sq->reserved_room = param->stop_room; param->wq.db_numa_node =cpu_to_node (c->cpu);
@@ -1721,7 +1721,7 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c, sq->priv = c->priv; sq->ch_ix = c->ix; sq->txq_ix = txq_ix; - sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; + sq->uar_map = mdev->priv.bfreg.map; sq->min_inline_mode = params->tx_min_inline_mode; sq->hw_mtu =MLX5E_SW2HW_MTU (params, params->sw_mtu); sq->max_sq_mpw_wqebbs =mlx5e_get_max_sq_aligned_wqebbs (mdev);
@@ -1797,7 +1797,7 @@ static int mlx5e_create_sq(struct mlx5_core_dev *mdev,MLX5_SET (sqc, sqc, flush_in_error_en,1 );MLX5_SET (wq, wq, wq_type,MLX5_WQ_TYPE_CYCLIC ); -MLX5_SET (wq, wq, uar_page, mdev->mlx5e_res.hw_objs.bfreg.index); +MLX5_SET (wq, wq, uar_page, mdev->priv.bfreg.index);MLX5_SET (wq, wq, log_wq_pg_sz, csp->wq_ctrl->buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );MLX5_SET64 (wq, wq, dbr_addr, csp->wq_ctrl->db.dma);
@@ -2292,7 +2292,7 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)MLX5_SET (cqc, cqc, cq_period_mode,mlx5e_cq_period_mode (param->cq_period_mode));MLX5_SET (cqc, cqc, c_eqn_or_apu_element, eqn); -MLX5_SET (cqc, cqc, uar_page, mdev->priv.uar->index); +MLX5_SET (cqc, cqc, uar_page, mdev->priv.bfreg.up->index);MLX5_SET (cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );MLX5_SET64 (cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma);
drivers/net/ethernet/mellanox/mlx5/core/eq.c +2 -2
@@ -307,7 +307,7 @@ create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, eqc =MLX5_ADDR_OF (create_eq_in, in, eq_context_entry);MLX5_SET (eqc, eqc, log_eq_size, eq->fbc.log_sz); -MLX5_SET (eqc, eqc, uar_page, priv->uar->index); +MLX5_SET (eqc, eqc, uar_page, priv->bfreg.up->index);MLX5_SET (eqc, eqc, intr, vecidx);MLX5_SET (eqc, eqc, log_page_size, eq->frag_buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );
@@ -320,7 +320,7 @@ create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, eq->eqn =MLX5_GET (create_eq_out, out, eq_number); eq->irqn =pci_irq_vector (dev->pdev, vecidx); eq->dev = dev; - eq->doorbell = priv->uar->map +MLX5_EQ_DOORBELL_OFFSET ; + eq->doorbell = priv->bfreg.up->map +MLX5_EQ_DOORBELL_OFFSET ; err =mlx5_debug_eq_add (dev, eq);if (err)
drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c +4 -4
@@ -100,7 +100,7 @@ static int create_aso_cq(struct mlx5_aso_cq *cq, void *cqc_data)MLX5_SET (cqc, cqc, cq_period_mode,MLX5_CQ_PERIOD_MODE_START_FROM_EQE );MLX5_SET (cqc, cqc, c_eqn_or_apu_element, eqn); -MLX5_SET (cqc, cqc, uar_page, mdev->priv.uar->index); +MLX5_SET (cqc, cqc, uar_page, mdev->priv.bfreg.up->index);MLX5_SET (cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );MLX5_SET64 (cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma);
@@ -129,7 +129,7 @@ static int mlx5_aso_create_cq(struct mlx5_core_dev *mdev, int numa_node,return -ENOMEM ;MLX5_SET (cqc, cqc_data, log_cq_size,1 ); -MLX5_SET (cqc, cqc_data, uar_page, mdev->priv.uar->index); +MLX5_SET (cqc, cqc_data, uar_page, mdev->priv.bfreg.up->index);if (MLX5_CAP_GEN (mdev, cqe_128_always) &&cache_line_size () >=128 )MLX5_SET (cqc, cqc_data, cqe_sz,CQE_STRIDE_128_PAD );
@@ -163,7 +163,7 @@ static int mlx5_aso_alloc_sq(struct mlx5_core_dev *mdev, int numa_node,struct mlx5_wq_param param;int err; - sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; + sq->uar_map = mdev->priv.bfreg.map; param.db_numa_node = numa_node; param.buf_numa_node = numa_node;
@@ -203,7 +203,7 @@ static int create_aso_sq(struct mlx5_core_dev *mdev, int pdn,MLX5_SET (sqc, sqc, ts_format, ts_format);MLX5_SET (wq, wq, wq_type,MLX5_WQ_TYPE_CYCLIC ); -MLX5_SET (wq, wq, uar_page, mdev->mlx5e_res.hw_objs.bfreg.index); +MLX5_SET (wq, wq, uar_page, mdev->priv.bfreg.index);MLX5_SET (wq, wq, log_wq_pg_sz, sq->wq_ctrl.buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );MLX5_SET64 (wq, wq, dbr_addr, sq->wq_ctrl.db.dma);
drivers/net/ethernet/mellanox/mlx5/core/main.c +5 -6
@@ -1340,10 +1340,9 @@ static int mlx5_load(struct mlx5_core_dev *dev) {int err; - dev->priv.uar =mlx5_get_uars_page (dev); -if (IS_ERR (dev->priv.uar)) { -mlx5_core_err (dev,"Failed allocating uar, aborting\n" ); - err =PTR_ERR (dev->priv.uar); + err =mlx5_alloc_bfreg (dev, &dev->priv.bfreg, false, false); +if (err) { +mlx5_core_err (dev,"Failed allocating bfreg, %d\n" , err);return err; }
@@ -1454,7 +1453,7 @@ static int mlx5_load(struct mlx5_core_dev *dev) err_irq_table:mlx5_pagealloc_stop (dev);mlx5_events_stop (dev); -mlx5_put_uars_page (dev, dev->priv.uar); +mlx5_free_bfreg (dev, &dev->priv.bfreg);return err; }
@@ -1479,7 +1478,7 @@ static void mlx5_unload(struct mlx5_core_dev *dev)mlx5_irq_table_destroy (dev);mlx5_pagealloc_stop (dev);mlx5_events_stop (dev); -mlx5_put_uars_page (dev, dev->priv.uar); +mlx5_free_bfreg (dev, &dev->priv.bfreg); }int mlx5_init_one_devl_locked (struct mlx5_core_dev *dev)
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c +4 -4
@@ -690,7 +690,7 @@ static int hws_send_ring_alloc_sq(struct mlx5_core_dev *mdev,size_t buf_sz;int err; - sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; + sq->uar_map = mdev->priv.bfreg.map; sq->mdev = mdev; param.db_numa_node = numa_node;
@@ -764,7 +764,7 @@ static int hws_send_ring_create_sq(struct mlx5_core_dev *mdev, u32 pdn,MLX5_SET (sqc, sqc, ts_format, ts_format);MLX5_SET (wq, wq, wq_type,MLX5_WQ_TYPE_CYCLIC ); -MLX5_SET (wq, wq, uar_page, mdev->mlx5e_res.hw_objs.bfreg.index); +MLX5_SET (wq, wq, uar_page, mdev->priv.bfreg.index);MLX5_SET (wq, wq, log_wq_pg_sz, sq->wq_ctrl.buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );MLX5_SET64 (wq, wq, dbr_addr, sq->wq_ctrl.db.dma);
@@ -940,7 +940,7 @@ static int hws_send_ring_create_cq(struct mlx5_core_dev *mdev, (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas));MLX5_SET (cqc, cqc, c_eqn_or_apu_element, eqn); -MLX5_SET (cqc, cqc, uar_page, mdev->priv.uar->index); +MLX5_SET (cqc, cqc, uar_page, mdev->priv.bfreg.up->index);MLX5_SET (cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );MLX5_SET64 (cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma);
@@ -963,7 +963,7 @@ static int hws_send_ring_open_cq(struct mlx5_core_dev *mdev,if (!cqc_data)return -ENOMEM ; -MLX5_SET (cqc, cqc_data, uar_page, mdev->priv.uar->index); +MLX5_SET (cqc, cqc_data, uar_page, mdev->priv.bfreg.up->index);MLX5_SET (cqc, cqc_data, log_cq_size,ilog2 (queue->num_entries)); err =hws_send_ring_alloc_cq (mdev, numa_node, queue, cqc_data, cq);
drivers/net/ethernet/mellanox/mlx5/core/wc.c +2 -2
@@ -94,7 +94,7 @@ static int create_wc_cq(struct mlx5_wc_cq *cq, void *cqc_data)MLX5_SET (cqc, cqc, cq_period_mode,MLX5_CQ_PERIOD_MODE_START_FROM_EQE );MLX5_SET (cqc, cqc, c_eqn_or_apu_element, eqn); -MLX5_SET (cqc, cqc, uar_page, mdev->priv.uar->index); +MLX5_SET (cqc, cqc, uar_page, mdev->priv.bfreg.up->index);MLX5_SET (cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );MLX5_SET64 (cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma);
@@ -116,7 +116,7 @@ static int mlx5_wc_create_cq(struct mlx5_core_dev *mdev, struct mlx5_wc_cq *cq)return -ENOMEM ;MLX5_SET (cqc, cqc, log_cq_size,TEST_WC_LOG_CQ_SZ ); -MLX5_SET (cqc, cqc, uar_page, mdev->priv.uar->index); +MLX5_SET (cqc, cqc, uar_page, mdev->priv.bfreg.up->index);if (MLX5_CAP_GEN (mdev, cqe_128_always) &&cache_line_size () >=128 )MLX5_SET (cqc, cqc, cqe_sz,CQE_STRIDE_128_PAD );
include/linux/mlx5/driver.h +1 -2
@@ -611,7 +611,7 @@ struct mlx5_priv {struct mlx5_ft_pool *ft_pool;struct mlx5_bfreg_data bfregs; -struct mlx5_uars_page *uar; +struct mlx5_sq_bfreg bfreg;#ifdef CONFIG_MLX5_SF struct mlx5_vhca_state_notifier *vhca_state_notifier;struct mlx5_sf_dev_table *sf_dev_table;
@@ -657,7 +657,6 @@ struct mlx5e_resources {u32 pdn;struct mlx5_td td;u32 mkey; -struct mlx5_sq_bfreg bfreg;#define MLX5_MAX_NUM_TC 8u32 tisn[MLX5_MAX_PORTS ][MLX5_MAX_NUM_TC ];bool tisn_valid;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 80/247 net/mlx5e: Prepare for using different CQ doorbells
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Ratiu <[email protected]>
[ Upstream commit a315b723e87ba4e4573e1e5c759d512f38bdc0b3 ]
Completion queues (CQs) in mlx5 use the same global doorbell, which may become contended when accessed concurrently from many cores.
This patch prepares the CQ management code for supporting different doorbells per CQ. This will be used in downstream patches to allow separate doorbells to be used by channels CQs.
The main change is moving the 'uar' pointer from struct mlx5_core_cq to struct mlx5e_cq, as the uar page to be used is better off stored directly there. Other users of mlx5_core_cq also store the UAR to be used separately and therefore the pointer being removed is dead weight for them. As evidence, in this patch there are two users which set the mcq.uar pointer but didn't use it, Software Steering and old Innova CQ creation code. Instead, they rang the doorbell directly from another pointer.
The 'uar' pointer added to struct mlx5e_cq remains in a hot cacheline (as before), because it may get accessed for each packet.
Stable-dep-of: e5eba42f0134 ("mlx5: Fix default values in create CQ")
--- drivers/net/ethernet/mellanox/mlx5/core/cq.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 5 +---- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++++--- drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c | 1 - .../ethernet/mellanox/mlx5/core/steering/sws/dr_send.c | 1 - include/linux/mlx5/cq.h | 1 - 7 files changed, 9 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cq.c +0 -1
@@ -145,7 +145,6 @@ int mlx5_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq,mlx5_core_dbg (dev,"failed adding CP 0x%x to debug file system\n" , cq->cqn); - cq->uar = dev->priv.bfreg.up; cq->irqn = eq->core.irqn;return 0 ;
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -0
@@ -344,6 +344,7 @@ struct mlx5e_cq {/* data path - accessed per napi poll */ u16 event_ctr;struct napi_struct *napi; +struct mlx5_uars_page *uar;struct mlx5_core_cq mcq;struct mlx5e_ch_stats *ch_stats;
drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +1 -4
@@ -309,10 +309,7 @@ mlx5e_notify_hw(struct mlx5_wq_cyc *wq, u16 pc, void __iomem *uar_map,static inline void mlx5e_cq_arm (struct mlx5e_cq *cq) { -struct mlx5_core_cq *mcq; - - mcq = &cq->mcq; -mlx5_cq_arm (mcq,MLX5_CQ_DB_REQ_NOT , mcq->uar->map, cq->wq.cc); +mlx5_cq_arm (&cq->mcq,MLX5_CQ_DB_REQ_NOT , cq->uar->map, cq->wq.cc); } static inline struct mlx5e_sq_dma *
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +7 -3
@@ -2201,6 +2201,7 @@ static void mlx5e_close_xdpredirect_sq(struct mlx5e_xdpsq *xdpsq)static int mlx5e_alloc_cq_common (struct mlx5_core_dev *mdev,struct net_device *netdev,struct workqueue_struct *workqueue, +struct mlx5_uars_page *uar,struct mlx5e_cq_param *param,struct mlx5e_cq *cq) {
@@ -2232,6 +2233,7 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev, cq->mdev = mdev; cq->netdev = netdev; cq->workqueue = workqueue; + cq->uar = uar;return 0 ; }
@@ -2247,7 +2249,8 @@ static int mlx5e_alloc_cq(struct mlx5_core_dev *mdev, param->wq.db_numa_node = ccp->node; param->eq_ix = ccp->ix; - err =mlx5e_alloc_cq_common (mdev, ccp->netdev, ccp->wq, param, cq); + err =mlx5e_alloc_cq_common (mdev, ccp->netdev, ccp->wq, + mdev->priv.bfreg.up, param, cq); cq->napi = ccp->napi; cq->ch_stats = ccp->ch_stats;
@@ -2292,7 +2295,7 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)MLX5_SET (cqc, cqc, cq_period_mode,mlx5e_cq_period_mode (param->cq_period_mode));MLX5_SET (cqc, cqc, c_eqn_or_apu_element, eqn); -MLX5_SET (cqc, cqc, uar_page, mdev->priv.bfreg.up->index); +MLX5_SET (cqc, cqc, uar_page, cq->uar->index);MLX5_SET (cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift -MLX5_ADAPTER_PAGE_SHIFT );MLX5_SET64 (cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma);
@@ -3584,7 +3587,8 @@ static int mlx5e_alloc_drop_cq(struct mlx5e_priv *priv, param->wq.buf_numa_node =dev_to_node (mlx5_core_dma_dev (mdev)); param->wq.db_numa_node =dev_to_node (mlx5_core_dma_dev (mdev)); -return mlx5e_alloc_cq_common (priv->mdev, priv->netdev, priv->wq, param, cq); +return mlx5e_alloc_cq_common (priv->mdev, priv->netdev, priv->wq, + mdev->priv.bfreg.up, param, cq); } int mlx5e_open_drop_rq(struct mlx5e_priv *priv,
drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c +0 -1
@@ -475,7 +475,6 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size) *conn->cq.mcq.arm_db =0 ; conn->cq.mcq.vector =0 ; conn->cq.mcq.comp = mlx5_fpga_conn_cq_complete; - conn->cq.mcq.uar = fdev->conn_res.uar;tasklet_setup (&conn->cq.tasklet, mlx5_fpga_conn_cq_tasklet);mlx5_fpga_dbg (fdev,"Created CQ #0x%x\n" , conn->cq.mcq.cqn);
drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c +0 -1
@@ -1131,7 +1131,6 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, *cq->mcq.arm_db =cpu_to_be32 (2 <<28 ); cq->mcq.vector =0 ; - cq->mcq.uar = uar; cq->mdev = mdev;return cq;
include/linux/mlx5/cq.h +0 -1
@@ -41,7 +41,6 @@ struct mlx5_core_cq {int cqe_sz;__be32 *set_ci_db;__be32 *arm_db; -struct mlx5_uars_page *uar;refcount_t refcount;struct completion free;unsigned vector;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 81/247 mlx5: Fix default values in create CQ
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akiva Goldberger <[email protected]>
[ Upstream commit e5eba42f01340f73888dfe560be2806057c25913 ]
Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created through the mlx5_ib driver are intended to use this function.
Additionally, all CQs that will use doorbells instead of polling for completions must call mlx5_cq_arm. However, the default CQ creation flow leaves a valid value in the CQ's arm_db field, allowing FW to send interrupts to polling-only CQs in certain corner cases.
These two factors would allow a polling-only kernel CQ to be triggered by an EQ interrupt and call a completion function intended only for user CQs, causing a null pointer exception.
Some areas in the driver have prevented this issue with one-off fixes but did not address the root cause.
This patch fixes the described issue by adding defaults to the create CQ flow. It adds a default dummy completion function to protect against null pointer exceptions, and it sets an invalid command sequence number by default in kernel CQs to prevent the FW from sending an interrupt to the CQ until it is armed. User CQs are responsible for their own initialization values.
Callers of mlx5_core_create_cq are responsible for changing the completion function and arming the CQ per their needs.
--- drivers/infiniband/hw/mlx5/cq.c | 11 +++++--- drivers/net/ethernet/mellanox/mlx5/core/cq.c | 23 +++++++++++++-- .../net/ethernet/mellanox/mlx5/core/en_main.c | 1 - .../ethernet/mellanox/mlx5/core/fpga/conn.c | 15 +++++----- .../mellanox/mlx5/core/steering/hws/send.c | 7 ----- .../mellanox/mlx5/core/steering/sws/dr_send.c | 28 +++++-------------- drivers/vdpa/mlx5/net/mlx5_vnet.c | 6 ++-- include/linux/mlx5/cq.h | 1 + 8 files changed, 44 insertions(+), 48 deletions(-)
drivers/infiniband/hw/mlx5/cq.c +7 -4
@@ -1020,15 +1020,18 @@ int mlx5_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,if (cq->create_flags &IB_UVERBS_CQ_FLAGS_IGNORE_OVERRUN )MLX5_SET (cqc, cqc, oi,1 ); +if (udata) { + cq->mcq.comp = mlx5_add_cq_to_tasklet; + cq->mcq.tasklet_ctx.comp = mlx5_ib_cq_comp; + }else { + cq->mcq.comp = mlx5_ib_cq_comp; + } + err =mlx5_core_create_cq (dev->mdev, &cq->mcq, cqb, inlen, out,sizeof (out));if (err) goto err_cqb;mlx5_ib_dbg (dev,"cqn 0x%x\n" , cq->mcq.cqn); -if (udata) - cq->mcq.tasklet_ctx.comp = mlx5_ib_cq_comp; -else - cq->mcq.comp = mlx5_ib_cq_comp; cq->mcq.event = mlx5_ib_cq_event;INIT_LIST_HEAD (&cq->wc_list);
drivers/net/ethernet/mellanox/mlx5/core/cq.c +20 -3
@@ -66,8 +66,8 @@ void mlx5_cq_tasklet_cb(struct tasklet_struct *t)tasklet_schedule (&ctx->task); } -static void mlx5_add_cq_to_tasklet (struct mlx5_core_cq *cq, -struct mlx5_eqe *eqe) +void mlx5_add_cq_to_tasklet (struct mlx5_core_cq *cq, +struct mlx5_eqe *eqe) {unsigned long flags;struct mlx5_eq_tasklet *tasklet_ctx = cq->tasklet_ctx.priv;
@@ -95,7 +95,15 @@ static void mlx5_add_cq_to_tasklet(struct mlx5_core_cq *cq,if (schedule_tasklet)tasklet_schedule (&tasklet_ctx->task); } +EXPORT_SYMBOL (mlx5_add_cq_to_tasklet); +static void mlx5_core_cq_dummy_cb (struct mlx5_core_cq *cq,struct mlx5_eqe *eqe) +{ +mlx5_core_err (cq->eq->core.dev, +"CQ default completion callback, CQ #%u\n" , cq->cqn); +} + +#define MLX5_CQ_INIT_CMD_SN cpu_to_be32(2 << 28)/* Callers must verify outbox status in case of err */ int mlx5_create_cq (struct mlx5_core_dev *dev,struct mlx5_core_cq *cq,u32 *in,int inlen,u32 *out,int outlen)
@@ -121,10 +129,19 @@ int mlx5_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq, cq->arm_sn =0 ; cq->eq = eq; cq->uid =MLX5_GET (create_cq_in, in, uid); + +/* Kernel CQs must set the arm_db address prior to calling +* this function, allowing for the proper value to be +* initialized. User CQs are responsible for their own +* initialization since they do not use the arm_db field. +*/ +if (cq->arm_db) + *cq->arm_db =MLX5_CQ_INIT_CMD_SN ; +refcount_set (&cq->refcount,1 );init_completion (&cq->free);if (!cq->comp) - cq->comp = mlx5_add_cq_to_tasklet; + cq->comp = mlx5_core_cq_dummy_cb;/* assuming CQ will be deleted before the EQ */ cq->tasklet_ctx.priv = &eq->tasklet_ctx;INIT_LIST_HEAD (&cq->tasklet_ctx.list);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +0 -1
@@ -2218,7 +2218,6 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev, mcq->set_ci_db = cq->wq_ctrl.db.db; mcq->arm_db = cq->wq_ctrl.db.db +1 ; *mcq->set_ci_db =0 ; - *mcq->arm_db =0 ; mcq->vector = param->eq_ix; mcq->comp = mlx5e_completion_event; mcq->event = mlx5e_cq_error_event;
drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c +7 -8
@@ -421,6 +421,13 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size)__be64 *pas;u32 i; + conn->cq.mcq.cqe_sz =64 ; + conn->cq.mcq.set_ci_db = conn->cq.wq_ctrl.db.db; + conn->cq.mcq.arm_db = conn->cq.wq_ctrl.db.db +1 ; + *conn->cq.mcq.set_ci_db =0 ; + conn->cq.mcq.vector =0 ; + conn->cq.mcq.comp = mlx5_fpga_conn_cq_complete; + cq_size =roundup_pow_of_two (cq_size);MLX5_SET (cqc, temp_cqc, log_cq_size,ilog2 (cq_size));
@@ -468,15 +475,7 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size)if (err) goto err_cqwq; - conn->cq.mcq.cqe_sz =64 ; - conn->cq.mcq.set_ci_db = conn->cq.wq_ctrl.db.db; - conn->cq.mcq.arm_db = conn->cq.wq_ctrl.db.db +1 ; - *conn->cq.mcq.set_ci_db =0 ; - *conn->cq.mcq.arm_db =0 ; - conn->cq.mcq.vector =0 ; - conn->cq.mcq.comp = mlx5_fpga_conn_cq_complete;tasklet_setup (&conn->cq.tasklet, mlx5_fpga_conn_cq_tasklet); -mlx5_fpga_dbg (fdev,"Created CQ #0x%x\n" , conn->cq.mcq.cqn); goto out;
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c +0 -7
@@ -873,12 +873,6 @@ static int hws_send_ring_open_sq(struct mlx5hws_context *ctx,return err; } -static void hws_cq_complete (struct mlx5_core_cq *mcq, -struct mlx5_eqe *eqe) -{ -pr_err ("CQ completion CQ: #%u\n" , mcq->cqn); -} - static int hws_send_ring_alloc_cq(struct mlx5_core_dev *mdev, int numa_node, struct mlx5hws_send_engine *queue,
@@ -901,7 +895,6 @@ static int hws_send_ring_alloc_cq(struct mlx5_core_dev *mdev, mcq->cqe_sz =64 ; mcq->set_ci_db = cq->wq_ctrl.db.db; mcq->arm_db = cq->wq_ctrl.db.db +1 ; - mcq->comp = hws_cq_complete;for (i =0 ; i <mlx5_cqwq_get_size (&cq->wq); i++) { cqe =mlx5_cqwq_get_wqe (&cq->wq, i);
drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c +7 -21
@@ -1049,12 +1049,6 @@ static int dr_prepare_qp_to_rts(struct mlx5dr_domain *dmn)return 0 ; } -static void dr_cq_complete (struct mlx5_core_cq *mcq, -struct mlx5_eqe *eqe) -{ -pr_err ("CQ completion CQ: #%u\n" , mcq->cqn); -} -static struct mlx5dr_cq *dr_create_cq (struct mlx5_core_dev *mdev,struct mlx5_uars_page *uar,size_t ncqe)
@@ -1089,6 +1083,13 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, cqe->op_own =MLX5_CQE_INVALID <<4 |MLX5_CQE_OWNER_MASK ; } + cq->mcq.cqe_sz =64 ; + cq->mcq.set_ci_db = cq->wq_ctrl.db.db; + cq->mcq.arm_db = cq->wq_ctrl.db.db +1 ; + *cq->mcq.set_ci_db =0 ; + cq->mcq.vector =0 ; + cq->mdev = mdev; + inlen =MLX5_ST_SZ_BYTES (create_cq_in) +sizeof (u64) * cq->wq_ctrl.buf.npages; in =kvzalloc (inlen,GFP_KERNEL );
@@ -1112,27 +1113,12 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, pas = (__be64 *)MLX5_ADDR_OF (create_cq_in, in, pas);mlx5_fill_page_frag_array (&cq->wq_ctrl.buf, pas); - cq->mcq.comp = dr_cq_complete; - err =mlx5_core_create_cq (mdev, &cq->mcq, in, inlen, out,sizeof (out));kvfree (in);if (err) goto err_cqwq; - cq->mcq.cqe_sz =64 ; - cq->mcq.set_ci_db = cq->wq_ctrl.db.db; - cq->mcq.arm_db = cq->wq_ctrl.db.db +1 ; - *cq->mcq.set_ci_db =0 ; - -/* set no-zero value, in order to avoid the HW to run db-recovery on -* CQ that used in polling mode. -*/ - *cq->mcq.arm_db =cpu_to_be32 (2 <<28 ); - - cq->mcq.vector =0 ; - cq->mdev = mdev; -return cq; err_cqwq:
drivers/vdpa/mlx5/net/mlx5_vnet.c +2 -4
@@ -573,6 +573,8 @@ static int cq_create(struct mlx5_vdpa_net *ndev, u16 idx, u32 num_ent) vcq->mcq.set_ci_db = vcq->db.db; vcq->mcq.arm_db = vcq->db.db +1 ; vcq->mcq.cqe_sz =64 ; + vcq->mcq.comp = mlx5_vdpa_cq_comp; + vcq->cqe = num_ent; err =cq_frag_buf_alloc (ndev, &vcq->buf, num_ent);if (err)
@@ -612,10 +614,6 @@ static int cq_create(struct mlx5_vdpa_net *ndev, u16 idx, u32 num_ent)if (err) goto err_vec; - vcq->mcq.comp = mlx5_vdpa_cq_comp; - vcq->cqe = num_ent; - vcq->mcq.set_ci_db = vcq->db.db; - vcq->mcq.arm_db = vcq->db.db +1 ;mlx5_cq_arm (&mvq->cq.mcq,MLX5_CQ_DB_REQ_NOT , uar_page, mvq->cq.mcq.cons_index);kfree (in);return 0 ;
include/linux/mlx5/cq.h +1 -0
@@ -183,6 +183,7 @@ static inline void mlx5_cq_put(struct mlx5_core_cq *cq)complete (&cq->free); } +void mlx5_add_cq_to_tasklet (struct mlx5_core_cq *cq,struct mlx5_eqe *eqe);int mlx5_create_cq (struct mlx5_core_dev *dev,struct mlx5_core_cq *cq,u32 *in,int inlen,u32 *out,int outlen); int mlx5_core_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 82/247 net_sched: limit try_bulk_dequeue_skb() batches
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0345552a653ce5542affeb69ac5aa52177a5199b ]
After commit 100dfa74cad9 ("inet: dev_queue_xmit() llist adoption") I started seeing many qdisc requeues on IDPF under high TX workload.
$ tc -s qd sh dev eth1 handle 1: ; sleep 1; tc -s qd sh dev eth1 handle 1: qdisc mq 1: root Sent 43534617319319 bytes 268186451819 pkt (dropped 0, overlimits 0 requeues 3532840114) backlog 1056Kb 6675p requeues 3532840114 qdisc mq 1: root Sent 43554665866695 bytes 268309964788 pkt (dropped 0, overlimits 0 requeues 3537737653) backlog 781164b 4822p requeues 3537737653
This is caused by try_bulk_dequeue_skb() being only limited by BQL budget.
perf record -C120-239 -e qdisc:qdisc_dequeue sleep 1 ; perf script
...
netperf 75332 [146] 2711.138269: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1292 skbaddr=0xff378005a1e9f200 netperf 75332 [146] 2711.138953: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1213 skbaddr=0xff378004d607a500 netperf 75330 [144] 2711.139631: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1233 skbaddr=0xff3780046be20100 netperf 75333 [147] 2711.140356: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1093 skbaddr=0xff37800514845b00 netperf 75337 [151] 2711.141037: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1353 skbaddr=0xff37800460753300 netperf 75337 [151] 2711.141877: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1367 skbaddr=0xff378004e72c7b00 netperf 75330 [144] 2711.142643: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1202 skbaddr=0xff3780045bd60000
...
This is bad because :
1) Large batches hold one victim cpu for a very long time.
2) Driver often hit their own TX ring limit (all slots are used).
3) We call dev_requeue_skb()
4) Requeues are using a FIFO (q->gso_skb), breaking qdisc ability to implement FQ or priority scheduling.
5) dequeue_skb() gets packets from q->gso_skb one skb at a time with no xmit_more support. This is causing many spinlock games between the qdisc and the device driver.
Requeues were supposed to be very rare, lets keep them this way.
Limit batch sizes to /proc/sys/net/core/dev_weight (default 64) as __qdisc_run() was designed to use.
--- net/sched/sch_generic.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
net/sched/sch_generic.c +10 -7
@@ -180,9 +180,10 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)static void try_bulk_dequeue_skb (struct Qdisc *q,struct sk_buff *skb,const struct netdev_queue *txq, -int *packets) +int *packets,int budget) {int bytelimit =qdisc_avail_bulklimit (txq) - skb->len; +int cnt =0 ;while (bytelimit >0 ) {struct sk_buff *nskb = q->dequeue (q);
@@ -193,8 +194,10 @@ static void try_bulk_dequeue_skb(struct Qdisc *q, bytelimit -= nskb->len;/* covers GSO len */ skb->next = nskb; skb = nskb; - (*packets)++;/* GSO counts as one pkt */ +if (++cnt >= budget) +break ; } + (*packets) += cnt;skb_mark_not_on_list (skb); }
@@ -228,7 +231,7 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q,* A requeued skb (via q->gso_skb) can also be a SKB list. */ static struct sk_buff *dequeue_skb (struct Qdisc *q,bool *validate, -int *packets) +int *packets,int budget) {const struct netdev_queue *txq = q->dev_queue;struct sk_buff *skb =NULL ;
@@ -295,7 +298,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,if (skb) { bulk:if (qdisc_may_bulk (q)) -try_bulk_dequeue_skb (q, skb, txq, packets); +try_bulk_dequeue_skb (q, skb, txq, packets, budget);else try_bulk_dequeue_skb_slow (q, skb, packets); }
@@ -387,7 +390,7 @@ bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,* >0 - queue is not empty. * */ -static inline bool qdisc_restart (struct Qdisc *q,int *packets) +static inline bool qdisc_restart (struct Qdisc *q,int *packets,int budget) {spinlock_t *root_lock =NULL ;struct netdev_queue *txq;
@@ -396,7 +399,7 @@ static inline bool qdisc_restart(struct Qdisc *q, int *packets)bool validate;/* Dequeue packet */ - skb =dequeue_skb (q, &validate, packets); + skb =dequeue_skb (q, &validate, packets, budget);if (unlikely (!skb))return false;
@@ -414,7 +417,7 @@ void __qdisc_run(struct Qdisc *q)int quota =READ_ONCE (net_hotdata.dev_tx_weight);int packets; -while (qdisc_restart (q, &packets)) { +while (qdisc_restart (q, &packets, quota)) { quota -= packets;if (quota <=0 ) {if (q->flags &TCQ_F_NOLOCK )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 83/247 wifi: iwlwifi: mvm: fix beacon template/fixed rate
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 3592c0083fb29cca13cd9978b8844d58b4eff548 ]
During the development of the rate changes, I evidently made some changes that shouldn't have been there; beacon templates with rate_n_flags are only in old versions, so no changes to them should have been necessary, and evidently broke on some devices. This also would have broken fixed (injection) rates, it would seem. Restore the old handling of this.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 13 +++---------- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 12 +++++++++--- 2 files changed, 12 insertions(+), 13 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +3 -10
@@ -938,19 +938,12 @@ u8 iwl_mvm_mac_ctxt_get_lowest_rate(struct iwl_mvm *mvm,u16 iwl_mvm_mac_ctxt_get_beacon_flags (const struct iwl_fw *fw,u8 rate_idx) { +u16 flags =iwl_mvm_mac80211_idx_to_hwrate (fw, rate_idx);bool is_new_rate =iwl_fw_lookup_cmd_ver (fw,BEACON_TEMPLATE_CMD ,0 ) >10 ; -u16 flags, cck_flag; - -if (is_new_rate) { - flags =iwl_mvm_mac80211_idx_to_hwrate (fw, rate_idx); - cck_flag =IWL_MAC_BEACON_CCK ; - }else { - cck_flag =IWL_MAC_BEACON_CCK_V1 ; - flags =iwl_fw_rate_idx_to_plcp (rate_idx); - }if (rate_idx <=IWL_LAST_CCK_RATE ) - flags |= cck_flag; + flags |= is_new_rate ?IWL_MAC_BEACON_CCK + :IWL_MAC_BEACON_CCK_V1 ;return flags; }
drivers/net/wireless/intel/iwlwifi/mvm/utils.c +9 -3
@@ -169,9 +169,15 @@ int iwl_mvm_legacy_rate_to_mac80211_idx(u32 rate_n_flags,u8 iwl_mvm_mac80211_idx_to_hwrate (const struct iwl_fw *fw,int rate_idx) { -return (rate_idx >=IWL_FIRST_OFDM_RATE ? - rate_idx -IWL_FIRST_OFDM_RATE : - rate_idx); +if (iwl_fw_lookup_cmd_ver (fw,TX_CMD ,0 ) >8 ) +/* In the new rate legacy rates are indexed: +* 0 - 3 for CCK and 0 - 7 for OFDM. +*/ +return (rate_idx >=IWL_FIRST_OFDM_RATE ? + rate_idx -IWL_FIRST_OFDM_RATE : + rate_idx); + +return iwl_fw_rate_idx_to_plcp (rate_idx); }u8 iwl_mvm_mac80211_ac_to_ucode_ac (enum ieee80211_ac_numbers ac)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 84/247 wifi: iwlwifi: mld: always take beacon ies in link grading
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 1a222625b468effd13d1ebb662c36a41c28a835a ]
One of the factors of a link's grade is the channel load, which is calculated from the AP's bss load element.
The current code takes this element from the beacon for an active link, and from bss->ies for an inactive link.
bss->ies is set to either the beacon's ies or to the probe response ones, with preference to the probe response (meaning that if there was even one probe response, the ies of it will be stored in bss->ies and won't be overiden by the beacon ies).
The probe response can be very old, i.e. from the connection time, where a beacon is updated before each link selection (which is triggered only after a passive scan).
In such case, the bss load element in the probe response will not include the channel load caused by the STA, where the beacon will.
This will cause the inactive link to always have a lower channel load, and therefore an higher grade than the active link's one.
This causes repeated link switches, causing the throughput to drop.
Fix this by always taking the ies from the beacon, as those are for sure new.
--- drivers/net/wireless/intel/iwlwifi/mld/link.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/mld/link.c +1 -6
@@ -701,18 +701,13 @@ static int iwl_mld_get_chan_load_from_element(struct iwl_mld *mld, struct ieee80211_bss_conf *link_conf) { - struct ieee80211_vif *vif = link_conf->vif; const struct cfg80211_bss_ies *ies;const struct element *bss_load_elem =NULL ;const struct ieee80211_bss_load_elem *bss_load;guard (rcu)(); -if (ieee80211_vif_link_active (vif, link_conf->link_id)) - ies =rcu_dereference (link_conf->bss->beacon_ies); -else - ies =rcu_dereference (link_conf->bss->ies); - + ies =rcu_dereference (link_conf->bss->beacon_ies);if (ies) bss_load_elem =cfg80211_find_elem (WLAN_EID_QBSS_LOAD , ies->data, ies->len);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 85/247 virtio-net: fix incorrect flags recording in big mode
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuan Zhuo <[email protected]>
[ Upstream commit 0eff2eaa5322b5b141ff5d5ded26fac4a52b5f7b ]
The purpose of commit 703eec1b2422 ("virtio_net: fixing XDP for fully checksummed packets handling") is to record the flags in advance, as their value may be overwritten in the XDP case. However, the flags recorded under big mode are incorrect, because in big mode, the passed buf does not point to the rx buffer, but rather to the page of the submitted buffer. This commit fixes this issue.
For the small mode, the commit c11a49d58ad2 ("virtio_net: Fix mismatched buf address when unmapping for small packets") fixed it.
--- drivers/net/virtio_net.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/net/virtio_net.c +11 -5
@@ -2632,22 +2632,28 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq,return ; } -/* 1. Save the flags early, as the XDP program might overwrite them. +/* About the flags below: +* 1. Save the flags early, as the XDP program might overwrite them. * These flags ensure packets marked as VIRTIO_NET_HDR_F_DATA_VALID * stay valid after XDP processing. * 2. XDP doesn't work with partially checksummed packets (refer to * virtnet_xdp_set()), so packets marked as * VIRTIO_NET_HDR_F_NEEDS_CSUM get dropped during XDP processing. */ - flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; -if (vi->mergeable_rx_bufs) +if (vi->mergeable_rx_bufs) { + flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; skb =receive_mergeable (dev, vi, rq, buf, ctx, len, xdp_xmit, stats); -else if (vi->big_packets) + }else if (vi->big_packets) { +void *p =page_address ((struct page *)buf); + + flags = ((struct virtio_net_common_hdr *)p)->hdr.flags; skb =receive_big (dev, vi, rq, buf, len, stats); -else + }else { + flags = ((struct virtio_net_common_hdr *)buf)->hdr.flags; skb =receive_small (dev, vi, rq, buf, ctx, len, xdp_xmit, stats); + }if (unlikely (!skb))return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 86/247 hsr: Fix supervision frame sending on HSRv0
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Maurer <[email protected]>
[ Upstream commit 96a3a03abf3d8cc38cd9cb0d280235fbcf7c3f7f ]
On HSRv0, no supervision frames were sent. The supervison frames were generated successfully, but failed the check for a sufficiently long mac header, i.e., at least sizeof(struct hsr_ethhdr), in hsr_fill_frame_info() because the mac header only contained the ethernet header.
Fix this by including the HSR header in the mac header when generating HSR supervision frames. Note that the mac header now also includes the TLV fields. This matches how we set the headers on rx and also the size of struct hsrv0_ethhdr_sp.
--- net/hsr/hsr_device.c | 3 +++ 1 file changed, 3 insertions(+)
net/hsr/hsr_device.c +3 -0
@@ -320,6 +320,9 @@ static void send_hsr_supervision_frame(struct hsr_port *port, } hsr_stag =skb_put (skb,sizeof (struct hsr_sup_tag )); +skb_set_network_header (skb,ETH_HLEN +HSR_HLEN ); +skb_reset_mac_len (skb); +set_hsr_stag_path (hsr_stag, (hsr->prot_version ?0x0 :0xf ));set_hsr_stag_HSR_ver (hsr_stag, hsr->prot_version);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 87/247 hsr: Follow standard for HSRv0 supervision frames
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Maurer <[email protected]>
[ Upstream commit b2c26c82f7a94ec4da096f370e3612ee14424450 ]
For HSRv0, the path_id has the following meaning:
- 0000: PRP supervision frame
- 0001-1001: HSR ring identifier
- 1010-1011: Frames from PRP network (A/B, with RedBoxes)
- 1111: HSR supervision frame
Follow the IEC 62439-3:2010 standard more closely by setting the right path_id for HSRv0 supervision frames (actually, it is correctly set when the frame is constructed, but hsr_set_path_id() overwrites it) and set a fixed HSR ring identifier of 1. The ring identifier seems to be generally unused and we ignore it anyways on reception, but some fixed identifier is definitely better than using one identifier in one direction and a wrong identifier in the other.
This was also the behavior before commit f266a683a480 ("net/hsr: Better frame dispatch") which introduced the alternating path_id. This was later moved to hsr_set_path_id() in commit 451d8123f897 ("net: prp: add packet handling support").
The IEC 62439-3:2010 also contains 6 unused bytes after the MacAddressA in the HSRv0 supervision frames. Adjust a TODO comment accordingly.
--- net/hsr/hsr_device.c | 2 +- net/hsr/hsr_forward.c | 22 +++++++++++++++------- 2 files changed, 16 insertions(+), 8 deletions(-)
net/hsr/hsr_device.c +1 -1
@@ -337,7 +337,7 @@ static void send_hsr_supervision_frame(struct hsr_port *port, } hsr_stag->tlv.HSR_TLV_type = type; -/* TODO: Why 12 in HSRv0? */ +/* HSRv0 has 6 unused bytes after the MAC */ hsr_stag->tlv.HSR_TLV_length = hsr->prot_version ?sizeof (struct hsr_sup_payload ) :12 ;
net/hsr/hsr_forward.c +15 -7
@@ -262,15 +262,23 @@ static struct sk_buff *prp_fill_rct(struct sk_buff *skb,return skb; } -static void hsr_set_path_id (struct hsr_ethhdr *hsr_ethhdr, +static void hsr_set_path_id (struct hsr_frame_info *frame, +struct hsr_ethhdr *hsr_ethhdr,struct hsr_port *port) {int path_id; -if (port->type ==HSR_PT_SLAVE_A ) - path_id =0 ; -else - path_id =1 ; +if (port->hsr->prot_version) { +if (port->type ==HSR_PT_SLAVE_A ) + path_id =0 ; +else + path_id =1 ; + }else { +if (frame->is_supervision) + path_id =0xf ; +else + path_id =1 ; + }set_hsr_tag_path (&hsr_ethhdr->hsr_tag, path_id); }
@@ -304,7 +312,7 @@ static struct sk_buff *hsr_fill_tag(struct sk_buff *skb,else hsr_ethhdr = (struct hsr_ethhdr *)pc; -hsr_set_path_id (hsr_ethhdr, port); +hsr_set_path_id (frame, hsr_ethhdr, port);set_hsr_tag_LSDU_size (&hsr_ethhdr->hsr_tag, lsdu_size); hsr_ethhdr->hsr_tag.sequence_nr =htons (frame->sequence_nr); hsr_ethhdr->hsr_tag.encap_proto = hsr_ethhdr->ethhdr.h_proto;
@@ -330,7 +338,7 @@ struct sk_buff *hsr_create_tagged_frame(struct hsr_frame_info *frame, (struct hsr_ethhdr *)skb_mac_header (frame->skb_hsr);/* set the lane id properly */ -hsr_set_path_id (hsr_ethhdr, port); +hsr_set_path_id (frame, hsr_ethhdr, port);return skb_clone (frame->skb_hsr,GFP_ATOMIC ); }else if (port->dev->features &NETIF_F_HW_HSR_TAG_INS ) {return skb_clone (frame->skb_std,GFP_ATOMIC );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 88/247 ACPI: CPPC: Detect preferred core availability on online CPUs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 4fe5934db4a7187d358f1af1b3ef9b6dd59bce58 ]
Commit 279f838a61f9 ("x86/amd: Detect preferred cores in amd_get_boost_ratio_numerator()") introduced the ability to detect the preferred core on AMD platforms by checking if there at least two distinct highest_perf values.
However, it uses for_each_present_cpu() to iterate through all the CPUs in the platform, which is problematic when the kernel is booted with "nosmt=force" commandline option.
Hence limit the search to only the online CPUs.
--- arch/x86/kernel/acpi/cppc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/acpi/cppc.c +1 -1
@@ -196,7 +196,7 @@ int amd_detect_prefcore(bool *detected)break ; } -for_each_present_cpu (cpu) { +for_each_online_cpu (cpu) {u32 tmp;int ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 89/247 ACPI: CPPC: Check _CPC validity for only the online CPUs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 6dd3b8a709a130a4d55c866af9804c81b8486d28 ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe().
However the function acpi_cpc_valid() checks for the validity of the _CPC object for all the present CPUs. This breaks when the kernel is booted with "nosmt=force".
Hence check the validity of the _CPC objects of only the online CPUs.
--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
@@ -460,7 +460,7 @@ bool acpi_cpc_valid(void)if (acpi_disabled)return false; -for_each_present_cpu (cpu) { +for_each_online_cpu (cpu) { cpc_ptr =per_cpu (cpc_desc_ptr, cpu);if (!cpc_ptr)return false;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 90/247 ACPI: CPPC: Perform fast check switch only for online CPUs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 8821c8e80a65bc4eb73daf63b34aac6b8ad69461 ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe().
However the function cppc_allow_fast_switch() checks for the validity of the _CPC object for all the present CPUs. This breaks when the kernel is booted with "nosmt=force".
Check fast_switch capability only on online CPUs
--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
@@ -476,7 +476,7 @@ bool cppc_allow_fast_switch(void)struct cpc_desc *cpc_ptr;int cpu; -for_each_present_cpu (cpu) { +for_each_online_cpu (cpu) { cpc_ptr =per_cpu (cpc_desc_ptr, cpu); desired_reg = &cpc_ptr->cpc_regs[DESIRED_PERF ]; if (!CPC_IN_SYSTEM_MEMORY(desired_reg) &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 91/247 ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <[email protected]>
[ Upstream commit 0fce75870666b46b700cfbd3216380b422f975da ]
per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPU via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe().
However the function cppc_perf_ctrs_in_pcc() checks if the CPPC perf-ctrs are in a PCC region for all the present CPUs, which breaks when the kernel is booted with "nosmt=force".
Hence, limit the check only to the online CPUs.
--- drivers/acpi/cppc_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/cppc_acpi.c +1 -1
@@ -1435,7 +1435,7 @@ bool cppc_perf_ctrs_in_pcc(void) {int cpu; -for_each_present_cpu (cpu) { +for_each_online_cpu (cpu) {struct cpc_register_resource *ref_perf_reg;struct cpc_desc *cpc_desc;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 92/247 cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
[ Upstream commit 4b747cc628d8f500d56cf1338280eacc66362ff3 ]
Commit ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode") introduced a check for feature X86_FEATURE_IDA to verify turbo mode support. Although this is the correct way to check for turbo mode support, it causes issues on some platforms that disable turbo during OS boot, but enable it later [1]. Before adding this feature check, users were able to get turbo mode frequencies by writing 0 to /sys/devices/system/cpu/intel_pstate/no_turbo post-boot.
To restore the old behavior on the affected systems while still addressing the unchecked MSR issue on some Skylake-X systems, check X86_FEATURE_IDA only immediately before updates of MSR_IA32_PERF_CTL that may involve setting the Turbo Engage Bit (bit 32).
--- drivers/cpufreq/intel_pstate.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/cpufreq/intel_pstate.c +4 -5
@@ -603,9 +603,6 @@ static bool turbo_is_disabled(void) {u64 misc_en; -if (!cpu_feature_enabled (X86_FEATURE_IDA )) -return true; -rdmsrq (MSR_IA32_MISC_ENABLE , misc_en);return !!(misc_en &MSR_IA32_MISC_ENABLE_TURBO_DISABLE );
@@ -2141,7 +2138,8 @@ static u64 atom_get_val(struct cpudata *cpudata, int pstate)u32 vid; val = (u64 )pstate <<8 ; -if (READ_ONCE (global.no_turbo) && !READ_ONCE (global.turbo_disabled)) +if (READ_ONCE (global.no_turbo) && !READ_ONCE (global.turbo_disabled) && +cpu_feature_enabled (X86_FEATURE_IDA )) val |= (u64 )1 <<32 ; vid_fp = cpudata->vid.min + mul_fp(
@@ -2306,7 +2304,8 @@ static u64 core_get_val(struct cpudata *cpudata, int pstate)u64 val; val = (u64 )pstate <<8 ; -if (READ_ONCE (global.no_turbo) && !READ_ONCE (global.turbo_disabled)) +if (READ_ONCE (global.no_turbo) && !READ_ONCE (global.turbo_disabled) && +cpu_feature_enabled (X86_FEATURE_IDA )) val |= (u64 )1 <<32 ;return val;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 93/247 Bluetooth: L2CAP: export l2cap_chan_hold for modules
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <[email protected]>
[ Upstream commit e060088db0bdf7932e0e3c2d24b7371c4c5b867c ]
l2cap_chan_put() is exported, so export also l2cap_chan_hold() for modules.
l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c
--- net/bluetooth/l2cap_core.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/l2cap_core.c +1 -0
@@ -497,6 +497,7 @@ void l2cap_chan_hold(struct l2cap_chan *c)kref_get (&c->kref); } +EXPORT_SYMBOL_GPL (l2cap_chan_hold);struct l2cap_chan *l2cap_chan_hold_unless_zero (struct l2cap_chan *c) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 94/247 netfilter: nft_ct: add seqadj extension for natted connections
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Melnychenko <[email protected]>
[ Upstream commit 90918e3b6404c2a37837b8f11692471b4c512de2 ]
Sequence adjustment may be required for FTP traffic with PASV/EPSV modes. due to need to re-write packet payload (IP, port) on the ftp control connection. This can require changes to the TCP length and expected seq / ack_seq.
The easiest way to reproduce this issue is with PASV mode. Example ruleset:
table inet ftp_nat {
ct helper ftp_helper {
type "ftp" protocol tcp
l3proto inet
}
chain prerouting {
type filter hook prerouting priority 0; policy accept;
tcp dport 21 ct state new ct helper set "ftp_helper"
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority -100; policy accept;
tcp dport 21 dnat ip prefix to ip daddr map {
192.168.100.1 : 192.168.13.2/32 }
}
chain postrouting {
type nat hook postrouting priority 100 ; policy accept;
tcp sport 21 snat ip prefix to ip saddr map {
192.168.13.2 : 192.168.100.1/32 }
}
}Note that the ftp helper gets assigned *after* the dnat setup.
The inverse (nat after helper assign) is handled by an existing check in nf_nat_setup_info() and will not show the problem.
Topoloy:
+-------------------+ +----------------------------------+
| FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 |
+-------------------+ +----------------------------------+
|
+-----------------------+
| Client: 192.168.100.2 |
+-----------------------+ftp nat changes do not work as expected in this case:
Connected to 192.168.100.1.
[..]
ftp> epsv
EPSV/EPRT on IPv4 off.
ftp> ls
227 Entering passive mode (192,168,100,1,209,129). 421 Service not available, remote server has closed connection.
Kernel logs:
Missing nfct_seqadj_ext_add() setup call
WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41 [..] __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat] nf_nat_ftp+0x142/0x280 [nf_nat_ftp] help+0x4d1/0x880 [nf_conntrack_ftp] nf_confirm+0x122/0x2e0 [nf_conntrack] nf_hook_slow+0x3c/0xb0 ..
Fix this by adding the required extension when a conntrack helper is assigned to a connection that has a nat binding.
--- net/netfilter/nft_ct.c | 5 +++++ 1 file changed, 5 insertions(+)
net/netfilter/nft_ct.c +5 -0
@@ -22,6 +22,7 @@#include <net/netfilter/nf_conntrack_timeout.h> #include <net/netfilter/nf_conntrack_l4proto.h> #include <net/netfilter/nf_conntrack_expect.h> +#include <net/netfilter/nf_conntrack_seqadj.h> struct nft_ct_helper_obj {struct nf_conntrack_helper *helper4;
@@ -1173,6 +1174,10 @@ static void nft_ct_helper_obj_eval(struct nft_object *obj,if (help) {rcu_assign_pointer (help->helper, to_assign);set_bit (IPS_HELPER_BIT , &ct->status); + +if ((ct->status &IPS_NAT_MASK ) && !nfct_seqadj (ct)) +if (!nfct_seqadj_ext_add (ct)) + regs->verdict.code =NF_DROP ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 95/247 io_uring/rsrc: dont use blk_rq_nr_phys_segments() as number of bvecs
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Sander Mateos <[email protected]>
[ Upstream commit 2d0e88f3fd1dcb37072d499c36162baf5b009d41 ]
io_buffer_register_bvec() currently uses blk_rq_nr_phys_segments() as the number of bvecs in the request. However, bvecs may be split into multiple segments depending on the queue limits. Thus, the number of segments may overestimate the number of bvecs. For ublk devices, the only current users of io_buffer_register_bvec(), virt_boundary_mask, seg_boundary_mask, max_segments, and max_segment_size can all be set arbitrarily by the ublk server process.
Set imu->nr_bvecs based on the number of bvecs the rq_for_each_bvec() loop actually yields. However, continue using blk_rq_nr_phys_segments() as an upper bound on the number of bvecs when allocating imu to avoid needing to iterate the bvecs a second time.
--- io_uring/rsrc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
io_uring/rsrc.c +9 -7
@@ -942,8 +942,8 @@ int io_buffer_register_bvec(struct io_uring_cmd *cmd, struct request *rq,struct req_iterator rq_iter;struct io_mapped_ubuf *imu;struct io_rsrc_node *node; -struct bio_vec bv, *bvec; -u16 nr_bvecs; +struct bio_vec bv; +unsigned int nr_bvecs =0 ;int ret =0 ;io_ring_submit_lock (ctx, issue_flags);
@@ -964,8 +964,11 @@ int io_buffer_register_bvec(struct io_uring_cmd *cmd, struct request *rq, goto unlock; } - nr_bvecs =blk_rq_nr_phys_segments (rq); - imu =io_alloc_imu (ctx, nr_bvecs); +/* +* blk_rq_nr_phys_segments() may overestimate the number of bvecs +* but avoids needing to iterate over the bvecs +*/ + imu =io_alloc_imu (ctx,blk_rq_nr_phys_segments (rq));if (!imu) {kfree (node); ret = -ENOMEM ;
@@ -976,16 +979,15 @@ int io_buffer_register_bvec(struct io_uring_cmd *cmd, struct request *rq, imu->len =blk_rq_bytes (rq); imu->acct_pages =0 ; imu->folio_shift =PAGE_SHIFT ; - imu->nr_bvecs = nr_bvecs;refcount_set (&imu->refs,1 ); imu->release = release; imu->priv = rq; imu->is_kbuf = true; imu->dir =1 <<rq_data_dir (rq); - bvec = imu->bvec;rq_for_each_bvec (bv, rq, rq_iter) - *bvec++ = bv; + imu->bvec[nr_bvecs++] = bv; + imu->nr_bvecs = nr_bvecs; node->buf = imu; data->nodes[index] = node;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 96/247 acpi,srat: Fix incorrect device handle check for Generic Initiator
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit 7c3643f204edf1c5edb12b36b34838683ee5f8dc ]
The Generic Initiator Affinity Structure in SRAT table uses device handle type field to indicate the device type. According to ACPI specification, the device handle type value of 1 represents PCI device, not 0.
--- drivers/acpi/numa/srat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/numa/srat.c +1 -1
@@ -237,7 +237,7 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header)struct acpi_srat_generic_affinity *p = (struct acpi_srat_generic_affinity *)header; -if (p->device_handle_type ==0 ) { +if (p->device_handle_type ==1 ) {/* * For pci devices this may be the only place they * are assigned a proximity domain
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 97/247 regulator: fixed: fix GPIO descriptor leak on register failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 636f4618b1cd96f6b5a2b8c7c4f665c8533ecf13 ]
In the commit referenced by the Fixes tag, devm_gpiod_get_optional() was replaced by manual
GPIO management, relying on the regulator core to release the GPIO descriptor. However, this approach does not account for the error path: when regulator registration fails, the core never takes over the GPIO, resulting in a resource leak.
Add gpiod_put() before returning on regulator registration failure.
--- drivers/regulator/fixed.c | 1 + 1 file changed, 1 insertion(+)
drivers/regulator/fixed.c +1 -0
@@ -334,6 +334,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) ret =dev_err_probe (&pdev->dev,PTR_ERR (drvdata->dev),"Failed to register regulator: %ld\n" ,PTR_ERR (drvdata->dev)); +gpiod_put (cfg.ena_gpiod);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 98/247 ASoC: cs4271: Fix regulator leak on probe failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 6b6eddc63ce871897d3a5bc4f8f593e698aef104 ]
The probe function enables regulators at the beginning but fails to disable them in its error handling path. If any operation after enabling the regulators fails, the probe will exit with an error, leaving the regulators permanently enabled, which could lead to a resource leak.
Add a proper error handling path to call regulator_bulk_disable() before returning an error.
--- sound/soc/codecs/cs4271.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/codecs/cs4271.c +7 -3
@@ -581,17 +581,17 @@ static int cs4271_component_probe(struct snd_soc_component *component) ret =regcache_sync (cs4271->regmap);if (ret <0 ) -return ret; + goto err_disable_regulator; ret =regmap_update_bits (cs4271->regmap,CS4271_MODE2 ,CS4271_MODE2_PDN |CS4271_MODE2_CPEN ,CS4271_MODE2_PDN |CS4271_MODE2_CPEN );if (ret <0 ) -return ret; + goto err_disable_regulator; ret =regmap_update_bits (cs4271->regmap,CS4271_MODE2 ,CS4271_MODE2_PDN ,0 );if (ret <0 ) -return ret; + goto err_disable_regulator;/* Power-up sequence requires 85 uS */ udelay (85 );
@@ -601,6 +601,10 @@ static int cs4271_component_probe(struct snd_soc_component *component) CS4271_MODE2_MUTECAEQUB);return 0 ; + +err_disable_regulator: +regulator_bulk_disable (ARRAY_SIZE (cs4271->supplies), cs4271->supplies); +return ret; }static void cs4271_component_remove (struct snd_soc_component *component)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 99/247 ASoC: codecs: va-macro: fix resource leak in probe error path
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 3dc8c73365d3ca25c99e7e1a0f493039d7291df5 ]
In the commit referenced by the Fixes tag, clk_hw_get_clk() was added in va_macro_probe() to get the fsgen clock, but forgot to add the corresponding clk_put() in va_macro_remove(). This leads to a clock reference leak when the driver is unloaded.
Switch to devm_clk_hw_get_clk() to automatically manage the clock resource.
--- sound/soc/codecs/lpass-va-macro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/lpass-va-macro.c +1 -1
@@ -1636,7 +1636,7 @@ static int va_macro_probe(struct platform_device *pdev)if (ret) goto err_clkout; - va->fsgen =clk_hw_get_clk (&va->hw,"fsgen" ); + va->fsgen =devm_clk_hw_get_clk (dev, &va->hw,"fsgen" );if (IS_ERR (va->fsgen)) { ret =PTR_ERR (va->fsgen); goto err_clkout;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 100/247 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af ]
This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +5 -0
@@ -3668,6 +3668,11 @@ static int vmw_cmd_check(struct vmw_private *dev_priv, cmd_id = header->id; +if (header->size >SVGA_CMD_MAX_DATASIZE ) { +VMW_DEBUG_USER ("SVGA3D command: %d is too big.\n" , + cmd_id +SVGA_3D_CMD_BASE ); +return -E2BIG ; + } *size = header->size +sizeof (SVGA3dCmdHeader); cmd_id -=SVGA_3D_CMD_BASE ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 101/247 drm/vmwgfx: Restore Guest-Backed only cursor plane support
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit eef295a8508202e750e4f103a97447f3c9d5e3d0 ]
The referenced fixes commit broke the cursor plane for configurations which have Guest-Backed surfaces but no cursor MOB support.
--- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 16 +++++++++++++++- drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.h | 1 + 2 files changed, 16 insertions(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c +15 -1
@@ -100,8 +100,10 @@ vmw_cursor_update_type(struct vmw_private *vmw, struct vmw_plane_state *vps)if (vmw->has_mob) {if ((vmw->capabilities2 &SVGA_CAP2_CURSOR_MOB ) !=0 )return VMW_CURSOR_UPDATE_MOB ; +else +return VMW_CURSOR_UPDATE_GB_ONLY ; } - +drm_warn_once (&vmw->drm,"Unknown Cursor Type!\n" );return VMW_CURSOR_UPDATE_NONE ; }
@@ -139,6 +141,7 @@ static u32 vmw_cursor_mob_size(enum vmw_cursor_update_type update_type, {switch (update_type) {case VMW_CURSOR_UPDATE_LEGACY : +case VMW_CURSOR_UPDATE_GB_ONLY :case VMW_CURSOR_UPDATE_NONE :return 0 ;case VMW_CURSOR_UPDATE_MOB :
@@ -623,6 +626,7 @@ int vmw_cursor_plane_prepare_fb(struct drm_plane *plane,if (!surface || vps->cursor.legacy.id == surface->snooper.id) vps->cursor.update_type =VMW_CURSOR_UPDATE_NONE ;break ; +case VMW_CURSOR_UPDATE_GB_ONLY :case VMW_CURSOR_UPDATE_MOB : { bo =vmw_user_object_buffer (&vps->uo);if (bo) {
@@ -737,6 +741,7 @@ void vmw_cursor_plane_atomic_update(struct drm_plane *plane, struct drm_atomic_state *state) { + struct vmw_bo *bo;struct drm_plane_state *new_state =drm_atomic_get_new_plane_state (state, plane); struct drm_plane_state *old_state =
@@ -762,6 +767,15 @@ vmw_cursor_plane_atomic_update(struct drm_plane *plane,case VMW_CURSOR_UPDATE_MOB :vmw_cursor_update_mob (dev_priv, vps);break ; +case VMW_CURSOR_UPDATE_GB_ONLY : + bo =vmw_user_object_buffer (&vps->uo); +if (bo) +vmw_send_define_cursor_cmd (dev_priv, bo->map.virtual, + vps->base.crtc_w, + vps->base.crtc_h, + vps->base.hotspot_x, + vps->base.hotspot_y); +break ;case VMW_CURSOR_UPDATE_NONE :/* do nothing */ break ;
drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.h +1 -0
@@ -33,6 +33,7 @@ static const u32 __maybe_unused vmw_cursor_plane_formats[] = {enum vmw_cursor_update_type {VMW_CURSOR_UPDATE_NONE =0 ,VMW_CURSOR_UPDATE_LEGACY , +VMW_CURSOR_UPDATE_GB_ONLY ,VMW_CURSOR_UPDATE_MOB , };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 102/247 ASoC: tas2781: fix getting the wrong device number
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
[ Upstream commit 29528c8e643bb0c54da01237a35010c6438423d2 ]
The return value of device_property_read_u32_array used for getting the property is the status instead of the number of the property.
--- sound/soc/codecs/tas2781-i2c.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2781-i2c.c +7 -2
@@ -1864,7 +1864,8 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) {struct i2c_client *client = (struct i2c_client *)tas_priv->client;unsigned int dev_addrs[TASDEVICE_MAX_CHANNELS ]; -int i, ndev =0 ; +int ndev =0 ; +int i, rc;if (tas_priv->isacpi) { ndev = device_property_read_u32_array(&client->dev,
@@ -1875,8 +1876,12 @@ static void tasdevice_parse_dt(struct tasdevice_priv *tas_priv) }else { ndev = (ndev <ARRAY_SIZE (dev_addrs)) ? ndev :ARRAY_SIZE (dev_addrs); - ndev =device_property_read_u32_array (&client->dev, + rc =device_property_read_u32_array (&client->dev,"ti,audio-slots" , dev_addrs, ndev); +if (rc !=0 ) { + ndev =1 ; + dev_addrs[0 ] = client->addr; + } } tas_priv->irq =
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 103/247 drm/panthor: Flush shmem writes before mapping buffers CPU-uncached
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
[ Upstream commit 576c930e5e7dcb937648490611a83f1bf0171048 ]
The shmem layer zeroes out the new pages using cached mappings, and if we don't CPU-flush we might leave dirty cachelines behind, leading to potential data leaks and/or asynchronous buffer corruption when dirty cachelines are evicted.
--- drivers/gpu/drm/panthor/panthor_gem.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/gpu/drm/panthor/panthor_gem.c +18 -0
@@ -291,6 +291,23 @@ panthor_gem_create_with_handle(struct drm_file *file,panthor_gem_debugfs_set_usage_flags (bo,0 ); +/* If this is a write-combine mapping, we query the sgt to force a CPU +* cache flush (dma_map_sgtable() is called when the sgt is created). +* This ensures the zero-ing is visible to any uncached mapping created +* by vmap/mmap. +* FIXME: Ideally this should be done when pages are allocated, not at +* BO creation time. +*/ +if (shmem->map_wc) { +struct sg_table *sgt; + + sgt =drm_gem_shmem_get_pages_sgt (shmem); +if (IS_ERR (sgt)) { + ret =PTR_ERR (sgt); + goto out_put_gem; + } + } +/* * Allocate an id of idr table where the obj is registered * and handle has the id what user can see.
@@ -299,6 +316,7 @@ panthor_gem_create_with_handle(struct drm_file *file,if (!ret) *size = bo->base.base.size; +out_put_gem:/* drop reference from allocate - handle holds it now. */ drm_gem_object_put (&shmem->base);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 104/247 pnfs: Fix TLS logic in _nfs4_pnfs_v3_ds_connect()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 7aca00d950e782e66c34fbd045c9605eca343a36 ]
Don't try to add an RDMA transport to a client that is already marked as being a TCP/TLS transport.
--- fs/nfs/pnfs_nfs.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-)
fs/nfs/pnfs_nfs.c +18 -14
@@ -809,8 +809,11 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv, unsigned int retrans) {struct nfs_client *clp =ERR_PTR (-EIO ); +struct nfs_client *mds_clp = mds_srv->nfs_client; +enum xprtsec_policies xprtsec_policy = mds_clp->cl_xprtsec.policy;struct nfs4_pnfs_ds_addr *da;unsigned long connect_timeout = timeo * (retrans +1 ) *HZ /10 ; +int ds_proto;int status =0 ;dprintk ("--> %s DS %s\n" , __func__, ds->ds_remotestr);
@@ -834,27 +837,28 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv, .xprtsec = clp->cl_xprtsec, }; -if (da->da_transport != clp->cl_proto && - clp->cl_proto !=XPRT_TRANSPORT_TCP_TLS ) -continue ; -if (da->da_transport ==XPRT_TRANSPORT_TCP && - mds_srv->nfs_client->cl_proto ==XPRT_TRANSPORT_TCP_TLS ) +if (xprt_args.ident ==XPRT_TRANSPORT_TCP && + clp->cl_proto ==XPRT_TRANSPORT_TCP_TLS ) xprt_args.ident =XPRT_TRANSPORT_TCP_TLS ; -if (da->da_addr.ss_family != clp->cl_addr.ss_family) +if (xprt_args.ident != clp->cl_proto) +continue ; +if (xprt_args.dstaddr->sa_family != + clp->cl_addr.ss_family)continue ;/* Add this address as an alias */ rpc_clnt_add_xprt (clp->cl_rpcclient, &xprt_args, - rpc_clnt_test_and_add_xprt,NULL ); + rpc_clnt_test_and_add_xprt,NULL );continue ; } -if (da->da_transport ==XPRT_TRANSPORT_TCP && - mds_srv->nfs_client->cl_proto ==XPRT_TRANSPORT_TCP_TLS ) - da->da_transport =XPRT_TRANSPORT_TCP_TLS ; - clp =get_v3_ds_connect (mds_srv, - &da->da_addr, - da->da_addrlen, da->da_transport, - timeo, retrans); + + ds_proto = da->da_transport; +if (ds_proto ==XPRT_TRANSPORT_TCP && + xprtsec_policy !=RPC_XPRTSEC_NONE ) + ds_proto =XPRT_TRANSPORT_TCP_TLS ; + + clp =get_v3_ds_connect (mds_srv, &da->da_addr, da->da_addrlen, + ds_proto, timeo, retrans);if (IS_ERR (clp))continue ; clp->cl_rpcclient->cl_softerr =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 105/247 pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 28e19737e1570c7c71890547c2e43c3e0da79df9 ]
Don't try to add an RDMA transport to a client that is already marked as being a TCP/TLS transport.
--- fs/nfs/pnfs_nfs.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-)
fs/nfs/pnfs_nfs.c +17 -17
@@ -884,7 +884,10 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, u32 minor_version) {struct nfs_client *clp =ERR_PTR (-EIO ); +struct nfs_client *mds_clp = mds_srv->nfs_client; +enum xprtsec_policies xprtsec_policy = mds_clp->cl_xprtsec.policy;struct nfs4_pnfs_ds_addr *da; +int ds_proto;int status =0 ;dprintk ("--> %s DS %s\n" , __func__, ds->ds_remotestr);
@@ -912,12 +915,8 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, .data = &xprtdata, }; -if (da->da_transport != clp->cl_proto && - clp->cl_proto !=XPRT_TRANSPORT_TCP_TLS ) -continue ; -if (da->da_transport ==XPRT_TRANSPORT_TCP && - mds_srv->nfs_client->cl_proto == -XPRT_TRANSPORT_TCP_TLS ) { +if (xprt_args.ident ==XPRT_TRANSPORT_TCP && + clp->cl_proto ==XPRT_TRANSPORT_TCP_TLS ) {struct sockaddr *addr = (struct sockaddr *)&da->da_addr; struct sockaddr_in *sin =
@@ -948,7 +947,10 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, xprt_args.ident =XPRT_TRANSPORT_TCP_TLS ; xprt_args.servername = servername; } -if (da->da_addr.ss_family != clp->cl_addr.ss_family) +if (xprt_args.ident != clp->cl_proto) +continue ; +if (xprt_args.dstaddr->sa_family != + clp->cl_addr.ss_family)continue ;/**
@@ -962,15 +964,14 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,if (xprtdata.cred)put_cred (xprtdata.cred); }else { -if (da->da_transport ==XPRT_TRANSPORT_TCP && - mds_srv->nfs_client->cl_proto == -XPRT_TRANSPORT_TCP_TLS ) - da->da_transport =XPRT_TRANSPORT_TCP_TLS ; - clp =nfs4_set_ds_client (mds_srv, - &da->da_addr, - da->da_addrlen, - da->da_transport, timeo, - retrans, minor_version); + ds_proto = da->da_transport; +if (ds_proto ==XPRT_TRANSPORT_TCP && + xprtsec_policy !=RPC_XPRTSEC_NONE ) + ds_proto =XPRT_TRANSPORT_TCP_TLS ; + + clp =nfs4_set_ds_client (mds_srv, &da->da_addr, + da->da_addrlen, ds_proto, + timeo, retrans, minor_version);if (IS_ERR (clp))continue ;
@@ -981,7 +982,6 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, clp =ERR_PTR (-EIO );continue ; } - } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 106/247 pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 8ab523ce78d4ca13add6b4ecbacff0f84c274603 ]
The default setting for the transport security policy must be RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS. Conversely, when using TLS, the security policy needs to be set.
--- fs/nfs/nfs3client.c | 14 ++++++++++++-- fs/nfs/nfs4client.c | 14 ++++++++++++-- 2 files changed, 24 insertions(+), 4 deletions(-)
fs/nfs/nfs3client.c +12 -2
@@ -2,6 +2,7 @@#include <linux/nfs_fs.h> #include <linux/nfs_mount.h> #include <linux/sunrpc/addr.h> +#include <net/handshake.h> #include "internal.h" #include "nfs3_fs.h" #include "netns.h"
@@ -98,7 +99,11 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv, .net = mds_clp->cl_net, .timeparms = &ds_timeout, .cred = mds_srv->cred, - .xprtsec = mds_clp->cl_xprtsec, + .xprtsec = { + .policy = RPC_XPRTSEC_NONE, + .cert_serial = TLS_NO_CERT, + .privkey_serial = TLS_NO_PRIVKEY, + }, .connect_timeout = connect_timeout, .reconnect_timeout = connect_timeout, };
@@ -111,9 +116,14 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv, cl_init.hostname = buf;switch (ds_proto) { +case XPRT_TRANSPORT_TCP_TLS : +if (mds_clp->cl_xprtsec.policy !=RPC_XPRTSEC_NONE ) + cl_init.xprtsec = mds_clp->cl_xprtsec; +else + ds_proto =XPRT_TRANSPORT_TCP ; + fallthrough;case XPRT_TRANSPORT_RDMA :case XPRT_TRANSPORT_TCP : -case XPRT_TRANSPORT_TCP_TLS :if (mds_clp->cl_nconnect >1 ) cl_init.nconnect = mds_clp->cl_nconnect; }
fs/nfs/nfs4client.c +12 -2
@@ -11,6 +11,7 @@#include <linux/sunrpc/xprt.h> #include <linux/sunrpc/bc_xprt.h> #include <linux/sunrpc/rpc_pipe_fs.h> +#include <net/handshake.h> #include "internal.h" #include "callback.h" #include "delegation.h"
@@ -983,7 +984,11 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, .net = mds_clp->cl_net, .timeparms = &ds_timeout, .cred = mds_srv->cred, - .xprtsec = mds_srv->nfs_client->cl_xprtsec, + .xprtsec = { + .policy = RPC_XPRTSEC_NONE, + .cert_serial = TLS_NO_CERT, + .privkey_serial = TLS_NO_PRIVKEY, + }, };char buf[INET6_ADDRSTRLEN +1 ];
@@ -992,9 +997,14 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, cl_init.hostname = buf;switch (ds_proto) { +case XPRT_TRANSPORT_TCP_TLS : +if (mds_srv->nfs_client->cl_xprtsec.policy !=RPC_XPRTSEC_NONE ) + cl_init.xprtsec = mds_srv->nfs_client->cl_xprtsec; +else + ds_proto =XPRT_TRANSPORT_TCP ; + fallthrough;case XPRT_TRANSPORT_RDMA :case XPRT_TRANSPORT_TCP : -case XPRT_TRANSPORT_TCP_TLS :if (mds_clp->cl_nconnect >1 ) { cl_init.nconnect = mds_clp->cl_nconnect; cl_init.max_connect =NFS_MAX_TRANSPORTS ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/247 NFS: Check the TLS certificate fields in nfs_match_client()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit fb2cba0854a7f315c8100a807a6959b99d72479e ]
If the TLS security policy is of type RPC_XPRTSEC_TLS_X509, then the cert_serial and privkey_serial fields need to match as well since they define the client's identity, as presented to the server.
--- fs/nfs/client.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/nfs/client.c +8 -0
@@ -338,6 +338,14 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat/* Match the xprt security policy */ if (clp->cl_xprtsec.policy != data->xprtsec.policy)continue ; +if (clp->cl_xprtsec.policy ==RPC_XPRTSEC_TLS_X509 ) { +if (clp->cl_xprtsec.cert_serial != + data->xprtsec.cert_serial) +continue ; +if (clp->cl_xprtsec.privkey_serial != + data->xprtsec.privkey_serial) +continue ; + }refcount_inc (&clp->cl_count);return clp;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 108/247 simplify nfs_atomic_open_v23()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit aae9db5739164353fa1894db000fabad940a835b ]
1) finish_no_open() takes ERR_PTR() as dentry now.
2) caller of ->atomic_open() will call d_lookup_done() itself, no need to do it here.
Stable-dep-of: 85d2c2392ac6 ("NFSv2/v3: Fix error handling in nfs_atomic_open_v23()")
--- fs/nfs/dir.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
fs/nfs/dir.c +5 -11
@@ -2260,7 +2260,7 @@ int nfs_atomic_open_v23(struct inode *dir, struct dentry *dentry, struct file *file, unsigned int open_flags, umode_t mode) { - + struct dentry *res = NULL;/* Same as look+open from lookup_open(), but with different O_TRUNC * handling. */
@@ -2275,21 +2275,15 @@ int nfs_atomic_open_v23(struct inode *dir, struct dentry *dentry,if (error)return error;return finish_open (file, dentry,NULL ); - }else if (d_in_lookup (dentry)) { + } +if (d_in_lookup (dentry)) {/* The only flags nfs_lookup considers are * LOOKUP_EXCL and LOOKUP_RENAME_TARGET, and * we want those to be zero so the lookup isn't skipped. */ -struct dentry *res =nfs_lookup (dir, dentry,0 ); - -d_lookup_done (dentry); -if (unlikely (res)) { -if (IS_ERR (res)) -return PTR_ERR (res); -return finish_no_open (file, res); - } + res =nfs_lookup (dir, dentry,0 ); } -return finish_no_open (file,NULL ); +return finish_no_open (file, res); }EXPORT_SYMBOL_GPL (nfs_atomic_open_v23);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 109/247 NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 85d2c2392ac6348e1171d627497034a341a250c1 ]
When nfs_do_create() returns an EEXIST error, it means that a regular file could not be created. That could mean that a symlink needs to be resolved. If that's the case, a lookup needs to be kicked off.
--- fs/nfs/dir.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/nfs/dir.c +4 -3
@@ -2270,11 +2270,12 @@ int nfs_atomic_open_v23(struct inode *dir, struct dentry *dentry,return -ENAMETOOLONG ;if (open_flags &O_CREAT ) { - file->f_mode |=FMODE_CREATED ; error =nfs_do_create (dir, dentry, mode, open_flags); -if (error) +if (!error) { + file->f_mode |=FMODE_CREATED ; +return finish_open (file, dentry,NULL ); + }else if (error != -EEXIST || open_flags &O_EXCL )return error; -return finish_open (file, dentry,NULL ); }if (d_in_lookup (dentry)) {/* The only flags nfs_lookup considers are
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 110/247 NFS: sysfs: fix leak when nfs_client kobject add fails
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Xiuwei <[email protected]>
[ Upstream commit 7a7a3456520b309a0bffa1d9d62bd6c9dcab89b3 ]
If adding the second kobject fails, drop both references to avoid sysfs residue and memory leak.
--- fs/nfs/sysfs.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/sysfs.c +1 -0
@@ -189,6 +189,7 @@ static struct nfs_netns_client *nfs_netns_client_alloc(struct kobject *parent,return p;kobject_put (&p->kobject); +kobject_put (&p->nfs_net_kobj); }return NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 111/247 NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 1f214e9c3aef2d0936be971072e991d78a174d71 ]
The Smatch static checker noted that in _nfs4_proc_lookupp(), the flag RPC_TASK_TIMEOUT is being passed as an argument to nfs4_init_sequence(), which is clearly incorrect.
Since LOOKUPP is an idempotent operation, nfs4_init_sequence() should not ask the server to cache the result. The RPC_TASK_TIMEOUT flag needs to be passed down to the RPC layer.
--- fs/nfs/nfs4proc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/nfs/nfs4proc.c +6 -3
@@ -4715,16 +4715,19 @@ static int _nfs4_proc_lookupp(struct inode *inode, };unsigned short task_flags =0 ; -if (NFS_SERVER (inode)->flags &NFS_MOUNT_SOFTREVAL ) +if (server->flags &NFS_MOUNT_SOFTREVAL ) task_flags |=RPC_TASK_TIMEOUT ; +if (server->caps &NFS_CAP_MOVEABLE ) + task_flags |=RPC_TASK_MOVEABLE ; args.bitmask =nfs4_bitmask (server, fattr->label);nfs_fattr_init (fattr); +nfs4_init_sequence (&args.seq_args, &res.seq_res,0 ,0 );dprintk ("NFS call lookupp ino=0x%lx\n" , inode->i_ino); - status =nfs4_call_sync (clnt, server, &msg, &args.seq_args, - &res.seq_res, task_flags); + status =nfs4_do_call_sync (clnt, server, &msg, &args.seq_args, + &res.seq_res, task_flags);dprintk ("NFS reply lookupp: %d\n" , status);return status; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 112/247 NFS: Fix LTP test failures when timestamps are delegated
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <[email protected]>
[ Upstream commit b623390045a81fc559decb9bfeb79319721d3dfb ]
The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fields using the 'nobody' user ID.
The problem can be reproduced as follow:
# echo "/media *(rw,no_root_squash,sync)" >> /etc/exports # export -ra # mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir # cd /opt/ltp # ./runltp -d /tmpdir -s utimes01 # ./runltp -d /tmpdir -s utime06
This issue occurs because nfs_setattr does not verify the inode's UID against the caller's fsuid when delegated timestamps are permitted for the inode.
This patch adds the UID check and if it does not match then the request is sent to the server for permission checking.
--- fs/nfs/inode.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
fs/nfs/inode.c +12 -6
@@ -718,6 +718,8 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,struct nfs_fattr *fattr;loff_t oldsize =i_size_read (inode);int error =0 ; +kuid_t task_uid =current_fsuid (); +kuid_t owner_uid = inode->i_uid;nfs_inc_stats (inode,NFSIOS_VFSSETATTR );
@@ -739,9 +741,11 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,if (nfs_have_delegated_mtime (inode) && attr->ia_valid &ATTR_MTIME ) {spin_lock (&inode->i_lock);if (attr->ia_valid &ATTR_MTIME_SET ) { -nfs_set_timestamps_to_ts (inode, attr); - attr->ia_valid &= ~(ATTR_MTIME |ATTR_MTIME_SET | +if (uid_eq (task_uid, owner_uid)) { +nfs_set_timestamps_to_ts (inode, attr); + attr->ia_valid &= ~(ATTR_MTIME |ATTR_MTIME_SET |ATTR_ATIME |ATTR_ATIME_SET ); + } }else {nfs_update_timestamps (inode, attr->ia_valid); attr->ia_valid &= ~(ATTR_MTIME |ATTR_ATIME );
@@ -751,10 +755,12 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, attr->ia_valid & ATTR_ATIME && !(attr->ia_valid & ATTR_MTIME)) {if (attr->ia_valid &ATTR_ATIME_SET ) { -spin_lock (&inode->i_lock); -nfs_set_timestamps_to_ts (inode, attr); -spin_unlock (&inode->i_lock); - attr->ia_valid &= ~(ATTR_ATIME |ATTR_ATIME_SET ); +if (uid_eq (task_uid, owner_uid)) { +spin_lock (&inode->i_lock); +nfs_set_timestamps_to_ts (inode, attr); +spin_unlock (&inode->i_lock); + attr->ia_valid &= ~(ATTR_ATIME |ATTR_ATIME_SET ); + } }else {nfs_update_delegated_atime (inode); attr->ia_valid &= ~ATTR_ATIME ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 113/247 ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haein Lee <[email protected]>
[ Upstream commit 632108ec072ad64c8c83db6e16a7efee29ebfb74 ]
In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor.
--- sound/usb/mixer.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/mixer.c +2 -0
@@ -3080,6 +3080,8 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,int i; assoc =usb_ifnum_to_if (dev, ctrlif)->intf_assoc; +if (!assoc) +return -EINVAL ;/* Detect BADD capture/playback channels from AS EP descriptors */ for (i =0 ; i < assoc->bInterfaceCount; i++) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 114/247 drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sultan Alsawaf <[email protected]>
[ Upstream commit 7132f7e025f9382157543dd86a62d161335b48b9 ]
When the BO pointer provided to amdgpu_bo_create_kernel() points to non-NULL, amdgpu_bo_create_kernel() takes it as a hint to pin that address rather than allocate a new BO.
This functionality is never desired for allocating ISP buffers. A new BO should always be created when isp_kernel_buffer_alloc() is called, per the description for isp_kernel_buffer_alloc().
Ensure this by zeroing *bo right before the amdgpu_bo_create_kernel() call.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_isp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_isp.c +2 -0
@@ -280,6 +280,8 @@ int isp_kernel_buffer_alloc(struct device *dev, u64 size,if (ret)return ret; +/* Ensure *bo is NULL so a new BO will be created */ + *bo =NULL ; ret = amdgpu_bo_create_kernel(adev, size, ISP_MC_ADDR_ALIGN,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 115/247 acpi/hmat: Fix lockdep warning for hmem_register_resource()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <[email protected]>
[ Upstream commit 214291cbaaceeb28debd773336642b1fca393ae0 ]
The following lockdep splat was observed while kernel auto-online a CXL memory region:
======================================================
WARNING: possible circular locking dependency detected
6.17.0djtest+ #53 Tainted: G W
------------------------------------------------------
systemd-udevd/3334 is trying to acquire lock:ffffffff90346188 (hmem_resource_lock){+.+.}-{4:4}, at: hmem_register_resource+0x31/0x50
but task is already holding lock:ffffffff90338890 ((node_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x2e/0x70
which lock already depends on the new lock.
[..]
Chain exists of: hmem_resource_lock --> mem_hotplug_lock --> (node_chain).rwsem Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock((node_chain).rwsem);
lock(mem_hotplug_lock);
lock((node_chain).rwsem); lock(hmem_resource_lock);
The lock ordering can cause potential deadlock. There are instances where hmem_resource_lock is taken after (node_chain).rwsem, and vice versa.
Split out the target update section of hmat_register_target() so that hmat_callback() only envokes that section instead of attempt to register hmem devices that it does not need to.
[ dj: Fix up comment to be closer to 80cols. (Jonathan) ]
--- drivers/acpi/numa/hmat.c | 46 ++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 21 deletions(-)
drivers/acpi/numa/hmat.c +25 -21
@@ -908,10 +908,32 @@ static void hmat_register_target_devices(struct memory_target *target) } } -static void hmat_register_target (struct memory_target *target) +static void hmat_hotplug_target (struct memory_target *target) {int nid =pxm_to_node (target->memory_pxm); +/* +* Skip offline nodes. This can happen when memory marked EFI_MEMORY_SP, +* "specific purpose", is applied to all the memory in a proximity +* domain leading to * the node being marked offline / unplugged, or if +* memory-only "hotplug" node is offline. +*/ +if (nid ==NUMA_NO_NODE || !node_online (nid)) +return ; + +guard (mutex)(&target_lock); +if (target->registered) +return ; + +hmat_register_target_initiators (target); +hmat_register_target_cache (target); +hmat_register_target_perf (target,ACCESS_COORDINATE_LOCAL ); +hmat_register_target_perf (target,ACCESS_COORDINATE_CPU ); + target->registered = true; +} + +static void hmat_register_target (struct memory_target *target) +{/* * Devices may belong to either an offline or online * node, so unconditionally add them.
@@ -929,25 +951,7 @@ static void hmat_register_target(struct memory_target *target) }mutex_unlock (&target_lock); -/* -* Skip offline nodes. This can happen when memory -* marked EFI_MEMORY_SP, "specific purpose", is applied -* to all the memory in a proximity domain leading to -* the node being marked offline / unplugged, or if -* memory-only "hotplug" node is offline. -*/ -if (nid ==NUMA_NO_NODE || !node_online (nid)) -return ; - -mutex_lock (&target_lock); -if (!target->registered) { -hmat_register_target_initiators (target); -hmat_register_target_cache (target); -hmat_register_target_perf (target,ACCESS_COORDINATE_LOCAL ); -hmat_register_target_perf (target,ACCESS_COORDINATE_CPU ); - target->registered = true; - } -mutex_unlock (&target_lock); +hmat_hotplug_target (target); }static void hmat_register_targets (void )
@@ -973,7 +977,7 @@ static int hmat_callback(struct notifier_block *self,if (!target)return NOTIFY_OK ; -hmat_register_target (target); +hmat_hotplug_target (target);return NOTIFY_OK ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 116/247 ASoC: rsnd: fix OF node reference leak in rsnd_ssiu_probe()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 360b3730f8eab6c4467c6cca4cb0e30902174a63 ]
rsnd_ssiu_probe() leaks an OF node reference obtained by rsnd_ssiu_of_node(). The node reference is acquired but never released across all return paths.
Fix it by declaring the device node with the __free(device_node) cleanup construct to ensure automatic release when the variable goes out of scope.
--- sound/soc/renesas/rcar/ssiu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/renesas/rcar/ssiu.c +1 -2
@@ -509,7 +509,7 @@ void rsnd_parse_connect_ssiu(struct rsnd_dai *rdai,int rsnd_ssiu_probe (struct rsnd_priv *priv) {struct device *dev =rsnd_priv_to_dev (priv); -struct device_node *node; + struct device_node *node __free(device_node) = rsnd_ssiu_of_node(priv);struct rsnd_ssiu *ssiu;struct rsnd_mod_ops *ops;const int *list =NULL ;
@@ -522,7 +522,6 @@ int rsnd_ssiu_probe(struct rsnd_priv *priv)* see * rsnd_ssiu_bufsif_to_id() */ - node =rsnd_ssiu_of_node (priv);if (node) nr =rsnd_node_count (priv, node,SSIU_NAME );else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 117/247 drm/client: fix MODULE_PARM_DESC string for "active"
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 0a4a18e888ae8c8004582f665c5792c84a681668 ]
The MODULE_PARM_DESC string for the "active" parameter is missing a space and has an extraneous trailing ']' character. Correct these.
Before patch:
$ modinfo -p ./drm_client_lib.ko active:Choose which drm client to start, default isfbdev] (string)
After patch:
$ modinfo -p ./drm_client_lib.ko active:Choose which drm client to start, default is fbdev (string)
--- drivers/gpu/drm/clients/drm_client_setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/clients/drm_client_setup.c +2 -2
@@ -13,8 +13,8 @@static char drm_client_default[16 ] =CONFIG_DRM_CLIENT_DEFAULT ;module_param_string (active, drm_client_default,sizeof (drm_client_default),0444 );MODULE_PARM_DESC (active, -"Choose which drm client to start, default is" -CONFIG_DRM_CLIENT_DEFAULT "]" ); +"Choose which drm client to start, default is " +CONFIG_DRM_CLIENT_DEFAULT );/** * drm_client_setup() - Setup in-kernel DRM clients
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 118/247 bpf: Add bpf_prog_run_data_pointers()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4ef92743625818932b9c320152b58274c05e5053 ]
syzbot found that cls_bpf_classify() is able to change tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline] WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214
struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong interaction with db58ba459202 ("bpf: wire in data and data_end for cls_act_bpf").
drop_reason was added later.
Add bpf_prog_run_data_pointers() helper to save/restore the net_sched storage colliding with BPF data_meta/data_end.
--- include/linux/filter.h | 20 ++++++++++++++++++++ net/sched/act_bpf.c | 6 ++---- net/sched/cls_bpf.c | 6 ++---- 3 files changed, 24 insertions(+), 8 deletions(-)
include/linux/filter.h +20 -0
@@ -898,6 +898,26 @@ static inline void bpf_compute_data_pointers(struct sk_buff *skb) cb->data_end = skb->data +skb_headlen (skb); } +static inline int bpf_prog_run_data_pointers ( +const struct bpf_prog *prog, +struct sk_buff *skb) +{ +struct bpf_skb_data_end *cb = (struct bpf_skb_data_end *)skb->cb; +void *save_data_meta, *save_data_end; +int res; + + save_data_meta = cb->data_meta; + save_data_end = cb->data_end; + +bpf_compute_data_pointers (skb); + res =bpf_prog_run (prog, skb); + + cb->data_meta = save_data_meta; + cb->data_end = save_data_end; + +return res; +} +/* Similar to bpf_compute_data_pointers(), except that save orginal * data in cb->data and cb->meta_data for restore. */
net/sched/act_bpf.c +2 -4
@@ -47,12 +47,10 @@ TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb, filter =rcu_dereference (prog->filter);if (at_ingress) {__skb_push (skb, skb->mac_len); -bpf_compute_data_pointers (skb); - filter_res =bpf_prog_run (filter, skb); + filter_res =bpf_prog_run_data_pointers (filter, skb);__skb_pull (skb, skb->mac_len); }else { -bpf_compute_data_pointers (skb); - filter_res =bpf_prog_run (filter, skb); + filter_res =bpf_prog_run_data_pointers (filter, skb); }if (unlikely (!skb->tstamp && skb->tstamp_type)) skb->tstamp_type =SKB_CLOCK_REALTIME ;
net/sched/cls_bpf.c +2 -4
@@ -97,12 +97,10 @@ TC_INDIRECT_SCOPE int cls_bpf_classify(struct sk_buff *skb, }else if (at_ingress) {/* It is safe to push/pull even if skb_shared() */ __skb_push (skb, skb->mac_len); -bpf_compute_data_pointers (skb); - filter_res =bpf_prog_run (prog->filter, skb); + filter_res =bpf_prog_run_data_pointers (prog->filter, skb);__skb_pull (skb, skb->mac_len); }else { -bpf_compute_data_pointers (skb); - filter_res =bpf_prog_run (prog->filter, skb); + filter_res =bpf_prog_run_data_pointers (prog->filter, skb); }if (unlikely (!skb->tstamp && skb->tstamp_type)) skb->tstamp_type =SKB_CLOCK_REALTIME ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 119/247 bpf: account for current allocated stack depth in widen_imprecise_scalars()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit b0c8e6d3d866b6a7f73877f71968dbffd27b7785 ]
The usage pattern for widen_imprecise_scalars() looks as follows:
prev_st = find_prev_entry(env, ...);
queued_st = push_stack(...);
widen_imprecise_scalars(env, prev_st, queued_st);Where prev_st is an ancestor of the queued_st in the explored states tree. This ancestor is not guaranteed to have same allocated stack depth as queued_st. E.g. in the following case:
def main():
for i in 1..2:
foo(i) // same callsite, differnt param
def foo(i):
if i == 1:
use 128 bytes of stack
iterator based loopHere, for a second 'foo' call prev_st->allocated_stack is 128, while queued_st->allocated_stack is much smaller. widen_imprecise_scalars() needs to take this into account and avoid accessing bpf_verifier_state->frame[*]->stack out of bounds.
--- kernel/bpf/verifier.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/bpf/verifier.c +4 -2
@@ -8917,7 +8917,7 @@ static int widen_imprecise_scalars(struct bpf_verifier_env *env, struct bpf_verifier_state *cur) {struct bpf_func_state *fold, *fcur; -int i, fr; +int i, fr, num_slots;reset_idmap_scratch (env);for (fr = old->curframe; fr >=0 ; fr--) {
@@ -8930,7 +8930,9 @@ static int widen_imprecise_scalars(struct bpf_verifier_env *env, &fcur->regs[i], &env->idmap_scratch); -for (i =0 ; i < fold->allocated_stack /BPF_REG_SIZE ; i++) { + num_slots =min (fold->allocated_stack /BPF_REG_SIZE , + fcur->allocated_stack /BPF_REG_SIZE ); +for (i =0 ; i < num_slots; i++) {if (!is_spilled_reg (&fold->stack[i]) || !is_spilled_reg (&fcur->stack[i]))continue ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 120/247 irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Hu <[email protected]>
[ Upstream commit 14473a1f88596fd729e892782efc267c0097dd1d ]
The irq_domain_free_irqs() helper requires that the irq_domain_ops->free callback is implemented. Otherwise, the kernel reports the warning message "NULL pointer, cannot free irq" when irq_dispose_mapping() is invoked to release the per-HART local interrupts.
Set irq_domain_ops->free to irq_domain_free_irqs_top() to cure that.
--- drivers/irqchip/irq-riscv-intc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/irqchip/irq-riscv-intc.c +2 -1
@@ -166,7 +166,8 @@ static int riscv_intc_domain_alloc(struct irq_domain *domain,static const struct irq_domain_ops riscv_intc_domain_ops = { .map = riscv_intc_domain_map, .xlate = irq_domain_xlate_onecell, - .alloc = riscv_intc_domain_alloc + .alloc = riscv_intc_domain_alloc, + .free = irq_domain_free_irqs_top, };static struct fwnode_handle *riscv_intc_hwnode (void )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 121/247 posix-timers: Plug potential memory leak in do_timer_create()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eslam Khafagy <[email protected]>
[ Upstream commit e0fd4d42e27f761e9cc82801b3f183e658dc749d ]
When posix timer creation is set to allocate a given timer ID and the access to the user space value faults, the function terminates without freeing the already allocated posix timer structure.
Move the allocation after the user space access to cure that.
[ tglx: Massaged change log ]
--- kernel/time/posix-timers.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
kernel/time/posix-timers.c +6 -6
@@ -476,12 +476,6 @@ static int do_timer_create(clockid_t which_clock, struct sigevent *event,if (!kc->timer_create)return -EOPNOTSUPP ; - new_timer =alloc_posix_timer (); -if (unlikely (!new_timer)) -return -EAGAIN ; - -spin_lock_init (&new_timer->it_lock); -/* Special case for CRIU to restore timers with a given timer ID. */ if (unlikely (current->signal->timer_create_restore_ids)) {if (copy_from_user (&req_id, created_timer_id,sizeof (req_id)))
@@ -491,6 +485,12 @@ static int do_timer_create(clockid_t which_clock, struct sigevent *event,return -EINVAL ; } + new_timer =alloc_posix_timer (); +if (unlikely (!new_timer)) +return -EAGAIN ; + +spin_lock_init (&new_timer->it_lock); +/* * Add the timer to the hash table. The timer is not yet valid * after insertion, but has a unique ID allocated.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 122/247 lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 44e8241c51f762aafa50ed116da68fd6ecdcc954 upstream.
On big endian arm kernels, the arm optimized Curve25519 code produces incorrect outputs and fails the Curve25519 test. This has been true ever since this code was added.
It seems that hardly anyone (or even no one?) actually uses big endian arm kernels. But as long as they're ostensibly supported, we should disable this code on them so that it's not accidentally used.
Note: for future-proofing, use !CPU_BIG_ENDIAN instead of CPU_LITTLE_ENDIAN. Both of these are arch-specific options that could get removed in the future if big endian support gets dropped.
--- arch/arm/crypto/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/crypto/Kconfig +1 -1
@@ -4,7 +4,7 @@ menu "Accelerated Cryptographic Algorithms for CPU (arm)" config CRYPTO_CURVE25519_NEON tristate - depends on KERNEL_MODE_NEON + depends on KERNEL_MODE_NEON && !CPU_BIG_ENDIAN select CRYPTO_KPP select CRYPTO_LIB_CURVE25519_GENERIC select CRYPTO_ARCH_HAVE_LIB_CURVE25519
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 123/247 hostfs: Fix only passing host root in boot stage with new mount
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongbo Li <[email protected]>
[ Upstream commit 2c2b67af5f5f77fc68261a137ad65dcfb8e52506 ]
In the old mount proceedure, hostfs could only pass root directory during boot. This is because it constructed the root directory using the @root_ino event without any mount options. However, when using it with the new mount API, this step is no longer triggered. As a result, if users mounts without specifying any mount options, the @host_root_path remains uninitialized. To prevent this issue, the @host_root_path should be initialized at the time of allocation.
--- fs/hostfs/hostfs_kern.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-)
fs/hostfs/hostfs_kern.c +18 -11
@@ -979,7 +979,7 @@ static int hostfs_parse_param(struct fs_context *fc, struct fs_parameter *param) {struct hostfs_fs_info *fsi = fc->s_fs_info;struct fs_parse_result result; -char *host_root; +char *host_root, *tmp_root;int opt; opt =fs_parse (fc, hostfs_param_specs, param, &result);
@@ -990,11 +990,13 @@ static int hostfs_parse_param(struct fs_context *fc, struct fs_parameter *param)case Opt_hostfs: host_root = param->string;if (!*host_root) - host_root ="" ; - fsi->host_root_path = -kasprintf (GFP_KERNEL ,"%s/%s" , root_ino, host_root); -if (fsi->host_root_path ==NULL ) +break ; + tmp_root =kasprintf (GFP_KERNEL ,"%s%s" , + fsi->host_root_path, host_root); +if (!tmp_root)return -ENOMEM ; +kfree (fsi->host_root_path); + fsi->host_root_path = tmp_root;break ; }
@@ -1004,17 +1006,17 @@ static int hostfs_parse_param(struct fs_context *fc, struct fs_parameter *param)static int hostfs_parse_monolithic (struct fs_context *fc,void *data) {struct hostfs_fs_info *fsi = fc->s_fs_info; -char *host_root = (char *)data; +char *tmp_root, *host_root = (char *)data;/* NULL is printed as '(null)' by printf(): avoid that. */ if (host_root ==NULL ) - host_root ="" ; +return 0 ; - fsi->host_root_path = -kasprintf (GFP_KERNEL ,"%s/%s" , root_ino, host_root); -if (fsi->host_root_path ==NULL ) + tmp_root =kasprintf (GFP_KERNEL ,"%s%s" , fsi->host_root_path, host_root); +if (!tmp_root)return -ENOMEM ; - +kfree (fsi->host_root_path); + fsi->host_root_path = tmp_root;return 0 ; }
@@ -1049,6 +1051,11 @@ static int hostfs_init_fs_context(struct fs_context *fc)if (!fsi)return -ENOMEM ; + fsi->host_root_path =kasprintf (GFP_KERNEL ,"%s/" , root_ino); +if (!fsi->host_root_path) { +kfree (fsi); +return -ENOMEM ; + } fc->s_fs_info = fsi; fc->ops = &hostfs_context_ops;return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 124/247 afs: Fix dynamic lookup to fail on cell lookup failure
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <[email protected]>
[ Upstream commit 330e2c514823008b22e6afd2055715bc46dd8d55 ]
When a process tries to access an entry in /afs, normally what happens is that an automount dentry is created by ->lookup() and then triggered, which jumps through the ->d_automount() op. Currently, afs_dynroot_lookup() does not do cell DNS lookup, leaving that to afs_d_automount() to perform - however, it is possible to use access() or stat() on the automount point, which will always return successfully, have briefly created an afs_cell record if one did not already exist.
This means that something like:
test -d "/afs/.west" && echo Directory exists
will print "Directory exists" even though no such cell is configured. This breaks the "west" python module available on PIP as it expects this access to fail.
Now, it could be possible to make afs_dynroot_lookup() perform the DNS[*] lookup, but that would make "ls --color /afs" do this for each cell in /afs that is listed but not yet probed. kafs-client, probably wrongly, preloads the entire cell database and all the known cells are then listed in /afs - and doing ls /afs would be very, very slow, especially if any cell supplied addresses but was wholly inaccessible.
[*] When I say "DNS", actually read getaddrinfo(), which could use any one
of a host of mechanisms. Could also use static configuration.
To fix this, make the following changes:
(1) Create an enum to specify the origination point of a call to afs_lookup_cell() and pass this value into that function in place of the "excl" parameter (which can be derived from it). There are six points of origination:
- Cell preload through /proc/net/afs/cells
- Root cell config through /proc/net/afs/rootcell
- Lookup in dynamic root
- Automount trigger
- Direct mount with mount() syscall
- Alias check where YFS tells us the cell name is different
(2) Add an extra state into the afs_cell state machine to indicate a cell that's been initialised, but not yet looked up. This is separate from one that can be considered active and has been looked up at least once.
(3) Make afs_lookup_cell() vary its behaviour more, depending on where it was called from:
If called from preload or root cell config, DNS lookup will not happen until we definitely want to use the cell (dynroot mount, automount, direct mount or alias check). The cell will appear in /afs but stat() won't trigger DNS lookup.
If the cell already exists, dynroot will not wait for the DNS lookup to complete. If the cell did not already exist, dynroot will wait.
If called from automount, direct mount or alias check, it will wait for the DNS lookup to complete.
(4) Make afs_lookup_cell() return an error if lookup failed in one way or another. We try to return -ENOENT if the DNS says the cell does not exist and -EDESTADDRREQ if we couldn't access the DNS.
--- fs/afs/cell.c | 78 +++++++++++++++++++++++++++++++++++++++-------- fs/afs/dynroot.c | 3 +- fs/afs/internal.h | 12 +++++++- fs/afs/mntpt.c | 3 +- fs/afs/proc.c | 3 +- fs/afs/super.c | 2 +- fs/afs/vl_alias.c | 3 +- 7 files changed, 86 insertions(+), 18 deletions(-)
fs/afs/cell.c +66 -12
@@ -229,7 +229,7 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,* @name: The name of the cell. * @namesz: The strlen of the cell name. * @vllist: A colon/comma separated list of numeric IP addresses or NULL. -* @excl: T if an error should be given if the cell name already exists. +* @reason: The reason we're doing the lookup * @trace: The reason to be logged if the lookup is successful. * * Look up a cell record by name and query the DNS for VL server addresses if
@@ -239,7 +239,8 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,*/ struct afs_cell *afs_lookup_cell (struct afs_net *net,const char *name,unsigned int namesz, -const char *vllist,bool excl, +const char *vllist, +enum afs_lookup_cell_for reason,enum afs_cell_trace trace) {struct afs_cell *cell, *candidate, *cursor;
@@ -247,12 +248,18 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net,enum afs_cell_state state;int ret, n; -_enter ("%s,%s" , name, vllist); +_enter ("%s,%s,%u" , name, vllist, reason); -if (!excl) { +if (reason !=AFS_LOOKUP_CELL_PRELOAD ) { cell =afs_find_cell (net, name, namesz, trace); -if (!IS_ERR (cell)) +if (!IS_ERR (cell)) { +if (reason ==AFS_LOOKUP_CELL_DYNROOT ) + goto no_wait; +if (cell->state ==AFS_CELL_SETTING_UP || + cell->state ==AFS_CELL_UNLOOKED ) + goto lookup_cell; goto wait_for_cell; + } }/* Assume we're probably going to create a cell and preallocate and
@@ -298,26 +305,69 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net,rb_insert_color (&cell->net_node, &net->cells);up_write (&net->cells_lock); -afs_queue_cell (cell, afs_cell_trace_queue_new); +lookup_cell: +if (reason !=AFS_LOOKUP_CELL_PRELOAD && + reason !=AFS_LOOKUP_CELL_ROOTCELL ) { +set_bit (AFS_CELL_FL_DO_LOOKUP , &cell->flags); +afs_queue_cell (cell, afs_cell_trace_queue_new); + } wait_for_cell: -_debug ("wait_for_cell" ); state =smp_load_acquire (&cell->state);/* vs error */ -if (state !=AFS_CELL_ACTIVE && - state !=AFS_CELL_DEAD ) { +switch (state) { +case AFS_CELL_ACTIVE : +case AFS_CELL_DEAD : +break ; +case AFS_CELL_UNLOOKED : +default : +if (reason ==AFS_LOOKUP_CELL_PRELOAD || + reason ==AFS_LOOKUP_CELL_ROOTCELL ) +break ; +_debug ("wait_for_cell" );afs_see_cell (cell, afs_cell_trace_wait);wait_var_event (&cell->state, ({ state =smp_load_acquire (&cell->state);/* vs error */ state ==AFS_CELL_ACTIVE || state ==AFS_CELL_DEAD ; })); +_debug ("waited_for_cell %d %d" , cell->state, cell->error); } +no_wait:/* Check the state obtained from the wait check. */ + state =smp_load_acquire (&cell->state);/* vs error */ if (state ==AFS_CELL_DEAD ) { ret = cell->error; goto error; } +if (state ==AFS_CELL_ACTIVE ) { +switch (cell->dns_status) { +case DNS_LOOKUP_NOT_DONE : +if (cell->dns_source ==DNS_RECORD_FROM_CONFIG ) { + ret =0 ; +break ; + } + fallthrough; +default : + ret = -EIO ; + goto error; +case DNS_LOOKUP_GOOD : +case DNS_LOOKUP_GOOD_WITH_BAD : + ret =0 ; +break ; +case DNS_LOOKUP_GOT_NOT_FOUND : + ret = -ENOENT ; + goto error; +case DNS_LOOKUP_BAD : + ret = -EREMOTEIO ; + goto error; +case DNS_LOOKUP_GOT_LOCAL_FAILURE : +case DNS_LOOKUP_GOT_TEMP_FAILURE : +case DNS_LOOKUP_GOT_NS_FAILURE : + ret = -EDESTADDRREQ ; + goto error; + } + }_leave (" = %p [cell]" , cell);return cell;
@@ -325,7 +375,7 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net, cell_already_exists:_debug ("cell exists" ); cell = cursor; -if (excl) { +if (reason ==AFS_LOOKUP_CELL_PRELOAD ) { ret = -EEXIST ; }else {afs_use_cell (cursor, trace);
@@ -384,7 +434,8 @@ int afs_cell_init(struct afs_net *net, const char *rootcell)return -EINVAL ;/* allocate a cell record for the root/workstation cell */ - new_root =afs_lookup_cell (net, rootcell, len, vllist, false, + new_root =afs_lookup_cell (net, rootcell, len, vllist, +AFS_LOOKUP_CELL_ROOTCELL , afs_cell_trace_use_lookup_ws);if (IS_ERR (new_root)) {_leave (" = %ld" ,PTR_ERR (new_root));
@@ -777,6 +828,7 @@ static bool afs_manage_cell(struct afs_cell *cell)switch (cell->state) {case AFS_CELL_SETTING_UP : goto set_up_cell; +case AFS_CELL_UNLOOKED :case AFS_CELL_ACTIVE : goto cell_is_active;case AFS_CELL_REMOVING :
@@ -797,7 +849,7 @@ static bool afs_manage_cell(struct afs_cell *cell) goto remove_cell; } -afs_set_cell_state (cell,AFS_CELL_ACTIVE ); +afs_set_cell_state (cell,AFS_CELL_UNLOOKED ); cell_is_active:if (afs_has_cell_expired (cell, &next_manage))
@@ -807,6 +859,8 @@ static bool afs_manage_cell(struct afs_cell *cell) ret =afs_update_cell (cell);if (ret <0 ) cell->error = ret; +if (cell->state ==AFS_CELL_UNLOOKED ) +afs_set_cell_state (cell,AFS_CELL_ACTIVE ); }if (next_manage <TIME64_MAX && cell->net->live) {
fs/afs/dynroot.c +2 -1
@@ -108,7 +108,8 @@ static struct dentry *afs_dynroot_lookup_cell(struct inode *dir, struct dentry * dotted = true; } - cell =afs_lookup_cell (net, name, len,NULL , false, + cell =afs_lookup_cell (net, name, len,NULL , +AFS_LOOKUP_CELL_DYNROOT , afs_cell_trace_use_lookup_dynroot);if (IS_ERR (cell)) { ret =PTR_ERR (cell);
fs/afs/internal.h +11 -1
@@ -343,6 +343,7 @@ extern const char afs_init_sysname[];enum afs_cell_state {AFS_CELL_SETTING_UP , +AFS_CELL_UNLOOKED ,AFS_CELL_ACTIVE ,AFS_CELL_REMOVING ,AFS_CELL_DEAD ,
@@ -1047,9 +1048,18 @@ static inline bool afs_cb_is_broken(unsigned int cb_break,extern int afs_cell_init (struct afs_net *,const char *);extern struct afs_cell *afs_find_cell (struct afs_net *,const char *,unsigned ,enum afs_cell_trace ); +enum afs_lookup_cell_for { +AFS_LOOKUP_CELL_DYNROOT , +AFS_LOOKUP_CELL_MOUNTPOINT , +AFS_LOOKUP_CELL_DIRECT_MOUNT , +AFS_LOOKUP_CELL_PRELOAD , +AFS_LOOKUP_CELL_ROOTCELL , +AFS_LOOKUP_CELL_ALIAS_CHECK , +};struct afs_cell *afs_lookup_cell (struct afs_net *net,const char *name,unsigned int namesz, -const char *vllist,bool excl, +const char *vllist, +enum afs_lookup_cell_for reason,enum afs_cell_trace trace);extern struct afs_cell *afs_use_cell (struct afs_cell *,enum afs_cell_trace );void afs_unuse_cell (struct afs_cell *cell,enum afs_cell_trace reason);
fs/afs/mntpt.c +2 -1
@@ -107,7 +107,8 @@ static int afs_mntpt_set_params(struct fs_context *fc, struct dentry *mntpt)if (size >AFS_MAXCELLNAME )return -ENAMETOOLONG ; - cell =afs_lookup_cell (ctx->net, p, size,NULL , false, + cell =afs_lookup_cell (ctx->net, p, size,NULL , +AFS_LOOKUP_CELL_MOUNTPOINT , afs_cell_trace_use_lookup_mntpt);if (IS_ERR (cell)) {pr_err ("kAFS: unable to lookup cell '%pd'\n" , mntpt);
fs/afs/proc.c +2 -1
@@ -122,7 +122,8 @@ static int afs_proc_cells_write(struct file *file, char *buf, size_t size)if (strcmp (buf,"add" ) ==0 ) {struct afs_cell *cell; - cell =afs_lookup_cell (net, name,strlen (name), args, true, + cell =afs_lookup_cell (net, name,strlen (name), args, +AFS_LOOKUP_CELL_PRELOAD , afs_cell_trace_use_lookup_add);if (IS_ERR (cell)) { ret =PTR_ERR (cell);
fs/afs/super.c +1 -1
@@ -290,7 +290,7 @@ static int afs_parse_source(struct fs_context *fc, struct fs_parameter *param)/* lookup the cell record */ if (cellname) { cell =afs_lookup_cell (ctx->net, cellname, cellnamesz, -NULL , false, +NULL ,AFS_LOOKUP_CELL_DIRECT_MOUNT , afs_cell_trace_use_lookup_mount);if (IS_ERR (cell)) { pr_err("kAFS: unable to lookup cell '%*.*s'\n",
fs/afs/vl_alias.c +2 -1
@@ -269,7 +269,8 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key)if (!name_len || name_len >AFS_MAXCELLNAME ) master =ERR_PTR (-EOPNOTSUPP );else - master =afs_lookup_cell (cell->net, cell_name, name_len,NULL , false, + master =afs_lookup_cell (cell->net, cell_name, name_len,NULL , +AFS_LOOKUP_CELL_ALIAS_CHECK , afs_cell_trace_use_lookup_canonical);kfree (cell_name);if (IS_ERR (master))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 125/247 mtd: onenand: Pass correct pointer to IRQ handler
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 97315e7c901a1de60e8ca9b11e0e96d0f9253e18 ]
This was supposed to pass "onenand" instead of "&onenand" with the ampersand. Passing a random stack address which will be gone when the function ends makes no sense. However the good thing is that the pointer is never used, so this doesn't cause a problem at run time.
--- drivers/mtd/nand/onenand/onenand_samsung.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/onenand/onenand_samsung.c +1 -1
@@ -906,7 +906,7 @@ static int s3c_onenand_probe(struct platform_device *pdev) err =devm_request_irq (&pdev->dev, r->start, s5pc110_onenand_irq,IRQF_SHARED ,"onenand" , - &onenand); + onenand);if (err) {dev_err (&pdev->dev,"failed to get irq\n" );return err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 126/247 virtio-fs: fix incorrect check for fsvq->kobj
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit c014021253d77cd89b2d8788ce522283d83fbd40 ]
In virtio_fs_add_queues_sysfs(), the code incorrectly checks fs->mqs_kobj after calling kobject_create_and_add(). Change the check to fsvq->kobj (fs->mqs_kobj -> fsvq->kobj) to ensure the per-queue kobject is successfully created.
--- fs/fuse/virtio_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/virtio_fs.c +1 -1
@@ -373,7 +373,7 @@ static int virtio_fs_add_queues_sysfs(struct virtio_fs *fs)sprintf (buff,"%d" , i); fsvq->kobj =kobject_create_and_add (buff, fs->mqs_kobj); -if (!fs->mqs_kobj) { +if (!fsvq->kobj) { ret = -ENOMEM ; goto out_del; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 127/247 binfmt_misc: restore write access before closing files opened by open_exec()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 90f601b497d76f40fa66795c3ecf625b6aced9fd ]
bm_register_write() opens an executable file using open_exec(), which internally calls do_open_execat() and denies write access on the file to avoid modification while it is being executed.
However, when an error occurs, bm_register_write() closes the file using filp_close() directly. This does not restore the write permission, which may cause subsequent write operations on the same file to fail.
Fix this by calling exe_file_allow_write_access() before filp_close() to restore the write permission properly.
--- fs/binfmt_misc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/binfmt_misc.c +3 -1
@@ -837,8 +837,10 @@ static ssize_t bm_register_write(struct file *file, const char __user *buffer,inode_unlock (d_inode (root));if (err) { -if (f) +if (f) { +exe_file_allow_write_access (f);filp_close (f,NULL ); + }kfree (e);return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 128/247 fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Vagin <[email protected]>
[ Upstream commit 78f0e33cd6c939a555aa80dbed2fec6b333a7660 ]
grab_requested_mnt_ns was changed to return error codes on failure, but its callers were not updated to check for error pointers, still checking only for a NULL return value.
This commit updates the callers to use IS_ERR() or IS_ERR_OR_NULL() and PTR_ERR() to correctly check for and propagate errors.
This also makes sure that the logic actually works and mount namespace file descriptors can be used to refere to mounts.
Christian Brauner <[email protected]> says:
Rework the patch to be more ergonomic and in line with our overall error handling patterns.
--- fs/namespace.c | 32 ++++++++++++++++---------------- include/uapi/linux/mount.h | 2 +- 2 files changed, 17 insertions(+), 17 deletions(-)
fs/namespace.c +16 -16
@@ -186,7 +186,8 @@ static void mnt_ns_release(struct mnt_namespace *ns)kfree (ns); } } -DEFINE_FREE(mnt_ns_release, struct mnt_namespace *, if (_T) mnt_ns_release(_T)) +DEFINE_FREE(mnt_ns_release, struct mnt_namespace *, + if (!IS_ERR(_T)) mnt_ns_release(_T))static void mnt_ns_release_rcu (struct rcu_head *rcu) {
@@ -5881,7 +5882,7 @@ static int copy_mnt_id_req(const struct mnt_id_req __user *req, ret =copy_struct_from_user (kreq,sizeof (*kreq), req, usize);if (ret)return ret; -if (kreq->spare !=0 ) +if (kreq->mnt_ns_fd !=0 && kreq->mnt_ns_id)return -EINVAL ;/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ if (kreq->mnt_id <=MNT_UNIQUE_ID_OFFSET )
@@ -5898,16 +5899,12 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq {struct mnt_namespace *mnt_ns; -if (kreq->mnt_ns_id && kreq->spare) -return ERR_PTR (-EINVAL ); - -if (kreq->mnt_ns_id) -return lookup_mnt_ns (kreq->mnt_ns_id); - -if (kreq->spare) { +if (kreq->mnt_ns_id) { + mnt_ns =lookup_mnt_ns (kreq->mnt_ns_id); + }else if (kreq->mnt_ns_fd) {struct ns_common *ns; -CLASS (fd, f)(kreq->spare); +CLASS (fd, f)(kreq->mnt_ns_fd);if (fd_empty (f))return ERR_PTR (-EBADF );
@@ -5922,6 +5919,8 @@ static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq }else { mnt_ns = current->nsproxy->mnt_ns; } +if (!mnt_ns) +return ERR_PTR (-ENOENT );refcount_inc (&mnt_ns->passive);return mnt_ns;
@@ -5946,8 +5945,8 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,return ret; ns =grab_requested_mnt_ns (&kreq); -if (!ns) -return -ENOENT ; +if (IS_ERR (ns)) +return PTR_ERR (ns);if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) && !ns_capable_noaudit (ns->user_ns,CAP_SYS_ADMIN ))
@@ -6056,8 +6055,8 @@ static void __free_klistmount_free(const struct klistmount *kls)static inline int prepare_klistmount (struct klistmount *kls,struct mnt_id_req *kreq,size_t nr_mnt_ids) { -u64 last_mnt_id = kreq->param; +struct mnt_namespace *ns;/* The first valid unique mount id is MNT_UNIQUE_ID_OFFSET + 1. */ if (last_mnt_id !=0 && last_mnt_id <=MNT_UNIQUE_ID_OFFSET )
@@ -6071,9 +6070,10 @@ static inline int prepare_klistmount(struct klistmount *kls, struct mnt_id_req *if (!kls->kmnt_ids)return -ENOMEM ; - kls->ns =grab_requested_mnt_ns (kreq); -if (!kls->ns) -return -ENOENT ; + ns =grab_requested_mnt_ns (kreq); +if (IS_ERR (ns)) +return PTR_ERR (ns); + kls->ns = ns; kls->mnt_parent_id = kreq->mnt_id;return 0 ;
include/uapi/linux/mount.h +1 -1
@@ -197,7 +197,7 @@ struct statmount {*/ struct mnt_id_req {__u32 size; -__u32 spare; +__u32 mnt_ns_fd;__u64 mnt_id;__u64 param;__u64 mnt_ns_id;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 129/247 sched_ext: Fix unsafe locking in the scx_dump_state()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 5f02151c411dda46efcc5dc57b0845efcdcfc26d ]
For built with CONFIG_PREEMPT_RT=y kernels, the dump_lock will be converted sleepable spinlock and not disable-irq, so the following scenarios occur:
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. irq_work/0/27 [HC0[0]:SC0[0]:HE1:SE1] takes:
(&rq->__lock){?...}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x40 {IN-HARDIRQ-W} state was registered at:
lock_acquire+0x1e1/0x510 _raw_spin_lock_nested+0x42/0x80 raw_spin_rq_lock_nested+0x2b/0x40 sched_tick+0xae/0x7b0 update_process_times+0x14c/0x1b0 tick_periodic+0x62/0x1f0 tick_handle_periodic+0x48/0xf0 timer_interrupt+0x55/0x80 __handle_irq_event_percpu+0x20a/0x5c0 handle_irq_event_percpu+0x18/0xc0 handle_irq_event+0xb5/0x150 handle_level_irq+0x220/0x460 __common_interrupt+0xa2/0x1e0 common_interrupt+0xb0/0xd0 asm_common_interrupt+0x2b/0x40 _raw_spin_unlock_irqrestore+0x45/0x80 __setup_irq+0xc34/0x1a30 request_threaded_irq+0x214/0x2f0 hpet_time_init+0x3e/0x60 x86_late_time_init+0x5b/0xb0 start_kernel+0x308/0x410 x86_64_start_reservations+0x1c/0x30 x86_64_start_kernel+0x96/0xa0 common_startup_64+0x13e/0x148
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&rq->__lock);
<Interrupt>
lock(&rq->__lock);*** DEADLOCK ***
stack backtrace: CPU: 0 UID: 0 PID: 27 Comm: irq_work/0 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 print_usage_bug+0x42e/0x690 mark_lock.part.44+0x867/0xa70 ? __pfx_mark_lock.part.44+0x10/0x10 ? string_nocheck+0x19c/0x310 ? number+0x739/0x9f0 ? __pfx_string_nocheck+0x10/0x10 ? __pfx_check_pointer+0x10/0x10 ? kvm_sched_clock_read+0x15/0x30 ? sched_clock_noinstr+0xd/0x20 ? local_clock_noinstr+0x1c/0xe0 __lock_acquire+0xc4b/0x62b0 ? __pfx_format_decode+0x10/0x10 ? __pfx_string+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_vsnprintf+0x10/0x10 lock_acquire+0x1e1/0x510 ? raw_spin_rq_lock_nested+0x2b/0x40 ? __pfx_lock_acquire+0x10/0x10 ? dump_line+0x12e/0x270 ? raw_spin_rq_lock_nested+0x20/0x40 _raw_spin_lock_nested+0x42/0x80 ? raw_spin_rq_lock_nested+0x2b/0x40 raw_spin_rq_lock_nested+0x2b/0x40 scx_dump_state+0x3b3/0x1270 ? finish_task_switch+0x27e/0x840 scx_ops_error_irq_workfn+0x67/0x80 irq_work_single+0x113/0x260 irq_work_run_list.part.3+0x44/0x70 run_irq_workd+0x6b/0x90 ? __pfx_run_irq_workd+0x10/0x10 smpboot_thread_fn+0x529/0x870 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0x305/0x3f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x40/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
This commit therefore use rq_lock_irqsave/irqrestore() to replace rq_lock/unlock() in the scx_dump_state().
--- kernel/sched/ext.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/sched/ext.c +2 -2
@@ -4270,7 +4270,7 @@ static void scx_dump_state(struct scx_exit_info *ei, size_t dump_len)size_t avail, used;bool idle; -rq_lock (rq, &rf); +rq_lock_irqsave (rq, &rf); idle =list_empty (&rq->scx.runnable_list) && rq->curr->sched_class == &idle_sched_class;
@@ -4339,7 +4339,7 @@ static void scx_dump_state(struct scx_exit_info *ei, size_t dump_len)list_for_each_entry (p, &rq->scx.runnable_list, scx.runnable_node)scx_dump_task (&s, &dctx, p,' ' ); next: -rq_unlock (rq, &rf); +rq_unlock_irqrestore (rq, &rf); }dump_newline (&s);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 130/247 perf header: Write bpf_prog (infos|btfs)_cnt to data file
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Falcon <[email protected]>
[ Upstream commit 85c894a80ac46aa177df04e0a33bcad409b7d64f ]
With commit f0d0f978f3f5830a ("perf header: Don't write empty BPF/BTF info"), the write_bpf_( prog_info() | btf() ) functions exit without writing anything if env->bpf_prog.(infos| btfs)_cnt is zero.
process_bpf_( prog_info() | btf() ), however, still expect a "count" value to exist in the data file. If btf information is empty, for example, process_bpf_btf will read garbage or some other data as the number of btf nodes in the data file. As a result, the data file will not be processed correctly.
Instead, write the count to the data file and exit if it is zero.
--- tools/perf/util/header.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
tools/perf/util/header.c +2 -8
@@ -1022,12 +1022,9 @@ static int write_bpf_prog_info(struct feat_fd *ff,down_read (&env->bpf_progs.lock); -if (env->bpf_progs.infos_cnt ==0 ) - goto out; - ret =do_write (ff, &env->bpf_progs.infos_cnt,sizeof (env->bpf_progs.infos_cnt)); -if (ret <0 ) +if (ret <0 || env->bpf_progs.infos_cnt ==0 ) goto out; root = &env->bpf_progs.infos;
@@ -1067,13 +1064,10 @@ static int write_bpf_btf(struct feat_fd *ff,down_read (&env->bpf_progs.lock); -if (env->bpf_progs.btfs_cnt ==0 ) - goto out; - ret =do_write (ff, &env->bpf_progs.btfs_cnt,sizeof (env->bpf_progs.btfs_cnt)); -if (ret <0 ) +if (ret <0 || env->bpf_progs.btfs_cnt ==0 ) goto out; root = &env->bpf_progs.btfs;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 131/247 perf build: Dont fail fast path feature detection when binutils-devel is not available
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit a09e5967ad6819379fd31894634d7aed29c18409 ]
This is one more remnant of the BUILD_NONDISTRO series to make building with binutils-devel opt-in due to license incompatibility.
In this case just the references at link time were still in place, which make building the test-all.bin file fail, which wasn't detected before probably because the last test was done with binutils-devel available, doh.
Now:
$ rpm -q binutils-devel package binutils-devel is not installed $ file /tmp/build/perf-tools/feature/test-all.bin /tmp/build/perf-tools/feature/test-all.bin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=4b5388a346b51f1b993f0b0dbd49f4570769b03c, for GNU/Linux 3.2.0, not stripped $
--- tools/build/feature/Makefile | 4 ++-- tools/perf/Makefile.config | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-)
tools/build/feature/Makefile +2 -2
@@ -110,7 +110,7 @@ all: $(FILES) __BUILD = $(CC) $(CFLAGS) -MD -Wall -Werror -o $@ $(patsubst %.bin,%.c,$(@F)) $(LDFLAGS) BUILD = $(__BUILD) > $(@:.bin=.make.output) 2>&1 BUILD_BFD = $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl - BUILD_ALL = $(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma -lzstd + BUILD_ALL = $(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -ldl -lz -llzma -lzstd __BUILDXX = $(CXX) $(CXXFLAGS) -MD -Wall -Werror -o $@ $(patsubst %.bin,%.cpp,$(@F)) $(LDFLAGS) BUILDXX = $(__BUILDXX) > $(@:.bin=.make.output) 2>&1
@@ -118,7 +118,7 @@ __BUILDXX = $(CXX) $(CXXFLAGS) -MD -Wall -Werror -o $@ $(patsubst %.bin,%.cpp,$( ############################### $(OUTPUT)test-all.bin: - $(BUILD_ALL) || $(BUILD_ALL) -lopcodes -liberty + $(BUILD_ALL) $(OUTPUT)test-hello.bin: $(BUILD)
tools/perf/Makefile.config +2 -3
@@ -323,9 +323,6 @@ FEATURE_CHECK_LDFLAGS-libpython := $(PYTHON_EMBED_LDOPTS) FEATURE_CHECK_LDFLAGS-libaio = -lrt -FEATURE_CHECK_LDFLAGS-disassembler-four-args = -lbfd -lopcodes -ldl -FEATURE_CHECK_LDFLAGS-disassembler-init-styled = -lbfd -lopcodes -ldl - CORE_CFLAGS += -fno-omit-frame-pointer CORE_CFLAGS += -Wall CORE_CFLAGS += -Wextra
@@ -921,6 +918,8 @@ ifdef BUILD_NONDISTRO ifeq ($(feature-libbfd), 1) EXTLIBS += -lbfd -lopcodes + FEATURE_CHECK_LDFLAGS-disassembler-four-args = -lbfd -lopcodes -ldl + FEATURE_CHECK_LDFLAGS-disassembler-init-styled = -lbfd -lopcodes -ldl else # we are on a system that requires -liberty and (maybe) -lz # to link against -lbfd; test each case individually here
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 132/247 perf lock: Fix segfault due to missing kernel map
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ravi Bangoria <[email protected]>
[ Upstream commit d0206db94b36c998c11458cfdae2f45ba20bc4fb ]
Kernel maps are encoded in PERF_RECORD_MMAP2 samples but "perf lock report" and "perf lock contention" do not process MMAP2 samples.
Because of that, machine->vmlinux_map stays NULL and any later access triggers a segmentation fault.
Fix it by adding ->mmap2() callbacks.
--- tools/perf/builtin-lock.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/builtin-lock.c +2 -0
@@ -1867,6 +1867,7 @@ static int __cmd_report(bool display_info) eops.sample = process_sample_event; eops.comm = perf_event__process_comm; eops.mmap = perf_event__process_mmap; + eops.mmap2 = perf_event__process_mmap2; eops.namespaces = perf_event__process_namespaces; eops.tracing_data = perf_event__process_tracing_data; session =perf_session__new (&data, &eops);
@@ -2023,6 +2024,7 @@ static int __cmd_contention(int argc, const char **argv) eops.sample = process_sample_event; eops.comm = perf_event__process_comm; eops.mmap = perf_event__process_mmap; + eops.mmap2 = perf_event__process_mmap2; eops.tracing_data = perf_event__process_tracing_data;perf_env__init (&host_env);
Signature · 1 line
2.51.0