6.6.117-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 149/529 drm/amdkfd: Handle lack of READ permissions in SVM mapping
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kent Russell <[email protected]>
[ Upstream commit 0ed704d058cec7643a716a21888d58c7d03f2c3e ]
HMM assumes that pages have READ permissions by default. Inside svm_range_validate_and_map, we add READ permissions then add WRITE permissions if the VMA isn't read-only. This will conflict with regions that only have PROT_WRITE or have PROT_NONE. When that happens, svm_range_restore_work will continue to retry, silently, giving the impression of a hang if pr_debug isn't enabled to show the retries..
If pages don't have READ permissions, simply unmap them and continue. If they weren't mapped in the first place, this would be a no-op. Since x86 doesn't support write-only, and PROT_NONE doesn't allow reads or writes anyways, this will allow the svm range validation to continue without getting stuck in a loop forever on mappings we can't use with HMM.
--- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
drivers/gpu/drm/amd/amdkfd/kfd_svm.c +23 -0
@@ -1709,6 +1709,29 @@ static int svm_range_validate_and_map(struct mm_struct *mm, next =min (vma->vm_end, end); npages = (next - addr) >>PAGE_SHIFT ; +/* HMM requires at least READ permissions. If provided with PROT_NONE, +* unmap the memory. If it's not already mapped, this is a no-op +* If PROT_WRITE is provided without READ, warn first then unmap +*/ +if (!(vma->vm_flags &VM_READ )) { +unsigned long e, s; + +svm_range_lock (prange); +if (vma->vm_flags &VM_WRITE ) +pr_debug ("VM_WRITE without VM_READ is not supported" ); + s =max (start, prange->start); + e =min (end, prange->last); +if (e >= s) + r =svm_range_unmap_from_gpus (prange, s, e, +KFD_SVM_UNMAP_TRIGGER_UNMAP_FROM_CPU ); +svm_range_unlock (prange); +/* If unmap returns non-zero, we'll bail on the next for loop +* iteration, so just leave r and continue +*/ + addr = next; +continue ; + } +WRITE_ONCE (p->svms.faulting_task, current); r = amdgpu_hmm_range_get_pages(&prange->notifier, addr, npages, readonly, owner, NULL,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 150/529 iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Gobbi <[email protected]>
[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
avg sample info is a bit field coded inside the following
bits: 5,6,7 and 8 of a device status register.
Channel num info the same, but over bits: 1, 2 and 3.
Mask both values in order to avoid touching other register bits, since the first info (avg sample), came from DT.
--- drivers/iio/adc/spear_adc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/iio/adc/spear_adc.c +5 -4
@@ -12,6 +12,7 @@#include <linux/kernel.h> #include <linux/slab.h> #include <linux/io.h> +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/err.h> #include <linux/completion.h>
@@ -29,9 +30,9 @@/* Bit definitions for SPEAR_ADC_STATUS */ #define SPEAR_ADC_STATUS_START_CONVERSION BIT(0) -#define SPEAR_ADC_STATUS_CHANNEL_NUM (x) ((x) << 1) +#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK GENMASK(3, 1)#define SPEAR_ADC_STATUS_ADC_ENABLE BIT(4) -#define SPEAR_ADC_STATUS_AVG_SAMPLE (x) ((x) << 5) +#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK GENMASK(8, 5)#define SPEAR_ADC_STATUS_VREF_INTERNAL BIT(9)#define SPEAR_ADC_DATA_MASK 0x03ff
@@ -157,8 +158,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,case IIO_CHAN_INFO_RAW :mutex_lock (&st->lock); - status =SPEAR_ADC_STATUS_CHANNEL_NUM (chan->channel) | -SPEAR_ADC_STATUS_AVG_SAMPLE (st->avg_samples) | + status =FIELD_PREP (SPEAR_ADC_STATUS_CHANNEL_NUM_MASK , chan->channel) | +FIELD_PREP (SPEAR_ADC_STATUS_AVG_SAMPLE_MASK , st->avg_samples) |SPEAR_ADC_STATUS_START_CONVERSION |SPEAR_ADC_STATUS_ADC_ENABLE ;if (st->vref_external ==0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 151/529 iio: adc: imx93_adc: load calibrated values even calibration failed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <[email protected]>
[ Upstream commit 12c9b09e981ab14ebec8e4eefa946cbd26dd306b ]
ADC calibration might fail because of the noise on reference voltage. To avoid calibration fail, need to meet the following requirement:
ADC reference voltage Noise < 1.8V * 1/2^ENOB
For the case which the ADC reference voltage on board do not meet the requirement, still load the calibrated values, so ADC can also work but maybe not that accurate.
--- drivers/iio/adc/imx93_adc.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/iio/adc/imx93_adc.c +15 -3
@@ -38,6 +38,7 @@#define IMX93_ADC_PCDR6 0x118#define IMX93_ADC_PCDR7 0x11c#define IMX93_ADC_CALSTAT 0x39C +#define IMX93_ADC_CALCFG0 0x3A0/* ADC bit shift */ #define IMX93_ADC_MCR_MODE_MASK BIT(29)
@@ -58,6 +59,8 @@#define IMX93_ADC_IMR_ECH_MASK BIT(0)#define IMX93_ADC_PCDR_CDATA_MASK GENMASK(11, 0) +#define IMX93_ADC_CALCFG0_LDFAIL_MASK BIT(4) +/* ADC status */ #define IMX93_ADC_MSR_ADCSTATUS_IDLE 0#define IMX93_ADC_MSR_ADCSTATUS_POWER_DOWN 1
@@ -145,7 +148,7 @@ static void imx93_adc_config_ad_clk(struct imx93_adc *adc)static int imx93_adc_calibration (struct imx93_adc *adc) { -u32 mcr, msr; +u32 mcr, msr, calcfg;int ret;/* make sure ADC in power down mode */
@@ -158,6 +161,11 @@ static int imx93_adc_calibration(struct imx93_adc *adc)imx93_adc_power_up (adc); +/* Enable loading of calibrated values even in fail condition */ + calcfg =readl (adc->regs +IMX93_ADC_CALCFG0 ); + calcfg |=IMX93_ADC_CALCFG0_LDFAIL_MASK ; +writel (calcfg, adc->regs +IMX93_ADC_CALCFG0 ); +/* * TODO: we use the default TSAMP/NRSMPL/AVGEN in MCR, * can add the setting of these bit if need in future.
@@ -180,9 +188,13 @@ static int imx93_adc_calibration(struct imx93_adc *adc)/* check whether calbration is success or not */ msr =readl (adc->regs +IMX93_ADC_MSR );if (msr &IMX93_ADC_MSR_CALFAIL_MASK ) { +/* +* Only give warning here, this means the noise of the +* reference voltage do not meet the requirement: +* ADC reference voltage Noise < 1.8V * 1/2^ENOB +* And the resault of ADC is not that accurate. +*/ dev_warn (adc->dev,"ADC calibration failed!\n" ); -imx93_adc_power_down (adc); -return -EAGAIN ; }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 152/529 usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: raub camaioni <[email protected]>
[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
This fix is already present in f_ecm.c and was never propagated to f_ncm.c
When creating multiple NCM ethernet devices
on a composite usb gadget device
each MAC address on the HOST side will be identical. Having the same MAC on different network interfaces is bad.
This fix updates the MAC address inside the ncm_strings_defs global during the ncm_bind call. This ensures each device has a unique MAC.
In f_ecm.c ecm_string_defs is updated in the same way.
The defunct MAC assignment in ncm_alloc has been removed.
--- drivers/usb/gadget/function/f_ncm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +2 -1
@@ -1449,6 +1449,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) ncm_opts->bound = true; + ncm_string_defs[1 ].s = ncm->ethaddr; + us =usb_gstrings_attach (cdev, ncm_strings,ARRAY_SIZE (ncm_string_defs));if (IS_ERR (us))
@@ -1696,7 +1698,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)mutex_unlock (&opts->lock);return ERR_PTR (-EINVAL ); } - ncm_string_defs[STRING_MAC_IDX ].s = ncm->ethaddr;spin_lock_init (&ncm->lock);ncm_reset_values (ncm);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 153/529 char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 52e2bb5ff089d65e2c7d982fe2826dc88e473d50 ]
For miscdevice who wants dynamic minor, it may fail to be registered again without reinitialization after being de-registered, which is illustrated by kunit test case miscdev_test_dynamic_reentry() newly added.
There is a real case found by cascardo when a part of minor range were contained by range [0, 255):
1) wmi/dell-smbios registered minor 122, and acpi_thermal_rel registered minor 123
2) unbind "int3400 thermal" driver from its device, this will de-register acpi_thermal_rel
3) rmmod then insmod dell_smbios again, now wmi/dell-smbios is using minor 123
4) bind the device to "int3400 thermal" driver again, acpi_thermal_rel fails to register.
Some drivers may reuse the miscdevice structure after they are deregistered If the intention is to allocate a dynamic minor, if the minor number is not reset to MISC_DYNAMIC_MINOR before calling misc_register(), it will try to register a previously dynamically allocated minor number, which may have been registered by a different driver.
One such case is the acpi_thermal_rel misc device, registered by the int3400 thermal driver. If the device is unbound from the driver and later bound, if there was another dynamic misc device registered in between, it would fail to register the acpi_thermal_rel misc device. Other drivers behave similarly.
Actually, this kind of issue is prone to happen if APIs misc_register()/misc_deregister() are invoked by driver's probe()/remove() separately.
Instead of fixing all the drivers, just reset the minor member to MISC_DYNAMIC_MINOR in misc_deregister() in case it was a dynamically allocated minor number, as error handling of misc_register() does.
--- drivers/char/misc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/char/misc.c +2 -0
@@ -300,6 +300,8 @@ void misc_deregister(struct miscdevice *misc)list_del (&misc->list);device_destroy (&misc_class,MKDEV (MISC_MAJOR , misc->minor));misc_minor_free (misc->minor); +if (misc->minor >MISC_DYNAMIC_MINOR ) + misc->minor =MISC_DYNAMIC_MINOR ;mutex_unlock (&misc_mtx); }EXPORT_SYMBOL (misc_deregister);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 154/529 char: misc: Does not request module for miscdevice with dynamic minor
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
misc_open() may request module for miscdevice with dynamic minor, which is meaningless since:
- The dynamic minor allocated is unknown in advance without registering miscdevice firstly.
- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
Fix by only requesting module for miscdevice with fixed minor.
--- drivers/char/misc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/char/misc.c +5 -3
@@ -150,7 +150,8 @@ static int misc_open(struct inode *inode, struct file *file)break ; } -if (!new_fops) { +/* Only request module for fixed minor code */ +if (!new_fops && minor <MISC_DYNAMIC_MINOR ) {mutex_unlock (&misc_mtx);request_module ("char-major-%d-%d" ,MISC_MAJOR , minor);mutex_lock (&misc_mtx);
@@ -162,10 +163,11 @@ static int misc_open(struct inode *inode, struct file *file) new_fops =fops_get (iter->fops);break ; } -if (!new_fops) - goto fail; } +if (!new_fops) + goto fail; +/* * Place the miscdevice in the file's * private_data so it can be used by the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 155/529 net: When removing nexthops, dont call synchronize_net if it is not necessary
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <[email protected]>
[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
When removing a nexthop, commit90f33bffa382 ("nexthops: don't modify published nexthop groups") added a call to synchronize_rcu() (later changed to _net()) to make sure everyone sees the new nexthop-group before the rtnl-lock is released.
When one wants to delete a large number of groups and nexthops, it is fastest to first flush the groups (ip nexthop flush groups) and then flush the nexthops themselves (ip -6 nexthop flush). As that way the groups don't need to be rebalanced.
However, ip -6 nexthop flush will still take a long time if there is a very large number of nexthops because of the call to synchronize_net(). Now, if there are no more groups, there is no point in calling synchronize_net(). So, let's skip that entirely by checking if nh->grp_list is empty.
This gives us a nice speedup:
BEFORE:
=======
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 2097152 nexthops
real 1m45.345s
user 0m0.001s
sys 0m0.005s
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 4194304 nexthops
real 3m10.430s
user 0m0.002s
sys 0m0.004s
AFTER:
======
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 2097152 nexthops
real 0m17.545s
user 0m0.003s
sys 0m0.003s
$ time sudo ip -6 nexthop flush Dump was interrupted and may be inconsistent. Flushed 4194304 nexthops
real 0m35.823s
user 0m0.002s
sys 0m0.004s
--- net/ipv4/nexthop.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/ipv4/nexthop.c +6 -0
@@ -1835,6 +1835,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh, {struct nh_grp_entry *nhge, *tmp; +/* If there is nothing to do, let's avoid the costly call to +* synchronize_net() +*/ +if (list_empty (&nh->grp_list)) +return ; +list_for_each_entry_safe (nhge, tmp, &nh->grp_list, nh_list)remove_nh_grp_entry (net, nhge, nlinfo);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 156/529 net: stmmac: Correctly handle Rx checksum offload errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit ee0aace5f844ef59335148875d05bec8764e71e8 ]
The stmmac_rx function would previously set skb->ip_summed to CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled and the packet was of a known IP ethertype.
However, this logic failed to check if the hardware had actually reported a checksum error. The hardware status, indicating a header or payload checksum failure, was being ignored at this stage. This could cause corrupt packets to be passed up the network stack as valid.
This patch corrects the logic by checking the csum_none status flag, which is set when the hardware reports a checksum error. If this flag is set, skb->ip_summed is now correctly set to CHECKSUM_NONE, ensuring the kernel's network stack will perform its own validation and properly handle the corrupt packet.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +2 -1
@@ -5527,7 +5527,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)stmmac_rx_vlan (priv->dev, skb); skb->protocol =eth_type_trans (skb, priv->dev); -if (unlikely (!coe) || !stmmac_has_ip_ethertype (skb)) +if (unlikely (!coe) || !stmmac_has_ip_ethertype (skb) || + (status & csum_none))skb_checksum_none_assert (skb);else skb->ip_summed =CHECKSUM_UNNECESSARY ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 157/529 net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
Initially, trace_sock_exceed_buf_limit() was invoked when __sk_mem_raise_allocated() failed due to the memcg limit or the global limit.
However, commit d6f19938eb031 ("net: expose sk wmem in sock_exceed_buf_limit tracepoint") somehow suppressed the event only when memcg failed to charge for SK_MEM_RECV, although the memcg failure for SK_MEM_SEND still triggers the event.
Let's restore the event for SK_MEM_RECV.
--- net/core/sock.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/core/sock.c +1 -2
@@ -3141,8 +3141,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind) } } -if (kind ==SK_MEM_SEND || (kind ==SK_MEM_RECV && charged)) -trace_sock_exceed_buf_limit (sk, prot, allocated, kind); +trace_sock_exceed_buf_limit (sk, prot, allocated, kind);sk_memory_allocated_sub (sk, amt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 158/529 PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungho Kim <[email protected]>
[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
The error handling path in pci_p2pdma_add_resource() contains a bug in its pgmap_free label.
Memory is allocated for the p2p_pgmap struct, and the pointer is stored in p2p_pgmap. However, the error path calls devm_kfree() with pgmap, which is a pointer to a member field within the p2p_pgmap struct, not the base pointer of the allocation.
Correct the bug by passing the correct base pointer, p2p_pgmap, to devm_kfree().
--- drivers/pci/p2pdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/p2pdma.c +1 -1
@@ -351,7 +351,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size, pages_free:devm_memunmap_pages (&pdev->dev, pgmap); pgmap_free: -devm_kfree (&pdev->dev, pgmap); +devm_kfree (&pdev->dev, p2p_pgmap);return error; }EXPORT_SYMBOL_GPL (pci_p2pdma_add_resource);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 159/529 ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
Just add fixed struct size validations for UAC2 and UAC3 effect units. The descriptor has a variable-length array, so it should be validated with a proper function later once when the unit is really parsed and used by the driver (currently only referred partially for the input terminal parsing).
--- sound/usb/validate.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/usb/validate.c +7 -2
@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {FUNC (UAC_VERSION_2 ,UAC_MIXER_UNIT , validate_mixer_unit),FUNC (UAC_VERSION_2 ,UAC_SELECTOR_UNIT , validate_selector_unit),FUNC (UAC_VERSION_2 ,UAC_FEATURE_UNIT , validate_uac2_feature_unit), -/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */ +/* just a stop-gap, it should be a proper function for the array +* once if the unit is really parsed/used +*/ +FIXED (UAC_VERSION_2 ,UAC2_EFFECT_UNIT , + struct uac2_effect_unit_descriptor),FUNC (UAC_VERSION_2 ,UAC2_PROCESSING_UNIT_V2 , validate_processing_unit),FUNC (UAC_VERSION_2 ,UAC2_EXTENSION_UNIT_V2 , validate_processing_unit), FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {FUNC (UAC_VERSION_3 ,UAC3_MIXER_UNIT , validate_mixer_unit),FUNC (UAC_VERSION_3 ,UAC3_SELECTOR_UNIT , validate_selector_unit),FUNC (UAC_VERSION_3 ,UAC3_FEATURE_UNIT , validate_uac3_feature_unit), -/* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */ +FIXED (UAC_VERSION_3 ,UAC3_EFFECT_UNIT , + struct uac2_effect_unit_descriptor), /* sharing the same struct */FUNC (UAC_VERSION_3 ,UAC3_PROCESSING_UNIT , validate_processing_unit),FUNC (UAC_VERSION_3 ,UAC3_EXTENSION_UNIT , validate_processing_unit), FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 160/529 rds: Fix endianness annotation for RDS_MPATH_HASH
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ujwal Kundur <[email protected]>
[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
jhash_1word accepts host endian inputs while rs_bound_port is a be16 value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
Flagged by Sparse.
--- net/rds/rds.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/rds.h +1 -1
@@ -93,7 +93,7 @@ enum {/* Max number of multipaths per RDS connection. Must be a power of 2 */ #define RDS_MPATH_WORKERS 8 -#define RDS_MPATH_HASH (rs, n) (jhash_1word((rs)->rs_bound_port, \ +#define RDS_MPATH_HASH (rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \ (rs)->rs_hash_initval) & ((n) - 1))#define IS_CANONICAL (laddr, faddr) (htonl(laddr) < htonl(faddr))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 161/529 scsi: mpi3mr: Fix controller init failure on fault during queue creation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chandrakanth Patil <[email protected]>
[ Upstream commit 829fa1582b6ff607b0e2fe41ba1c45c77f686618 ]
Firmware can enter a transient fault while creating operational queues. The driver fails the load immediately.
Add a retry loop that checks controller status and history bit after queue creation. If either indicates a fault, retry init up to a set limit before failing.
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/scsi/mpi3mr/mpi3mr_fw.c +10 -0
@@ -2117,6 +2117,8 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc) {int retval =0 ;u16 num_queues =0 , i =0 , msix_count_op_q =1 ; +u32 ioc_status; +enum mpi3mr_iocstate ioc_state; num_queues =min_t (int, mrioc->facts.max_op_reply_q, mrioc->facts.max_op_req_q);
@@ -2172,6 +2174,14 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc) retval =-1 ; goto out_failed; } + ioc_status =readl (&mrioc->sysif_regs->ioc_status); + ioc_state =mpi3mr_get_iocstate (mrioc); +if ((ioc_status &MPI3_SYSIF_IOC_STATUS_RESET_HISTORY ) || + ioc_state !=MRIOC_STATE_READY ) { +mpi3mr_print_fault_info (mrioc); + retval =-1 ; + goto out_failed; + } mrioc->num_op_reply_q = mrioc->num_op_req_q = i; ioc_info(mrioc, "successfully created %d operational queue pairs(default/polled) queue = (%d/%d)\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 162/529 scsi: pm80xx: Fix race condition caused by static variables
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francisco Gutierrez <[email protected]>
[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
Eliminate the use of static variables within the log pull implementation to resolve a race condition and prevent data gaps when pulling logs from multiple controllers in parallel, ensuring each operation is properly isolated.
--- drivers/scsi/pm8001/pm8001_ctl.c | 22 ++++++++++++---------- drivers/scsi/pm8001/pm8001_init.c | 1 + drivers/scsi/pm8001/pm8001_sas.h | 4 ++++ 3 files changed, 17 insertions(+), 10 deletions(-)
drivers/scsi/pm8001/pm8001_ctl.c +12 -10
@@ -534,23 +534,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,char *str = buf;u32 read_size = pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size /1024 ; -static u32 start, end, count;u32 max_read_times =32 ;u32 max_count = (read_size *1024 ) / (max_read_times *4 );u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP ].virt_ptr; -if ((count % max_count) ==0 ) { - start =0 ; - end = max_read_times; - count =0 ; +mutex_lock (&pm8001_ha->iop_log_lock); + +if ((pm8001_ha->iop_log_count % max_count) ==0 ) { + pm8001_ha->iop_log_start =0 ; + pm8001_ha->iop_log_end = max_read_times; + pm8001_ha->iop_log_count =0 ; }else { - start = end; - end = end + max_read_times; + pm8001_ha->iop_log_start = pm8001_ha->iop_log_end; + pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times; } -for (; start < end; start++) - str +=sprintf (str,"%08x " , *(temp+start)); - count++; +for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++) + str +=sprintf (str,"%08x " , *(temp+pm8001_ha->iop_log_start)); + pm8001_ha->iop_log_count++; +mutex_unlock (&pm8001_ha->iop_log_lock);return str - buf; } static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
drivers/scsi/pm8001/pm8001_init.c +1 -0
@@ -529,6 +529,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev, pm8001_ha->id = pm8001_id++; pm8001_ha->logging_level = logging_level; pm8001_ha->non_fatal_count =0 ; +mutex_init (&pm8001_ha->iop_log_lock);if (link_rate >=1 && link_rate <=15 ) pm8001_ha->link_rate = (link_rate <<8 );else {
drivers/scsi/pm8001/pm8001_sas.h +4 -0
@@ -543,6 +543,10 @@ struct pm8001_hba_info {u32 ci_offset;u32 pi_offset;u32 max_memcnt; +u32 iop_log_start; +u32 iop_log_end; +u32 iop_log_count; +struct mutex iop_log_lock; };struct pm8001_work {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 163/529 extcon: adc-jack: Fix wakeup source leaks on device unbind
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
Device can be unbound, so driver must also release memory for the wakeup source. Do not use devm interface, because it would change the order of cleanup.
--- drivers/extcon/extcon-adc-jack.c | 1 + 1 file changed, 1 insertion(+)
drivers/extcon/extcon-adc-jack.c +1 -0
@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev) {struct adc_jack_data *data =platform_get_drvdata (pdev); +device_init_wakeup (&pdev->dev, false);free_irq (data->irq, data);cancel_work_sync (&data->handler.work);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 164/529 remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit 461edcf73eec57bc0006fbb5209f5012c514c58b ]
Use device life-cycle managed runtime enable function to simplify probe and exit paths.
--- drivers/remoteproc/wkup_m3_rproc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/remoteproc/wkup_m3_rproc.c +3 -3
@@ -148,7 +148,9 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev)return -ENODEV ; } -pm_runtime_enable (&pdev->dev); + ret =devm_pm_runtime_enable (dev); +if (ret <0 ) +return dev_err_probe (dev, ret,"Failed to enable runtime PM\n" ); ret =pm_runtime_get_sync (&pdev->dev);if (ret <0 ) {dev_err (&pdev->dev,"pm_runtime_get_sync() failed\n" );
@@ -219,7 +221,6 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev)rproc_free (rproc); err:pm_runtime_put_noidle (dev); -pm_runtime_disable (dev);return ret; }
@@ -230,7 +231,6 @@ static void wkup_m3_rproc_remove(struct platform_device *pdev)rproc_del (rproc);rproc_free (rproc);pm_runtime_put_sync (&pdev->dev); -pm_runtime_disable (&pdev->dev); }#ifdef CONFIG_PM
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 165/529 net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit a0f849c1cc6df0db9083b4c81c05a5456b1ed0fb ]
fixed_phy_register() creates and registers the phy_device. To be symmetric, we should not only unregister, but also free the phy_device in fixed_phy_unregister(). This allows to simplify code in users.
Note wrt of_phy_deregister_fixed_link():put_device(&phydev->mdio.dev) and phy_device_free(phydev) are identical.
--- drivers/net/dsa/dsa_loop.c | 9 +++------ drivers/net/mdio/of_mdio.c | 1 - drivers/net/phy/fixed_phy.c | 1 + 3 files changed, 4 insertions(+), 7 deletions(-)
drivers/net/dsa/dsa_loop.c +3 -6
@@ -378,13 +378,10 @@ static struct mdio_driver dsa_loop_drv = {static void dsa_loop_phydevs_unregister (void ) { -unsigned int i; - -for (i =0 ; i <NUM_FIXED_PHYS ; i++) -if (!IS_ERR (phydevs[i])) { +for (int i =0 ; i <NUM_FIXED_PHYS ; i++) { +if (!IS_ERR (phydevs[i]))fixed_phy_unregister (phydevs[i]); -phy_device_free (phydevs[i]); - } + } }static int __init dsa_loop_init (void )
drivers/net/mdio/of_mdio.c +0 -1
@@ -440,6 +440,5 @@ void of_phy_deregister_fixed_link(struct device_node *np)fixed_phy_unregister (phydev);put_device (&phydev->mdio.dev);/* of_phy_find_device() */ -phy_device_free (phydev);/* fixed_phy_register() */ }EXPORT_SYMBOL (of_phy_deregister_fixed_link);
drivers/net/phy/fixed_phy.c +1 -0
@@ -329,6 +329,7 @@ void fixed_phy_unregister(struct phy_device *phy)phy_device_remove (phy);of_node_put (phy->mdio.dev.of_node);fixed_phy_del (phy->mdio.addr); +phy_device_free (phy); }EXPORT_SYMBOL_GPL (fixed_phy_unregister);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 166/529 fuse: zero initialize inode private data
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <[email protected]>
[ Upstream commit 3ca1b311181072415b6432a169de765ac2034e5a ]
This is slightly tricky, since the VFS uses non-zeroing allocation to preserve some fields that are left in a consistent state.
--- fs/fuse/inode.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
fs/fuse/inode.c +4 -7
@@ -94,14 +94,11 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)if (!fi)return NULL ; - fi->i_time =0 ; +/* Initialize private data (i.e. everything except fi->inode) */ +BUILD_BUG_ON (offsetof(struct fuse_inode , inode) !=0 ); +memset ((void *) fi +sizeof (fi->inode),0 ,sizeof (*fi) -sizeof (fi->inode)); + fi->inval_mask = ~0 ; - fi->nodeid =0 ; - fi->nlookup =0 ; - fi->attr_version =0 ; - fi->orig_ino =0 ; - fi->state =0 ; - fi->submount_lookup =NULL ;mutex_init (&fi->mutex);spin_lock_init (&fi->lock); fi->forget =fuse_alloc_forget ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 167/529 drm/amdkfd: fix vram allocation failure for a special case
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Huang <[email protected]>
[ Upstream commit 93aa919ca05bec544b17ee9a1bfe394ce6c94bd8 ]
When it only allocates vram without va, which is 0, and a SVM range allocated stays in this range, the vram allocation returns failure. It should be skipped for this case from SVM usage check.
--- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +6 -1
@@ -1085,7 +1085,12 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,svm_range_list_lock_and_flush_work (&p->svms, current->mm);mutex_lock (&p->svms.lock);mmap_write_unlock (current->mm); -if (interval_tree_iter_first (&p->svms.objects, + +/* Skip a special case that allocates VRAM without VA, +* VA will be invalid of 0. +*/ +if (!(!args->va_addr && (flags &KFD_IOC_ALLOC_MEM_FLAGS_VRAM )) && +interval_tree_iter_first (&p->svms.objects, args->va_addr >>PAGE_SHIFT , (args->va_addr + args->size -1 ) >>PAGE_SHIFT )) { pr_err("Address: 0x%llx already allocated by SVM\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 168/529 drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amber Lin <[email protected]>
[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
When KFD asks CP to preempt queues, other than preempt CP queues, CP also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout. Currently queue_preemption_timeout_ms is 9000 ms by default but can be configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as 4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to queue_preemption_timeout_ms so in a slow system such as emulator, both CP and SDMA slowness are taken into account.
--- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_priv.h +8 -1
@@ -111,7 +111,14 @@#define KFD_KERNEL_QUEUE_SIZE 2048 -#define KFD_UNMAP_LATENCY_MS (4000) +/* KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC +* can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time +* driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is +* queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload +* The format here makes CP workload 10% of total timeout +*/ +#define KFD_UNMAP_LATENCY_MS \ + ((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)#define KFD_MAX_SDMA_QUEUES 128
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 169/529 media: fix uninitialized symbol warnings
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chelsy Ratnawat <[email protected]>
[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
Initialize variables to fix these smatch warnings drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'protocol'.drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'scancode'.drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized symbol 'toggle'.drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized symbol 'adc_envelope'.drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized symbol 'lock_status'.drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized symbol 'frame_lines'.drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized symbol 'quality'.drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized symbol 'adc_envelope'.drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized symbol 'lock_status'.drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized symbol 'frame_lines'.drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized symbol 'quality'.drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized symbol 'snr'.drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized symbol 'totalgain'.
--- drivers/media/i2c/ir-kbd-i2c.c | 6 +++--- drivers/media/tuners/xc4000.c | 8 ++++---- drivers/media/tuners/xc5000.c | 12 ++++++------ 3 files changed, 13 insertions(+), 13 deletions(-)
drivers/media/i2c/ir-kbd-i2c.c +3 -3
@@ -321,9 +321,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,static int ir_key_poll (struct IR_i2c *ir) { -enum rc_proto protocol; -u32 scancode; -u8 toggle; +enum rc_proto protocol =0 ; +u32 scancode =0 ; +u8 toggle =0 ;int rc;dev_dbg (&ir->rc->dev,"%s\n" , __func__);
drivers/media/tuners/xc4000.c +4 -4
@@ -1087,12 +1087,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,static void xc_debug_dump (struct xc4000_priv *priv) { -u16 adc_envelope; +u16 adc_envelope =0 ;u32 freq_error_hz =0 ; -u16 lock_status; +u16 lock_status =0 ;u32 hsync_freq_hz =0 ; -u16 frame_lines; -u16 quality; +u16 frame_lines =0 ; +u16 quality =0 ;u16 signal =0 ;u16 noise =0 ;u8 hw_majorversion =0 , hw_minorversion =0 ;
drivers/media/tuners/xc5000.c +6 -6
@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,static void xc_debug_dump (struct xc5000_priv *priv) { -u16 adc_envelope; +u16 adc_envelope =0 ;u32 freq_error_hz =0 ; -u16 lock_status; +u16 lock_status =0 ;u32 hsync_freq_hz =0 ; -u16 frame_lines; -u16 quality; -u16 snr; -u16 totalgain; +u16 frame_lines =0 ; +u16 quality =0 ; +u16 snr =0 ; +u16 totalgain =0 ;u8 hw_majorversion =0 , hw_minorversion =0 ;u8 fw_majorversion =0 , fw_minorversion =0 ;u16 fw_buildversion =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 170/529 drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 585b2f685c56c5095cc22c7202bf74d8e9a73cdd ]
Update the legacy (non-DC) display code to respect the maximum pixel clock for HDMI and DVI-D. Reject modes that would require a higher pixel clock than can be supported.
Also update the maximum supported HDMI clock value depending on the ASIC type.
For reference, see the DC code:
check max_hdmi_pixel_clock in dce*_resource.c
v2:
Fix maximum clocks for DVI-D and DVI/HDMI adapters.
--- .../gpu/drm/amd/amdgpu/amdgpu_connectors.c | 57 ++++++++++++++----- 1 file changed, 44 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +44 -13
@@ -1205,29 +1205,60 @@ static void amdgpu_connector_dvi_force(struct drm_connector *connector) amdgpu_connector->use_digital = true; } +/** +* Returns the maximum supported HDMI (TMDS) pixel clock in KHz. +*/ +static int amdgpu_max_hdmi_pixel_clock (const struct amdgpu_device *adev) +{ +if (adev->asic_type >=CHIP_POLARIS10 ) +return 600000 ; +else if (adev->asic_type >=CHIP_TONGA ) +return 300000 ; +else +return 297000 ; +} + +/** +* Validates the given display mode on DVI and HDMI connectors, +* including analog signals on DVI-I. +*/ static enum drm_mode_status amdgpu_connector_dvi_mode_valid (struct drm_connector *connector,struct drm_display_mode *mode) {struct drm_device *dev = connector->dev;struct amdgpu_device *adev =drm_to_adev (dev);struct amdgpu_connector *amdgpu_connector =to_amdgpu_connector (connector); +const int max_hdmi_pixel_clock =amdgpu_max_hdmi_pixel_clock (adev); +const int max_dvi_single_link_pixel_clock =165000 ; +int max_digital_pixel_clock_khz;/* XXX check mode bandwidth */ -if (amdgpu_connector->use_digital && (mode->clock >165000 )) { -if ((amdgpu_connector->connector_object_id ==CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I ) || - (amdgpu_connector->connector_object_id ==CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D ) || - (amdgpu_connector->connector_object_id ==CONNECTOR_OBJECT_ID_HDMI_TYPE_B )) { -return MODE_OK ; - }else if (connector->display_info.is_hdmi) { -/* HDMI 1.3+ supports max clock of 340 Mhz */ -if (mode->clock >340000 ) -return MODE_CLOCK_HIGH ; -else -return MODE_OK ; - }else { -return MODE_CLOCK_HIGH ; +if (amdgpu_connector->use_digital) { +switch (amdgpu_connector->connector_object_id) { +case CONNECTOR_OBJECT_ID_HDMI_TYPE_A : + max_digital_pixel_clock_khz = max_hdmi_pixel_clock; +break ; +case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I : +case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D : + max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock; +break ; +case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I : +case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D : +case CONNECTOR_OBJECT_ID_HDMI_TYPE_B : + max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock *2 ; +break ; } + +/* When the display EDID claims that it's an HDMI display, +* we use the HDMI encoder mode of the display HW, +* so we should verify against the max HDMI clock here. +*/ +if (connector->display_info.is_hdmi) + max_digital_pixel_clock_khz = max_hdmi_pixel_clock; + +if (mode->clock > max_digital_pixel_clock_khz) +return MODE_CLOCK_HIGH ; }/* check against the max pixel clock */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 171/529 mips: lantiq: danube: add missing properties to cpu node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
This fixes the following warnings:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
--- arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/mips/boot/dts/lantiq/danube.dtsi +4 -0
@@ -5,8 +5,12 @@ compatible = "lantiq,xway", "lantiq,danube"; cpus { + #address-cells = <1>; + #size-cells = <0>; + cpu@0 { compatible = "mips,mips24Kc"; + reg = <0>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 172/529 mips: lantiq: danube: add model to EASY50712 dts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit cb96fd880ef78500b34d10fa76ddd3fa070287d6 ]
This fixes the following warning:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: / (lantiq,xway): 'model' is a required property
from schema $id: http://devicetree.org/schemas/root-node.yaml#
--- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/boot/dts/lantiq/danube_easy50712.dts +2 -0
@@ -4,6 +4,8 @@ /include/ "danube.dtsi" / { + model = "Intel EASY50712"; + chosen { bootargs = "console=ttyLTQ0,115200 init=/etc/preinit"; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 173/529 mips: lantiq: danube: add missing device_type in pci node
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
This fixes the following warning:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
--- arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/boot/dts/lantiq/danube.dtsi +2 -0
@@ -104,6 +104,8 @@ 0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */ reg = <0x7000000 0x8000 /* config space */ 0xe105400 0x400>; /* pci bridge */ + + device_type = "pci"; }; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 174/529 mips: lantiq: xway: sysctrl: rename stp clock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch changes the clock name from “stp” to “gpio”.
--- arch/mips/lantiq/xway/sysctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/lantiq/xway/sysctrl.c +1 -1
@@ -466,7 +466,7 @@ void __init ltq_soc_init(void)/* add our generic xway clocks */ clkdev_add_pmu ("10000000.fpi" ,NULL ,0 ,0 ,PMU_FPI );clkdev_add_pmu ("1e100a00.gptu" ,NULL ,1 ,0 ,PMU_GPT ); -clkdev_add_pmu ("1e100bb0.stp" ,NULL ,1 ,0 ,PMU_STP ); +clkdev_add_pmu ("1e100bb0.gpio" ,NULL ,1 ,0 ,PMU_STP );clkdev_add_pmu ("1e100c00.serial" ,NULL ,0 ,0 ,PMU_ASC1 );clkdev_add_pmu ("1e104100.dma" ,NULL ,1 ,0 ,PMU_DMA );clkdev_add_pmu ("1e100800.spi" ,NULL ,1 ,0 ,PMU_SPI );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 175/529 mips: lantiq: danube: rename stp node on EASY50712 reference board
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 2b9706ce84be9cb26be03e1ad2e43ec8bc3986be ]
This fixes the following warning:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: stp@e100bb0 (lantiq,gpio-stp-xway): $nodename:0: 'stp@e100bb0' does not match '^gpio@[0-9a-f]+$'
from schema $id: http://devicetree.org/schemas/gpio/gpio-stp-xway.yaml#
--- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/boot/dts/lantiq/danube_easy50712.dts +1 -1
@@ -96,7 +96,7 @@ lantiq,tx-burst-length = <4>; }; - stp0: stp@e100bb0 { + stp0: gpio@e100bb0 { #gpio-cells = <2>; compatible = "lantiq,gpio-stp-xway"; gpio-controller;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 176/529 crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit 4c634b6b3c77bba237ee64bca172e73f9cee0cb2 ]
As noted in the kernel documentation [1], open-coded multiplication in allocator arguments is discouraged because it can lead to integer overflow.
Use kcalloc() to gain built-in overflow protection, making memory allocation safer when calculating allocation size compared to explicit multiplication. Similarly, use size_add() instead of explicit addition for 'uobj_chunk_num + sobj_chunk_num'.
--- drivers/crypto/intel/qat/qat_common/qat_uclo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/intel/qat/qat_common/qat_uclo.c +1 -1
@@ -1745,7 +1745,7 @@ static int qat_uclo_map_objs_from_mof(struct icp_qat_mof_handle *mobj_handle)if (sobj_hdr) sobj_chunk_num = sobj_hdr->num_chunks; - mobj_hdr =kzalloc ((uobj_chunk_num + sobj_chunk_num) * + mobj_hdr =kcalloc (size_add (uobj_chunk_num, sobj_chunk_num),sizeof (*mobj_hdr),GFP_KERNEL );if (!mobj_hdr)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 177/529 scsi: pm8001: Use int instead of u32 to store error codes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
Use int instead of u32 for 'ret' variable to store negative error codes returned by PM8001_CHIP_DISP->set_nvmd_req().
--- drivers/scsi/pm8001/pm8001_ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/pm8001/pm8001_ctl.c +1 -1
@@ -682,7 +682,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)struct pm8001_ioctl_payload *payload;DECLARE_COMPLETION_ONSTACK (completion);u8 *ioctlbuffer; -u32 ret; +int ret;u32 length =1024 *5 +sizeof (*payload) -1 ;if (pm8001_ha->fw_image->size >4096 ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 178/529 ptp: Limit time setting of PTP clocks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miroslav Lichvar <[email protected]>
[ Upstream commit 5a8c02a6bf52b1cf9cfb7868a8330f7c3c6aebe9 ]
Networking drivers implementing PTP clocks and kernel socket code handling hardware timestamps use the 64-bit signed ktime_t type counting nanoseconds. When a PTP clock reaches the maximum value in year 2262, the timestamps returned to applications will overflow into year 1667. The same thing happens when injecting a large offset with clock_adjtime(ADJ_SETOFFSET).
The commit 7a8e61f84786 ("timekeeping: Force upper bound for setting CLOCK_REALTIME") limited the maximum accepted value setting the system clock to 30 years before the maximum representable value (i.e. year 2232) to avoid the overflow, assuming the system will not run for more than 30 years.
Enforce the same limit for PTP clocks. Don't allow negative values and values closer than 30 years to the maximum value. Drivers may implement an even lower limit if the hardware registers cannot represent the whole interval between years 1970 and 2262 in the required resolution.
--- drivers/ptp/ptp_clock.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/ptp/ptp_clock.c +12 -1
@@ -83,6 +83,9 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tpreturn -EBUSY ; } +if (!timespec64_valid_settod (tp)) +return -EINVAL ; +return ptp->info->settime64 (ptp->info, tp); }
@@ -113,7 +116,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx) ops = ptp->info;if (tx->modes &ADJ_SETOFFSET ) { -struct timespec64 ts; +struct timespec64 ts, ts2;ktime_t kt;s64 delta;
@@ -126,6 +129,14 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)if ((unsigned long ) ts.tv_nsec >=NSEC_PER_SEC )return -EINVAL ; +/* Make sure the offset is valid */ + err =ptp_clock_gettime (pc, &ts2); +if (err) +return err; + ts2 =timespec64_add (ts2, ts); +if (!timespec64_valid_settod (&ts2)) +return -EINVAL ; + kt =timespec64_to_ktime (ts); delta =ktime_to_ns (kt); err = ops->adjtime (ops, delta);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 179/529 dmaengine: sh: setup_xref error handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Andreatta <[email protected]>
[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
This patch modifies the type of setup_xref from void to int and handles errors since the function can fail.
setup_xref now returns the (eventual) error from dmae_set_dmars|dmae_set_chcr, while shdma_tx_submit handles the result, removing the chunks from the queue and marking PM as idle in case of an error.
--- drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------ drivers/dma/sh/shdmac.c | 17 +++++++++++++---- include/linux/shdma-base.h | 2 +- 3 files changed, 33 insertions(+), 11 deletions(-)
drivers/dma/sh/shdma-base.c +19 -6
@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)const struct shdma_ops *ops = sdev->ops;dev_dbg (schan->dev,"Bring up channel %d\n" , schan->id); -/* -* TODO: .xfer_setup() might fail on some platforms. -* Make it int then, on error remove chunks from the -* queue again -*/ - ops->setup_xfer (schan, schan->slave_id); + + ret = ops->setup_xfer (schan, schan->slave_id); +if (ret <0 ) { +dev_err (schan->dev,"setup_xfer failed: %d\n" , ret); + +/* Remove chunks from the queue and mark them as idle */ +list_for_each_entry_safe (chunk, c, &schan->ld_queue, node) { +if (chunk->cookie == cookie) { + chunk->mark =DESC_IDLE ; +list_move (&chunk->node, &schan->ld_free); + } + } + + schan->pm_state =SHDMA_PM_ESTABLISHED ; + ret =pm_runtime_put (schan->dev); + +spin_unlock_irq (&schan->chan_lock); +return ret; + }if (schan->pm_state ==SHDMA_PM_PENDING )shdma_chan_xfer_ld_queue (schan);
drivers/dma/sh/shdmac.c +13 -4
@@ -300,21 +300,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)return dmae_is_busy (sh_chan); } -static void sh_dmae_setup_xfer (struct shdma_chan *schan, -int slave_id) +static int sh_dmae_setup_xfer (struct shdma_chan *schan,int slave_id) { struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan, shdma_chan); +int ret =0 ;if (slave_id >=0 ) {const struct sh_dmae_slave_config *cfg = sh_chan->config; -dmae_set_dmars (sh_chan, cfg->mid_rid); -dmae_set_chcr (sh_chan, cfg->chcr); + ret =dmae_set_dmars (sh_chan, cfg->mid_rid); +if (ret <0 ) + goto END; + + ret =dmae_set_chcr (sh_chan, cfg->chcr); +if (ret <0 ) + goto END; + }else {dmae_init (sh_chan); } + +END: +return ret; }/*
include/linux/shdma-base.h +1 -1
@@ -96,7 +96,7 @@ struct shdma_ops {int (*desc_setup)(struct shdma_chan *,struct shdma_desc *,dma_addr_t ,dma_addr_t ,size_t *);int (*set_slave)(struct shdma_chan *,int ,dma_addr_t ,bool ); -void (*setup_xfer)(struct shdma_chan *,int ); +int (*setup_xfer)(struct shdma_chan *,int );void (*start_xfer)(struct shdma_chan *,struct shdma_desc *);struct shdma_desc *(*embedded_desc)(void *,int );bool (*chan_irq)(struct shdma_chan *,int );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 180/529 dmaengine: mv_xor: match alloc_wc and free_wc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
dma_alloc_wc is used but not dma_free_wc.
--- drivers/dma/mv_xor.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/mv_xor.c +2 -2
@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)dma_async_device_unregister (&mv_chan->dmadev); -dma_free_coherent (dev,MV_XOR_POOL_SIZE , +dma_free_wc (dev,MV_XOR_POOL_SIZE , mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);dma_unmap_single (dev, mv_chan->dummy_src_addr,MV_XOR_MIN_BYTE_COUNT ,DMA_FROM_DEVICE );
@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev, err_free_irq:free_irq (mv_chan->irq, mv_chan); err_free_dma: -dma_free_coherent (&pdev->dev,MV_XOR_POOL_SIZE , +dma_free_wc (&pdev->dev,MV_XOR_POOL_SIZE , mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool); err_unmap_dst: dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 181/529 dmaengine: dw-edma: Set status for callback_result
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devendra K Verma <[email protected]>
[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
DMA Engine has support for the callback_result which provides the status of the request and the residue. This helps in determining the correct status of the request and in efficient resource management of the request.
The 'callback_result' method is preferred over the deprecated 'callback' method.
--- drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
drivers/dma/dw-edma/dw-edma-core.c +22 -0
@@ -595,6 +595,25 @@ dw_edma_device_prep_interleaved_dma(struct dma_chan *dchan,return dw_edma_device_transfer (&xfer); } +static void dw_hdma_set_callback_result (struct virt_dma_desc *vd, +enum dmaengine_tx_result result) +{ +u32 residue =0 ; +struct dw_edma_desc *desc; +struct dmaengine_result *res; + +if (!vd->tx.callback_result) +return ; + + desc =vd2dw_edma_desc (vd); +if (desc) + residue = desc->alloc_sz - desc->xfer_sz; + + res = &vd->tx_result; + res->result = result; + res->residue = residue; +} +static void dw_edma_done_interrupt (struct dw_edma_chan *chan) {struct dw_edma_desc *desc;
@@ -608,6 +627,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)case EDMA_REQ_NONE : desc =vd2dw_edma_desc (vd);if (!desc->chunks_alloc) { +dw_hdma_set_callback_result (vd, +DMA_TRANS_NOERROR );list_del (&vd->node);vchan_cookie_complete (vd); }
@@ -644,6 +665,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)spin_lock_irqsave (&chan->vc.lock, flags); vd =vchan_next_desc (&chan->vc);if (vd) { +dw_hdma_set_callback_result (vd,DMA_TRANS_ABORTED );list_del (&vd->node);vchan_cookie_complete (vd); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 182/529 drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit b63f008f395ca5f6bc89123db97440bdc19981c4 ]
According to Hardware Programming Guide for DSI PHY, the retime buffer resync should be done after PLL clock users (byte_clk and intf_byte_clk) are enabled. Downstream also does it as part of configuring the PLL.
Driver was only turning off the resync FIFO buffer, but never bringing it on again.
Patchwork: https://patchwork.freedesktop.org/patch/657823/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +4 -0
@@ -445,6 +445,10 @@ static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw)if (pll_7nm->slave)dsi_pll_enable_global_clk (pll_7nm->slave); +writel (0x1 , pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL); +if (pll_7nm->slave) +writel (0x1 , pll_7nm->slave->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL); + error:return rc; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 183/529 drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5ddcb0cb9d10e6e70a68e0cb8f0b8e3a7eb8ccaf ]
Driver unconditionally saves current state on first init in dsi_pll_7nm_init(), but does not save the VCO rate, only some of the divider registers. The state is then restored during probe/enable via msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() -> dsi_7nm_pll_restore_state().
Restoring calls dsi_pll_7nm_vco_set_rate() with pll_7nm->vco_current_rate=0, which basically overwrites existing rate of VCO and messes with clock hierarchy, by setting frequency to 0 to clock tree. This makes anyway little sense - VCO rate was not saved, so should not be restored.
If PLL was not configured configure it to minimum rate to avoid glitches and configuring entire in clock hierarchy to 0 Hz.
Patchwork: https://patchwork.freedesktop.org/patch/657827/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c +6 -0
@@ -797,6 +797,12 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy)/* TODO: Remove this when we have proper display handover support */ msm_dsi_phy_pll_save_state (phy); +/* +* Store also proper vco_current_rate, because its value will be used in +* dsi_7nm_pll_restore_state(). +*/ +if (!dsi_pll_7nm_vco_recalc_rate (&pll_7nm->clk_hw,VCO_REF_CLK_RATE )) + pll_7nm->vco_current_rate = pll_7nm->phy->cfg->min_pll_rate;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 184/529 drm/amdgpu: Allow kfd CRIU with no buffer objects
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Francis <[email protected]>
[ Upstream commit 85705b18ae7674347f8675f64b2b3115fb1d5629 ]
The kfd CRIU checkpoint ioctl would return an error if trying to checkpoint a process with no kfd buffer objects.
This is a normal case and should not be an error.
--- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +2 -2
@@ -2572,8 +2572,8 @@ static int criu_restore(struct file *filep,pr_debug ("CRIU restore (num_devices:%u num_bos:%u num_objects:%u priv_data_size:%llu)\n" , args->num_devices, args->num_bos, args->num_objects, args->priv_data_size); -if (!args->bos || !args->devices || !args->priv_data || !args->priv_data_size || - !args->num_devices || !args->num_bos) +if ((args->num_bos >0 && !args->bos) || !args->devices || !args->priv_data || + !args->priv_data_size || !args->num_devices)return -EINVAL ;mutex_lock (&p->mutex);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 185/529 ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <[email protected]>
[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled, idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is zero, but if one of the values is negative it will in fact return non-zero.
--- net/ipv6/addrconf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/addrconf.c +3 -1
@@ -7102,7 +7102,9 @@ static const struct ctl_table addrconf_sysctl[] = { .data = &ipv6_devconf.rpl_seg_enabled, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, }, { .procname = "ioam6_enabled",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 186/529 net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juraj Šarinay <[email protected]>
[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
An exchange with a NFC target must complete within NCI_DATA_TIMEOUT. A delay of 700 ms is not sufficient for cryptographic operations on smart cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH or 3072-bit RSA. To prevent brute-force attacks, passports and similar documents introduce even longer delays into access control protocols (BAC/PACE).
The timeout should be higher, but not too much. The expiration allows us to detect that a NFC target has disappeared.
--- include/net/nfc/nci_core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/nfc/nci_core.h +1 -1
@@ -52,7 +52,7 @@ enum nci_state {#define NCI_RF_DISC_SELECT_TIMEOUT 5000#define NCI_RF_DEACTIVATE_TIMEOUT 30000#define NCI_CMD_TIMEOUT 5000 -#define NCI_DATA_TIMEOUT 700 +#define NCI_DATA_TIMEOUT 3000struct nci_dev ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 187/529 media: adv7180: Add missing lock in suspend callback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit 878c496ac5080f94a93a9216a8f70cfd67ace8c9 ]
The adv7180_set_power() utilizes adv7180_write() which in turn requires the state mutex to be held, take it before calling adv7180_set_power() to avoid tripping a lockdep_assert_held().
--- drivers/media/i2c/adv7180.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/i2c/adv7180.c +6 -0
@@ -804,6 +804,8 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,if (format->which ==V4L2_SUBDEV_FORMAT_ACTIVE ) {if (state->field != format->format.field) { +guard (mutex)(&state->mutex); + state->field = format->format.field;adv7180_set_power (state, false);adv7180_set_field_mode (state);
@@ -1568,6 +1570,8 @@ static int adv7180_suspend(struct device *dev)struct v4l2_subdev *sd =dev_get_drvdata (dev);struct adv7180_state *state =to_state (sd); +guard (mutex)(&state->mutex); +return adv7180_set_power (state, false); }
@@ -1581,6 +1585,8 @@ static int adv7180_resume(struct device *dev)if (ret <0 )return ret; +guard (mutex)(&state->mutex); + ret =adv7180_set_power (state, state->powered);if (ret)return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 188/529 media: adv7180: Do not write format to device in set_fmt
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit 46c1e7814d1c3310ef23c01ed1a582ef0c8ab1d2 ]
The .set_fmt callback should not write the new format directly do the device, it should only store it and have it applied by .s_stream.
The .s_stream callback already calls adv7180_set_field_mode() so it's safe to remove programming of the device and just store the format and have .s_stream apply it.
--- drivers/media/i2c/adv7180.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/media/i2c/adv7180.c +1 -8
@@ -803,14 +803,7 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd, ret =adv7180_mbus_fmt (sd, &format->format);if (format->which ==V4L2_SUBDEV_FORMAT_ACTIVE ) { -if (state->field != format->format.field) { -guard (mutex)(&state->mutex); - - state->field = format->format.field; -adv7180_set_power (state, false); -adv7180_set_field_mode (state); -adv7180_set_power (state, true); - } + state->field = format->format.field; }else { framefmt =v4l2_subdev_get_try_format (sd, sd_state,0 ); *framefmt = format->format;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 189/529 media: adv7180: Only validate format in querystd
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit 91c5d7c849273d14bc4bae1b92666bdb5409294a ]
The .querystd callback should not program the device with the detected standard, it should only report the standard to user-space. User-space may then use .s_std to set the standard, if it wants to use it.
All that is required of .querystd is to setup the auto detection of standards and report its findings.
While at it add some documentation on why this can't happen while streaming and improve the error handling using a scoped guard.
--- drivers/media/i2c/adv7180.c | 37 ++++++++++++++++--------------------- 1 file changed, 16 insertions(+), 21 deletions(-)
drivers/media/i2c/adv7180.c +16 -21
@@ -356,32 +356,27 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)static int adv7180_querystd (struct v4l2_subdev *sd,v4l2_std_id *std) {struct adv7180_state *state =to_state (sd); -int err =mutex_lock_interruptible (&state->mutex); -if (err) -return err; - -if (state->streaming) { - err = -EBUSY ; - goto unlock; - } +int ret; - err =adv7180_set_video_standard (state, -ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM ); -if (err) - goto unlock; +guard (mutex)(&state->mutex); -msleep (100 ); -__adv7180_status (state,NULL , std); +/* +* We can't sample the standard if the device is streaming as that would +* interfere with the capture session as the VID_SEL reg is touched. +*/ +if (state->streaming) +return -EBUSY ; - err =v4l2_std_to_adv7180 (state->curr_norm); -if (err <0 ) - goto unlock; +/* Set the standard to autodetect PAL B/G/H/I/D, NTSC J or SECAM */ + ret =adv7180_set_video_standard (state, +ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM ); +if (ret) +return ret; - err =adv7180_set_video_standard (state, err); +/* Allow some time for the autodetection to run. */ +msleep (100 ); -unlock: -mutex_unlock (&state->mutex); -return err; +return __adv7180_status (state,NULL , std); } static int adv7180_s_routing(struct v4l2_subdev *sd, u32 input,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 190/529 media: verisilicon: Explicitly disable selection api ioctls for decoders
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Kocialkowski <[email protected]>
[ Upstream commit 73d50aa92f28ee8414fbfde011974fce970b82cc ]
Call the dedicated v4l2_disable_ioctl helper instead of manually checking whether the current context is an encoder for the selection api ioctls.
--- drivers/media/platform/verisilicon/hantro_drv.c | 2 ++ drivers/media/platform/verisilicon/hantro_v4l2.c | 6 ++---- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/media/platform/verisilicon/hantro_drv.c +2 -0
@@ -910,6 +910,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid) vpu->decoder = func;v4l2_disable_ioctl (vfd,VIDIOC_TRY_ENCODER_CMD );v4l2_disable_ioctl (vfd,VIDIOC_ENCODER_CMD ); +v4l2_disable_ioctl (vfd,VIDIOC_G_SELECTION ); +v4l2_disable_ioctl (vfd,VIDIOC_S_SELECTION ); }video_set_drvdata (vfd, vpu);
drivers/media/platform/verisilicon/hantro_v4l2.c +2 -4
@@ -655,8 +655,7 @@ static int vidioc_g_selection(struct file *file, void *priv,struct hantro_ctx *ctx =fh_to_ctx (priv);/* Crop only supported on source. */ -if (!ctx->is_encoder || - sel->type !=V4L2_BUF_TYPE_VIDEO_OUTPUT ) +if (sel->type !=V4L2_BUF_TYPE_VIDEO_OUTPUT )return -EINVAL ;switch (sel->target) {
@@ -688,8 +687,7 @@ static int vidioc_s_selection(struct file *file, void *priv,struct vb2_queue *vq;/* Crop only supported on source. */ -if (!ctx->is_encoder || - sel->type !=V4L2_BUF_TYPE_VIDEO_OUTPUT ) +if (sel->type !=V4L2_BUF_TYPE_VIDEO_OUTPUT )return -EINVAL ;/* Change not allowed if the queue is streaming. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 191/529 ALSA: usb-audio: apply quirk for MOONDROP Quark2
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cryolitia PukNgae <[email protected]>
[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
It reports a MIN value -15360 for volume control, but will mute when setting it less than -14208
--- sound/usb/mixer.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/usb/mixer.c +7 -0
@@ -1191,6 +1191,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, cval->res =1 ; }break ; +case USB_ID (0x3302 ,0x12db ):/* MOONDROP Quark2 */ +if (!strcmp (kctl->id.name,"PCM Playback Volume" )) { +usb_audio_info (chip, +"set volume quirk for MOONDROP Quark2\n" ); + cval->min =-14208 ;/* Mute under it */ + } +break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 192/529 net: call cond_resched() less often in __release_sock()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
While stress testing TCP I had unexpected retransmits and sack packets when a single cpu receives data from multiple high-throughput flows.
super_netperf 4 -H srv -T,10 -l 3000 &
Tcpdump extract:
00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
After analysis, it appears this is because of the cond_resched() call from __release_sock().
When current thread is yielding, while still holding the TCP socket lock, it might regain the cpu after a very long time.
Other peer TLP/RTO is firing (multiple times) and packets are retransmit, while the initial copy is waiting in the socket backlog or receive queue.
In this patch, I call cond_resched() only once every 16 packets.
Modern TCP stack now spends less time per packet in the backlog, especially because ACK are no longer sent (commit 133c4c0d3717 "tcp: defer regular ACK while processing socket backlog")
Before:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK" TcpOutSegs 19046186 0.0 TcpRetransSegs 1471 0.0 TcpExtTCPTimeouts 1397 0.0 TcpExtTCPLossProbes 1356 0.0 TcpExtTCPDSACKRecv 1352 0.0 TcpExtTCPSpuriousRTOs 114 0.0 TcpExtTCPDSACKRecvSegs 1352 0.0
After:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK" TcpOutSegs 19218936 0.0
--- net/core/sock.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/core/sock.c +8 -4
@@ -2996,23 +2996,27 @@ void __release_sock(struct sock *sk) __acquires(&sk->sk_lock.slock) {struct sk_buff *skb, *next; +int nb =0 ;while ((skb = sk->sk_backlog.head) !=NULL ) { sk->sk_backlog.head = sk->sk_backlog.tail =NULL ;spin_unlock_bh (&sk->sk_lock.slock); -do { +while (1 ) { next = skb->next;prefetch (next);DEBUG_NET_WARN_ON_ONCE (skb_dst_is_noref (skb));skb_mark_not_on_list (skb);sk_backlog_rcv (sk, skb); -cond_resched (); - skb = next; - }while (skb !=NULL ); +if (!skb) +break ; + +if (!(++nb &15 )) +cond_resched (); + }spin_lock_bh (&sk->sk_lock.slock); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 193/529 smsc911x: add second read of EEPROM mac when possible corruption seen
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Foster <[email protected]>
[ Upstream commit 69777753a8919b0b8313c856e707e1d1fe5ced85 ]
When the EEPROM MAC is read by way of ADDRH, it can return all 0s the first time. Subsequent reads succeed.
This is fully reproduceable on the Phytec PCM049 SOM.
Re-read the ADDRH when this behaviour is observed, in an attempt to correctly apply the EEPROM MAC address.
--- drivers/net/ethernet/smsc/smsc911x.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/ethernet/smsc/smsc911x.c +12 -2
@@ -2162,10 +2162,20 @@ static const struct net_device_ops smsc911x_netdev_ops = {static void smsc911x_read_mac_address (struct net_device *dev) {struct smsc911x_data *pdata =netdev_priv (dev); -u32 mac_high16 =smsc911x_mac_read (pdata,ADDRH ); -u32 mac_low32 =smsc911x_mac_read (pdata,ADDRL ); +u32 mac_high16, mac_low32;u8 addr[ETH_ALEN ]; + mac_high16 =smsc911x_mac_read (pdata,ADDRH ); + mac_low32 =smsc911x_mac_read (pdata,ADDRL ); + +/* The first mac_read in some setups can incorrectly read 0. Re-read it +* to get the full MAC if this is observed. +*/ +if (mac_high16 ==0 ) { +SMSC_TRACE (pdata, probe,"Re-read MAC ADDRH\n" ); + mac_high16 =smsc911x_mac_read (pdata,ADDRH ); + } + addr[0 ] = (u8)(mac_low32); addr[1 ] = (u8)(mac_low32 >>8 ); addr[2 ] = (u8)(mac_low32 >>16 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 194/529 iommu/amd: Skip enabling command/event buffers for kdump
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <[email protected]>
[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
After a panic if SNP is enabled in the previous kernel then the kdump kernel boots with IOMMU SNP enforcement still enabled.
IOMMU command buffers and event buffer registers remain locked and exclusive to the previous kernel. Attempts to enable command and event buffers in the kdump kernel will fail, as hardware ignores writes to the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
Skip enabling command buffers and event buffers for kdump boot as they are already enabled in the previous kernel.
--- drivers/iommu/amd/init.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-)
drivers/iommu/amd/init.c +19 -9
@@ -840,11 +840,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)BUG_ON (iommu->cmd_buf ==NULL ); - entry =iommu_virt_to_phys (iommu->cmd_buf); - entry |=MMIO_CMD_SIZE_512 ; - -memcpy_toio (iommu->mmio_base +MMIO_CMD_BUF_OFFSET , - &entry,sizeof (entry)); +if (!is_kdump_kernel ()) { +/* +* Command buffer is re-used for kdump kernel and setting +* of MMIO register is not required. +*/ + entry =iommu_virt_to_phys (iommu->cmd_buf); + entry |=MMIO_CMD_SIZE_512 ; +memcpy_toio (iommu->mmio_base +MMIO_CMD_BUF_OFFSET , + &entry,sizeof (entry)); + }amd_iommu_reset_cmd_buffer (iommu); }
@@ -893,10 +898,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)BUG_ON (iommu->evt_buf ==NULL ); - entry =iommu_virt_to_phys (iommu->evt_buf) |EVT_LEN_MASK ; - -memcpy_toio (iommu->mmio_base +MMIO_EVT_BUF_OFFSET , - &entry,sizeof (entry)); +if (!is_kdump_kernel ()) { +/* +* Event buffer is re-used for kdump kernel and setting +* of MMIO register is not required. +*/ + entry =iommu_virt_to_phys (iommu->evt_buf) |EVT_LEN_MASK ; +memcpy_toio (iommu->mmio_base +MMIO_EVT_BUF_OFFSET , + &entry,sizeof (entry)); + }/* set head and tail to zero manually */ writel (0x00 , iommu->mmio_base +MMIO_EVT_HEAD_OFFSET );
Signature · 1 line
2.51.0
Re: [PATCH 6.6 194/529] iommu/amd: Skip enabling command/event buffers for kdump
Quoted 1 line · On Fri, 21 Nov 2025 14:08:13 +0100, [email protected] wrote:
6.6-stable review patch. If anyone has any objections, please let me know.
The remaining 3 prerequisite patches in [1] should probably also be integrated, otherwise it may cause the capture kernel to fail to run properly:
[ 8.336262][ T0] AMD-Vi: Completion-Wait loop timed out [ 8.457132][ T0] AMD-Vi: Completion-Wait loop timed out [ 8.578015][ T0] AMD-Vi: Completion-Wait loop timed out [ 8.601978][ T0] Kernel panic - not syncing: timer doesn't work through Interrupt-remapped IO-APIC [ 8.612329][ T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.6.119-s #1 [ 8.620057][ T0] Hardware name: Tencent AC222/TC2-SLMB-A, BIOS 1.17.00 08/26/2025 [ 8.628759][ T0] Call Trace: [ 8.632297][ T0] <TASK> [ 8.635445][ T0] dump_stack_lvl+0x32/0x50 [ 8.640354][ T0] panic+0x156/0x310 [ 8.644579][ T0] panic_if_irq_remap+0x19/0x20 [ 8.649875][ T0] setup_IO_APIC+0x7cb/0x8e0 [ 8.654878][ T0] ? _raw_spin_unlock_irqrestore+0xb/0x20 [ 8.661146][ T0] ? ioapic_read_entry+0x39/0x50 [ 8.666539][ T0] ? clear_IO_APIC_pin+0xbb/0x130 [ 8.672025][ T0] apic_intr_mode_init+0x62/0x110 [ 8.677511][ T0] x86_late_time_init+0x20/0x40 [ 8.682804][ T0] start_kernel+0x3e4/0x6d0 [ 8.687707][ T0] x86_64_start_reservations+0x14/0x30 [ 8.693679][ T0] x86_64_start_kernel+0x92/0xa0 [ 8.699057][ T0] secondary_startup_64_no_verify+0x18f/0x19b [ 8.705715][ T0] </TASK> [ 8.708966][ T0] Rebooting in 10 seconds..
[1] https://lore.kernel.org/all/[email protected]/
thanks,
Jinliang Zheng :)
Quoted 76 lines
------------------
From: Ashish Kalra <[email protected]>
[ Upstream commit
9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb]After a panic if SNP is enabled in the previous kernel then the kdump kernel boots with IOMMU SNP enforcement still enabled.
IOMMU command buffers and event buffer registers remain locked and exclusive to the previous kernel. Attempts to enable command and event buffers in the kdump kernel will fail, as hardware ignores writes to the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
Skip enabling command buffers and event buffers for kdump boot as they are already enabled in the previous kernel.
Reviewed-by Vasant Hegde <[email protected]>Tested-by Sairaj Kodilkar <[email protected]>Signed-off-by Ashish Kalra <[email protected]>Link https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com open hereSigned-off-by Joerg Roedel <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/iommu/amd/init.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-)drivers/iommu/amd/init.c +19
-9@@ -840,11 +840,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)BUG_ON (iommu->cmd_buf ==NULL ); - entry =iommu_virt_to_phys (iommu->cmd_buf); - entry |=MMIO_CMD_SIZE_512 ; - -memcpy_toio (iommu->mmio_base +MMIO_CMD_BUF_OFFSET , - &entry,sizeof (entry)); +if (!is_kdump_kernel ()) { +/* +* Command buffer is re-used for kdump kernel and setting +* of MMIO register is not required. +*/ + entry =iommu_virt_to_phys (iommu->cmd_buf); + entry |=MMIO_CMD_SIZE_512 ; +memcpy_toio (iommu->mmio_base +MMIO_CMD_BUF_OFFSET , + &entry,sizeof (entry)); + }amd_iommu_reset_cmd_buffer (iommu); }@@ -893,10 +898,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)BUG_ON (iommu->evt_buf ==NULL ); - entry =iommu_virt_to_phys (iommu->evt_buf) |EVT_LEN_MASK ; - -memcpy_toio (iommu->mmio_base +MMIO_EVT_BUF_OFFSET , - &entry,sizeof (entry)); +if (!is_kdump_kernel ()) { +/* +* Event buffer is re-used for kdump kernel and setting +* of MMIO register is not required. +*/ + entry =iommu_virt_to_phys (iommu->evt_buf) |EVT_LEN_MASK ; +memcpy_toio (iommu->mmio_base +MMIO_EVT_BUF_OFFSET , + &entry,sizeof (entry)); + }/* set head and tail to zero manually */ writel (0x00 , iommu->mmio_base +MMIO_EVT_HEAD_OFFSET );Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 195/529 iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hector Martin <[email protected]>
[ Upstream commit ecf6508923f87e4597228f70cc838af3d37f6662 ]
These registers exist and at least on the t602x variant the IRQ only clears when theses are cleared.
--- drivers/iommu/apple-dart.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/iommu/apple-dart.c +5 -0
@@ -121,6 +121,8 @@#define DART_T8110_ERROR_ADDR_LO 0x170#define DART_T8110_ERROR_ADDR_HI 0x174 +#define DART_T8110_ERROR_STREAMS 0x1c0 +#define DART_T8110_PROTECT 0x200#define DART_T8110_UNPROTECT 0x204#define DART_T8110_PROTECT_LOCK 0x208
@@ -1041,6 +1043,9 @@ static irqreturn_t apple_dart_t8110_irq(int irq, void *dev) error, stream_idx, error_code, fault_name, addr);writel (error, dart->regs +DART_T8110_ERROR ); +for (int i =0 ; i <BITS_TO_U32 (dart->num_streams); i++) +writel (U32_MAX , dart->regs +DART_T8110_ERROR_STREAMS +4 * i); +return IRQ_HANDLED ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 196/529 drm/amd: add more cyan skillfish PCI ids
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 1e18746381793bef7c715fc5ec5611a422a75c4c ]
Add additional PCI IDs to the cyan skillfish family.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +5 -0
@@ -1983,6 +1983,11 @@ static const struct pci_device_id pciidlist[] = { {0x1002, 0x7410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ALDEBARAN},/* CYAN_SKILLFISH */ + {0x1002, 0x13DB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, + {0x1002, 0x13F9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, + {0x1002, 0x13FA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, + {0x1002, 0x13FB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, + {0x1002, 0x13FC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, {0x1002, 0x13FE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU}, {0x1002, 0x143F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 197/529 drm/amdgpu: dont enable SMU on cyan skillfish
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 94bd7bf2c920998b4c756bc8a54fd3dbdf7e4360 ]
Cyan skillfish uses different SMU firmware.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +4 -1
@@ -1819,13 +1819,16 @@ static int amdgpu_discovery_set_smu_ip_blocks(struct amdgpu_device *adev)case IP_VERSION (11 ,0 ,5 ):case IP_VERSION (11 ,0 ,9 ):case IP_VERSION (11 ,0 ,7 ): -case IP_VERSION (11 ,0 ,8 ):case IP_VERSION (11 ,0 ,11 ):case IP_VERSION (11 ,0 ,12 ):case IP_VERSION (11 ,0 ,13 ):case IP_VERSION (11 ,5 ,0 ):amdgpu_device_ip_block_add (adev, &smu_v11_0_ip_block);break ; +case IP_VERSION (11 ,0 ,8 ): +if (adev->apu_flags &AMD_APU_IS_CYAN_SKILLFISH2 ) +amdgpu_device_ip_block_add (adev, &smu_v11_0_ip_block); +break ;case IP_VERSION (12 ,0 ,0 ):case IP_VERSION (12 ,0 ,1 ):amdgpu_device_ip_block_add (adev, &smu_v12_0_ip_block);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 198/529 drm/amdgpu: add support for cyan skillfish gpu_info
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit fa819e3a7c1ee994ce014cc5a991c7fd91bc00f1 ]
Some SOCs which are part of the cyan skillfish family rely on an explicit firmware for IP discovery. Add support for the gpu_info firmware.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +4 -0
@@ -93,6 +93,7 @@ MODULE_FIRMWARE("amdgpu/picasso_gpu_info.bin");MODULE_FIRMWARE ("amdgpu/raven2_gpu_info.bin" );MODULE_FIRMWARE ("amdgpu/arcturus_gpu_info.bin" );MODULE_FIRMWARE ("amdgpu/navi12_gpu_info.bin" ); +MODULE_FIRMWARE ("amdgpu/cyan_skillfish_gpu_info.bin" );#define AMDGPU_RESUME_MS 2000#define AMDGPU_MAX_RETRY_LIMIT 2
@@ -1939,6 +1940,9 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev)case CHIP_NAVI12 : chip_name ="navi12" ;break ; +case CHIP_CYAN_SKILLFISH : + chip_name ="cyan_skillfish" ; +break ; }snprintf (fw_name,sizeof (fw_name),"amdgpu/%s_gpu_info.bin" , chip_name);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 199/529 usb: gadget: f_hid: Fix zero length packet transfer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <[email protected]>
[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
Set the hid req->zero flag of ep0/in_ep to true by default, then the UDC drivers can transfer a zero length packet at the end if the hid transfer with size divisible to EPs max packet size according to the USB 2.0 spec.
--- drivers/usb/gadget/function/f_hid.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_hid.c +2 -2
@@ -494,7 +494,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer, } req->status =0 ; - req->zero =0 ; + req->zero =1 ; req->length = count; req->complete = f_hidg_req_complete; req->context = hidg;
@@ -765,7 +765,7 @@ static int hidg_setup(struct usb_function *f,return -EOPNOTSUPP ; respond: - req->zero =0 ; + req->zero =1 ; req->length = length; status =usb_ep_queue (cdev->gadget->ep0, req,GFP_ATOMIC );if (status <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 200/529 usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yufeng <[email protected]>
[ Upstream commit 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 ]
In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget structure (pdev->gadget) was freed before its endpoints.
The endpoints are linked via the ep_list in the gadget structure. Freeing the gadget first leaves dangling pointers in the endpoint list. When the endpoints are subsequently freed, this results in a use-after-free.
Fix:
By separating the usb_del_gadget_udc() operation into distinct "del" and "put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the final release of the gadget structure with usb_put_gadget().
A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure
only after freeing endpoints").
--- drivers/usb/cdns3/cdnsp-gadget.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/cdns3/cdnsp-gadget.c +6 -2
@@ -1975,7 +1975,10 @@ static int __cdnsp_gadget_init(struct cdns *cdns)return 0 ; del_gadget: -usb_del_gadget_udc (&pdev->gadget); +usb_del_gadget (&pdev->gadget); +cdnsp_gadget_free_endpoints (pdev); +usb_put_gadget (&pdev->gadget); + goto halt_pdev; free_endpoints:cdnsp_gadget_free_endpoints (pdev); halt_pdev:
@@ -1997,8 +2000,9 @@ static void cdnsp_gadget_exit(struct cdns *cdns)devm_free_irq (pdev->dev, cdns->dev_irq, pdev);pm_runtime_mark_last_busy (cdns->dev);pm_runtime_put_autosuspend (cdns->dev); -usb_del_gadget_udc (&pdev->gadget); +usb_del_gadget (&pdev->gadget);cdnsp_gadget_free_endpoints (pdev); +usb_put_gadget (&pdev->gadget);cdnsp_mem_cleanup (pdev);kfree (pdev); cdns->gadget_dev =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 201/529 drm/msm: make sure to not queue up recovery more than once
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antonino Maniscalco <[email protected]>
[ Upstream commit 10fb1b2fcaee5545a5e54db1ed4d7b15c2db50c8 ]
If two fault IRQs arrive in short succession recovery work will be queued up twice.
When recovery runs a second time it may end up killing an unrelated context.
Prevent this by masking off interrupts when triggering recovery.
Patchwork: https://patchwork.freedesktop.org/patch/670023/
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +3 -0
@@ -1702,6 +1702,9 @@ static void a6xx_fault_detect_irq(struct msm_gpu *gpu)/* Turn off the hangcheck timer to keep it from bothering us */ del_timer (&gpu->hangcheck_timer); +/* Turn off interrupts to avoid triggering recovery again */ +gpu_write (gpu,REG_A6XX_RBBM_INT_0_MASK ,0 ); +kthread_queue_work (gpu->worker, &gpu->recover_work); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 202/529 char: Use list_del_init() in misc_deregister() to reinitialize list pointer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xion Wang <[email protected]>
[ Upstream commit e28022873c0d051e980c4145f1965cab5504b498 ]
Currently, misc_deregister() uses list_del() to remove the device from the list. After list_del(), the list pointers are set to LIST_POISON1 and LIST_POISON2, which may help catch use-after-free bugs, but does not reset the list head.
If misc_deregister() is called more than once on the same device, list_empty() will not return true, and list_del() may be called again, leading to undefined behavior.
Replace list_del() with list_del_init() to reinitialize the list head after deletion. This makes the code more robust against double deregistration and allows safe usage of list_empty() on the miscdevice after deregistration.
[ Note, this seems to keep broken out-of-tree drivers from doing foolish
things. While this does not matter for any in-kernel drivers, external drivers could use a bit of help to show them they shouldn't be doing stuff like re-registering misc devices - gregkh ]
--- drivers/char/misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/misc.c +1 -1
@@ -299,7 +299,7 @@ void misc_deregister(struct miscdevice *misc)return ;mutex_lock (&misc_mtx); -list_del (&misc->list); +list_del_init (&misc->list);device_destroy (&misc_class,MKDEV (MISC_MAJOR , misc->minor));misc_minor_free (misc->minor);if (misc->minor >MISC_DYNAMIC_MINOR )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 203/529 media: ov08x40: Fix the horizontal flip control
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Yao <[email protected]>
[ Upstream commit c7df6f339af94689fdc433887f9fbb480bf8a4ed ]
The datasheet of ov08x40 doesn't match the hardware behavior. 0x3821[2] == 1 is the original state and 0 the horizontal flip enabled.
--- drivers/media/i2c/ov08x40.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/ov08x40.c +1 -1
@@ -2643,7 +2643,7 @@ static int ov08x40_set_ctrl_hflip(struct ov08x40 *ov08x, u32 ctrl_val)return ov08x40_write_reg (ov08x,OV08X40_REG_MIRROR ,OV08X40_REG_VALUE_08BIT , - ctrl_val ? val |BIT (2 ) : val & ~BIT (2 )); + ctrl_val ? val & ~BIT (2 ) : val |BIT (2 )); }static int ov08x40_set_ctrl_vflip (struct ov08x40 *ov08x,u32 ctrl_val)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 204/529 media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
[ Upstream commit bfbd5aa5347fbd11ade188b316b800bfb27d9e22 ]
The OmniVision OG01A1B image sensor is a monochrome sensor, it supports 8-bit and 10-bit RAW output formats only.
That said the planar greyscale Y8/Y10 media formats are more appropriate for the sensor instead of the originally and arbitrary selected SGRBG one, since there is no red, green or blue color components.
--- drivers/media/i2c/og01a1b.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/i2c/og01a1b.c +3 -3
@@ -676,7 +676,7 @@ static void og01a1b_update_pad_format(const struct og01a1b_mode *mode, { fmt->width = mode->width; fmt->height = mode->height; - fmt->code =MEDIA_BUS_FMT_SGRBG10_1X10 ; + fmt->code =MEDIA_BUS_FMT_Y10_1X10 ; fmt->field =V4L2_FIELD_NONE ; }
@@ -867,7 +867,7 @@ static int og01a1b_enum_mbus_code(struct v4l2_subdev *sd,if (code->index >0 )return -EINVAL ; - code->code =MEDIA_BUS_FMT_SGRBG10_1X10 ; + code->code =MEDIA_BUS_FMT_Y10_1X10 ;return 0 ; }
@@ -879,7 +879,7 @@ static int og01a1b_enum_frame_size(struct v4l2_subdev *sd,if (fse->index >=ARRAY_SIZE (supported_modes))return -EINVAL ; -if (fse->code !=MEDIA_BUS_FMT_SGRBG10_1X10 ) +if (fse->code !=MEDIA_BUS_FMT_Y10_1X10 )return -EINVAL ; fse->min_width = supported_modes[fse->index].width;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 205/529 scsi: ufs: host: mediatek: Enhance recovery on resume failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 15ef3f5aa822f32524cba1463422a2c9372443f0 ]
Improve the recovery process for failed resume operations. Log the device's power status and return 0 if both resume and recovery fail to prevent I/O hang.
--- drivers/ufs/host/ufs-mediatek.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/ufs/host/ufs-mediatek.c +14 -1
@@ -1444,8 +1444,21 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) }return 0 ; + fail: -return ufshcd_link_recovery (hba); +/* +* Check if the platform (parent) device has resumed, and ensure that +* power, clock, and MTCMOS are all turned on. +*/ + err =ufshcd_link_recovery (hba); +if (err) { +dev_err (hba->dev,"Device PM: req=%d, status:%d, err:%d\n" , + hba->dev->power.request, + hba->dev->power.runtime_status, + hba->dev->power.runtime_error); + } + +return 0 ;/* Cannot return a failure, otherwise, the I/O will hang. */ }static void ufs_mtk_dbg_register_dump (struct ufs_hba *hba)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 206/529 scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit faac32d4ece30609f1a0930ca0ae951cf6dc1786 ]
Improve the recovery process for hibernation exit failures. Trigger the error handler and break the suspend operation to ensure effective recovery from hibernation errors. Activate the error handling mechanism by ufshcd_force_error_recovery and scheduling the error handler work.
--- drivers/ufs/core/ufshcd.c | 3 ++- drivers/ufs/host/ufs-mediatek.c | 14 +++++++++++--- include/ufs/ufshcd.h | 1 + 3 files changed, 14 insertions(+), 4 deletions(-)
drivers/ufs/core/ufshcd.c +2 -1
@@ -6341,13 +6341,14 @@ void ufshcd_schedule_eh_work(struct ufs_hba *hba) } } -static void ufshcd_force_error_recovery (struct ufs_hba *hba) +void ufshcd_force_error_recovery (struct ufs_hba *hba) {spin_lock_irq (hba->host->host_lock); hba->force_reset = true;ufshcd_schedule_eh_work (hba);spin_unlock_irq (hba->host->host_lock); } +EXPORT_SYMBOL_GPL (ufshcd_force_error_recovery);static void ufshcd_clk_scaling_allow (struct ufs_hba *hba,bool allow) {
drivers/ufs/host/ufs-mediatek.c +11 -3
@@ -1363,7 +1363,7 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm) } } -static void ufs_mtk_auto_hibern8_disable (struct ufs_hba *hba) +static int ufs_mtk_auto_hibern8_disable (struct ufs_hba *hba) {int ret;
@@ -1374,8 +1374,16 @@ static void ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)ufs_mtk_wait_idle_state (hba,5 ); ret =ufs_mtk_wait_link_state (hba,VS_LINK_UP ,100 ); -if (ret) +if (ret) {dev_warn (hba->dev,"exit h8 state fail, ret=%d\n" , ret); + +ufshcd_force_error_recovery (hba); + +/* trigger error handler and break suspend */ + ret = -EBUSY ; + } + +return ret; } static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
@@ -1386,7 +1394,7 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,if (status ==PRE_CHANGE ) {if (ufshcd_is_auto_hibern8_supported (hba)) -ufs_mtk_auto_hibern8_disable (hba); +return ufs_mtk_auto_hibern8_disable (hba);return 0 ; }
include/ufs/ufshcd.h +1 -0
@@ -1425,5 +1425,6 @@ int __ufshcd_write_ee_control(struct ufs_hba *hba, u32 ee_ctrl_mask);int ufshcd_write_ee_control (struct ufs_hba *hba);int ufshcd_update_ee_control (struct ufs_hba *hba,u16 *mask,const u16 *other_mask,u16 set,u16 clr); +void ufshcd_force_error_recovery (struct ufs_hba *hba);#endif /* End of Header */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 207/529 net: phy: marvell: Fix 88e1510 downshift counter errata
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
The 88e1510 PHY has an erratum where the phy downshift counter is not cleared after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN cleared). This can cause the gigabit link to intermittently downshift to a lower speed.
Disabling and re-enabling the downshift feature clears the counter, allowing the PHY to retry gigabit link negotiation up to the programmed retry count times before downshifting. This behavior has been observed on copper links.
--- drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-)
drivers/net/phy/marvell.c +38 -1
@@ -1802,6 +1802,43 @@ static int marvell_resume(struct phy_device *phydev)return err; } +/* m88e1510_resume +* +* The 88e1510 PHY has an erratum where the phy downshift counter is not cleared +* after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN +* cleared). This can cause the link to intermittently downshift to a lower speed. +* +* Disabling and re-enabling the downshift feature clears the counter, allowing +* the PHY to retry gigabit link negotiation up to the programmed retry count +* before downshifting. This behavior has been observed on copper links. +*/ +static int m88e1510_resume (struct phy_device *phydev) +{ +int err; +u8 cnt =0 ; + + err =marvell_resume (phydev); +if (err <0 ) +return err; + +/* read downshift counter value */ + err =m88e1011_get_downshift (phydev, &cnt); +if (err <0 ) +return err; + +if (cnt) { +/* downshift disabled */ + err =m88e1011_set_downshift (phydev,0 ); +if (err <0 ) +return err; + +/* downshift enabled, with previous counter value */ + err =m88e1011_set_downshift (phydev, cnt); + } + +return err; +} +static int marvell_aneg_done (struct phy_device *phydev) {int retval =phy_read (phydev,MII_M1011_PHY_STATUS );
@@ -3506,7 +3543,7 @@ static struct phy_driver marvell_drivers[] = { .handle_interrupt = marvell_handle_interrupt, .get_wol = m88e1318_get_wol, .set_wol = m88e1318_set_wol, - .resume = marvell_resume, + .resume = m88e1510_resume, .suspend = marvell_suspend, .read_page = marvell_read_page, .write_page = marvell_write_page,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 208/529 scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit f5ca8d0c7a6388abd5d8023cc682e1543728cc73 ]
Disable auto-hibern8 during power mode transitions to prevent unintended entry into auto-hibern8. Restore the original auto-hibern8 timer value after completing the power mode change to maintain system stability and prevent potential issues during power state transitions.
--- drivers/ufs/host/ufs-mediatek.c | 53 +++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 23 deletions(-)
drivers/ufs/host/ufs-mediatek.c +30 -23
@@ -1131,19 +1131,49 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,return ret; } +static int ufs_mtk_auto_hibern8_disable (struct ufs_hba *hba) +{ +int ret; + +/* disable auto-hibern8 */ +ufshcd_writel (hba,0 ,REG_AUTO_HIBERNATE_IDLE_TIMER ); + +/* wait host return to idle state when auto-hibern8 off */ +ufs_mtk_wait_idle_state (hba,5 ); + + ret =ufs_mtk_wait_link_state (hba,VS_LINK_UP ,100 ); +if (ret) { +dev_warn (hba->dev,"exit h8 state fail, ret=%d\n" , ret); + +ufshcd_force_error_recovery (hba); + +/* trigger error handler and break suspend */ + ret = -EBUSY ; + } + +return ret; +} +static int ufs_mtk_pwr_change_notify (struct ufs_hba *hba,enum ufs_notify_change_status stage,struct ufs_pa_layer_attr *dev_max_params,struct ufs_pa_layer_attr *dev_req_params) {int ret =0 ; +static u32 reg;switch (stage) {case PRE_CHANGE : +if (ufshcd_is_auto_hibern8_supported (hba)) { + reg =ufshcd_readl (hba,REG_AUTO_HIBERNATE_IDLE_TIMER ); +ufs_mtk_auto_hibern8_disable (hba); + } ret =ufs_mtk_pre_pwr_change (hba, dev_max_params, dev_req_params);break ;case POST_CHANGE : +if (ufshcd_is_auto_hibern8_supported (hba)) +ufshcd_writel (hba, reg,REG_AUTO_HIBERNATE_IDLE_TIMER );break ;default : ret = -EINVAL ;
@@ -1363,29 +1393,6 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm) } } -static int ufs_mtk_auto_hibern8_disable (struct ufs_hba *hba) -{ -int ret; - -/* disable auto-hibern8 */ -ufshcd_writel (hba,0 ,REG_AUTO_HIBERNATE_IDLE_TIMER ); - -/* wait host return to idle state when auto-hibern8 off */ -ufs_mtk_wait_idle_state (hba,5 ); - - ret =ufs_mtk_wait_link_state (hba,VS_LINK_UP ,100 ); -if (ret) { -dev_warn (hba->dev,"exit h8 state fail, ret=%d\n" , ret); - -ufshcd_force_error_recovery (hba); - -/* trigger error handler and break suspend */ - ret = -EBUSY ; - } - -return ret; -} -static int ufs_mtk_suspend (struct ufs_hba *hba,enum ufs_pm_op pm_op,enum ufs_notify_change_status status) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 209/529 ntfs3: pretend $Extend records as regular files
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 4e8011ffec79717e5fdac43a7e79faf811a384b7 ]
Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
--- fs/ntfs3/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/inode.c +1 -0
@@ -464,6 +464,7 @@ static struct inode *ntfs_read_mft(struct inode *inode, fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) { /* Records in $Extend are not a files or general directories. */ inode->i_op = &ntfs_file_inode_operations; + mode = S_IFREG; } else { err = -EINVAL ; goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 210/529 wifi: mac80211: Fix HE capabilities element check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit ea928544f3215fdeac24d66bef85e10bb638b8c1 ]
The element data length check did not account for the extra octet used for the extension ID. Fix it.
--- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/mlme.c +1 -1
@@ -4507,7 +4507,7 @@ static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link, he_cap_elem =cfg80211_find_ext_elem (WLAN_EID_EXT_HE_CAPABILITY , ies->data, ies->len); -if (!he_cap_elem || he_cap_elem->datalen <sizeof (*he_cap)) +if (!he_cap_elem || he_cap_elem->datalen <sizeof (*he_cap) +1 )return chains;/* skip one byte ext_tag_id */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 211/529 phy: cadence: cdns-dphy: Enable lower resolutions in dphy
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harikrishna Shenoy <[email protected]>
[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
Enable support for data lane rates between 80-160 Mbps cdns dphy as mentioned in TRM [0] by setting the pll_opdiv field to 16. This change enables lower resolutions like 640x480 at 60Hz.
[0]: https://www.ti.com/lit/zip/spruil1
(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
--- drivers/phy/cadence/cdns-dphy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/phy/cadence/cdns-dphy.c +3 -1
@@ -145,7 +145,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, dlane_bps = opts->hs_clk_rate; -if (dlane_bps >2500000000UL || dlane_bps <160000000UL ) +if (dlane_bps >2500000000UL || dlane_bps <80000000UL )return -EINVAL ;else if (dlane_bps >=1250000000 ) cfg->pll_opdiv =1 ;
@@ -155,6 +155,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy, cfg->pll_opdiv =4 ; else if (dlane_bps >= 160000000) cfg->pll_opdiv = 8; + else if (dlane_bps >= 80000000) + cfg->pll_opdiv = 16; cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv * cfg->pll_ipdiv,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 212/529 phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Dege <[email protected]>
[ Upstream commit e4a8db93b5ec9bca1cc66b295544899e3afd5e86 ]
R-Car S4-8 datasheet Rev.1.20 describes some additional register settings at the end of the initialization.
--- drivers/phy/renesas/r8a779f0-ether-serdes.c | 28 +++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/phy/renesas/r8a779f0-ether-serdes.c +28 -0
@@ -49,6 +49,13 @@ static void r8a779f0_eth_serdes_write32(void __iomem *addr, u32 offs, u32 bank,iowrite32 (data, addr + offs); } +static u32 r8a779f0_eth_serdes_read32 (void __iomem *addr,u32 offs,u32 bank) +{ +iowrite32 (bank, addr +R8A779F0_ETH_SERDES_BANK_SELECT ); + +return ioread32 (addr + offs); +} +static int r8a779f0_eth_serdes_reg_wait (struct r8a779f0_eth_serdes_channel *channel,u32 offs,u32 bank,u32 mask,u32 expected)
@@ -261,6 +268,7 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel *channel) {int ret; +u32 val; ret =r8a779f0_eth_serdes_chan_setting (channel);if (ret)
@@ -274,6 +282,26 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channelr8a779f0_eth_serdes_write32 (channel->addr,0x03d0 ,0x380 ,0x0000 ); + val =r8a779f0_eth_serdes_read32 (channel->addr,0x00c0 ,0x180 ); +r8a779f0_eth_serdes_write32 (channel->addr,0x00c0 ,0x180 , val |BIT (8 )); + ret =r8a779f0_eth_serdes_reg_wait (channel,0x0100 ,0x180 ,BIT (0 ),1 ); +if (ret) +return ret; +r8a779f0_eth_serdes_write32 (channel->addr,0x00c0 ,0x180 , val & ~BIT (8 )); + ret =r8a779f0_eth_serdes_reg_wait (channel,0x0100 ,0x180 ,BIT (0 ),0 ); +if (ret) +return ret; + + val =r8a779f0_eth_serdes_read32 (channel->addr,0x0144 ,0x180 ); +r8a779f0_eth_serdes_write32 (channel->addr,0x0144 ,0x180 , val |BIT (4 )); + ret =r8a779f0_eth_serdes_reg_wait (channel,0x0180 ,0x180 ,BIT (0 ),1 ); +if (ret) +return ret; +r8a779f0_eth_serdes_write32 (channel->addr,0x0144 ,0x180 , val & ~BIT (4 )); + ret =r8a779f0_eth_serdes_reg_wait (channel,0x0180 ,0x180 ,BIT (0 ),0 ); +if (ret) +return ret; +return r8a779f0_eth_serdes_monitor_linkup (channel); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 213/529 phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Riesch <[email protected]>
[ Upstream commit 8c7c19466c854fa86b82d2148eaa9bf0e6531423 ]
The driver for the Rockchip MIPI CSI-2 DPHY uses GRF register offset value 0 to sort out undefined registers. However, the RK3588 CSIDPHY GRF this offset is perfectly fine (in fact, register 0 is the only one in this register file).
Introduce a boolean variable to indicate valid registers and allow writes to register 0.
--- drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-csidphy.c +3 -2
@@ -87,10 +87,11 @@ struct dphy_reg {u32 offset;u32 mask;u32 shift; +u8 valid; };#define PHY_REG (_offset, _width, _shift) \ - { .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, } + { .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, .valid = 1, }static const struct dphy_reg rk1808_grf_dphy_regs[] = { [GRF_DPHY_CSIPHY_FORCERXMODE ] =PHY_REG (RK1808_GRF_PD_VI_CON_OFFSET ,4 ,0 ),
@@ -145,7 +146,7 @@ static inline void write_grf_reg(struct rockchip_inno_csidphy *priv,const struct dphy_drv_data *drv_data = priv->drv_data;const struct dphy_reg *reg = &drv_data->grf_regs[index]; -if (reg->offset) +if (reg->valid)regmap_write (priv->grf, reg->offset,HIWORD_UPDATE (value, reg->mask, reg->shift)); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 214/529 net: sh_eth: Disable WoL if system can not suspend
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <[email protected]>
[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
The MAC can't facilitate WoL if the system can't go to sleep. Gate the WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
--- drivers/net/ethernet/renesas/sh_eth.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/renesas/sh_eth.c +4 -0
@@ -2360,6 +2360,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,return 0 ; } +#ifdef CONFIG_PM_SLEEP static void sh_eth_get_wol (struct net_device *ndev,struct ethtool_wolinfo *wol) {struct sh_eth_private *mdp =netdev_priv (ndev);
@@ -2386,6 +2387,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)return 0 ; } +#endif static const struct ethtool_ops sh_eth_ethtool_ops = { .get_regs_len = sh_eth_get_regs_len,
@@ -2401,8 +2403,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = { .set_ringparam = sh_eth_set_ringparam, .get_link_ksettings = phy_ethtool_get_link_ksettings, .set_link_ksettings = phy_ethtool_set_link_ksettings, +#ifdef CONFIG_PM_SLEEP .get_wol = sh_eth_get_wol, .set_wol = sh_eth_set_wol, +#endif };/* network device open function */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 215/529 selftests: net: replace sleeps in fcnal-test with waits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 15c068cb214d74a2faca9293b25f454242d0d65e ]
fcnal-test.sh already includes lib.sh, use relevant helpers instead of sleeping. Replace sleep after starting nettest as a server with wait_local_port_listen.
--- tools/testing/selftests/net/fcnal-test.sh | 428 +++++++++++----------- 1 file changed, 214 insertions(+), 214 deletions(-)
tools/testing/selftests/net/fcnal-test.sh +214 -214
@@ -865,7 +865,7 @@ ipv4_tcp_md5_novrf() # basic use case log_start run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: Single address config"
@@ -873,7 +873,7 @@ ipv4_tcp_md5_novrf() log_start show_hint "Should timeout due to MD5 mismatch" run_cmd nettest -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: Server no config, client uses password"
@@ -881,7 +881,7 @@ ipv4_tcp_md5_novrf() log_start show_hint "Should timeout since client uses wrong password" run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: Client uses wrong password"
@@ -889,7 +889,7 @@ ipv4_tcp_md5_novrf() log_start show_hint "Should timeout due to MD5 mismatch" run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: Client address does not match address configured with password"
@@ -900,7 +900,7 @@ ipv4_tcp_md5_novrf() # client in prefix log_start run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: Prefix config"
@@ -908,7 +908,7 @@ ipv4_tcp_md5_novrf() log_start show_hint "Should timeout since client uses wrong password" run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: Prefix config, client uses wrong password"
@@ -916,7 +916,7 @@ ipv4_tcp_md5_novrf() log_start show_hint "Should timeout due to MD5 mismatch" run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: Prefix config, client address not in configured prefix" }
@@ -933,7 +933,7 @@ ipv4_tcp_md5() # basic use case log_start run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Single address config"
@@ -941,7 +941,7 @@ ipv4_tcp_md5() log_start show_hint "Should timeout since server does not have MD5 auth" run_cmd nettest -s -I ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Server no config, client uses password"
@@ -949,7 +949,7 @@ ipv4_tcp_md5() log_start show_hint "Should timeout since client uses wrong password" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: VRF: Client uses wrong password"
@@ -957,7 +957,7 @@ ipv4_tcp_md5() log_start show_hint "Should timeout since server config differs from client" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
@@ -968,7 +968,7 @@ ipv4_tcp_md5() # client in prefix log_start run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Prefix config"
@@ -976,7 +976,7 @@ ipv4_tcp_md5() log_start show_hint "Should timeout since client uses wrong password" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
@@ -984,7 +984,7 @@ ipv4_tcp_md5() log_start show_hint "Should timeout since client address is outside of prefix" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
@@ -995,14 +995,14 @@ ipv4_tcp_md5() log_start run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF" log_start run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
@@ -1010,7 +1010,7 @@ ipv4_tcp_md5() show_hint "Should timeout since client in default VRF uses VRF password" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
@@ -1018,21 +1018,21 @@ ipv4_tcp_md5() show_hint "Should timeout since client in VRF uses default VRF password" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} & run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw" log_start run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF" log_start run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
@@ -1040,7 +1040,7 @@ ipv4_tcp_md5() show_hint "Should timeout since client in default VRF uses VRF password" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
@@ -1048,7 +1048,7 @@ ipv4_tcp_md5() show_hint "Should timeout since client in VRF uses default VRF password" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} & run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
@@ -1072,14 +1072,14 @@ test_ipv4_md5_vrf__vrf_server__no_bind_ifindex() log_start show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection" log_start show_hint "Binding both the socket and the key is not required but it works" run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection" }
@@ -1093,25 +1093,25 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0() log_start run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection" log_start run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection" log_start run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection" log_start run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"
@@ -1183,7 +1183,7 @@ ipv4_tcp_novrf() do log_start run_cmd nettest -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 0 "Global server" done
@@ -1191,7 +1191,7 @@ ipv4_tcp_novrf() a=${NSA_IP} log_start run_cmd nettest -s -I ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 0 "Device server"
@@ -1211,13 +1211,13 @@ ipv4_tcp_novrf() do log_start run_cmd_nsb nettest -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -r ${a} -0 ${NSA_IP} log_test_addr ${a} $? 0 "Client" log_start run_cmd_nsb nettest -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 0 "Client, device bind"
@@ -1239,7 +1239,7 @@ ipv4_tcp_novrf() do log_start run_cmd nettest -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -0 ${a} -1 ${a} log_test_addr ${a} $? 0 "Global server, local connection" done
@@ -1247,7 +1247,7 @@ ipv4_tcp_novrf() a=${NSA_IP} log_start run_cmd nettest -s -I ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -0 ${a} log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
@@ -1256,7 +1256,7 @@ ipv4_tcp_novrf() log_start show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" run_cmd nettest -s -I ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} log_test_addr ${a} $? 1 "Device server, unbound client, local connection" done
@@ -1264,7 +1264,7 @@ ipv4_tcp_novrf() a=${NSA_IP} log_start run_cmd nettest -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV} log_test_addr ${a} $? 0 "Global server, device client, local connection"
@@ -1273,7 +1273,7 @@ ipv4_tcp_novrf() log_start show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" run_cmd nettest -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 1 "Global server, device client, local connection" done
@@ -1281,7 +1281,7 @@ ipv4_tcp_novrf() a=${NSA_IP} log_start run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -d ${NSA_DEV} -r ${a} -0 ${a} log_test_addr ${a} $? 0 "Device server, device client, local connection"
@@ -1313,19 +1313,19 @@ ipv4_tcp_vrf() log_start show_hint "Should fail 'Connection refused' since global server with VRF is disabled" run_cmd nettest -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 1 "Global server" log_start run_cmd nettest -s -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 0 "VRF server" log_start run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 0 "Device server"
@@ -1342,7 +1342,7 @@ ipv4_tcp_vrf() log_start show_hint "Should fail 'Connection refused' since global server with VRF is disabled" run_cmd nettest -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 1 "Global server, local connection"
@@ -1364,14 +1364,14 @@ ipv4_tcp_vrf() log_start show_hint "client socket should be bound to VRF" run_cmd nettest -s -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 0 "Global server" log_start show_hint "client socket should be bound to VRF" run_cmd nettest -s -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 0 "VRF server"
@@ -1386,7 +1386,7 @@ ipv4_tcp_vrf() log_start show_hint "client socket should be bound to device" run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 0 "Device server"
@@ -1396,7 +1396,7 @@ ipv4_tcp_vrf() log_start show_hint "Should fail 'Connection refused' since client is not bound to VRF" run_cmd nettest -s -I ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} log_test_addr ${a} $? 1 "Global server, local connection" done
@@ -1408,13 +1408,13 @@ ipv4_tcp_vrf() do log_start run_cmd_nsb nettest -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -r ${a} -d ${VRF} log_test_addr ${a} $? 0 "Client, VRF bind" log_start run_cmd_nsb nettest -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 0 "Client, device bind"
@@ -1433,7 +1433,7 @@ ipv4_tcp_vrf() do log_start run_cmd nettest -s -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -d ${VRF} -0 ${a} log_test_addr ${a} $? 0 "VRF server, VRF client, local connection" done
@@ -1441,26 +1441,26 @@ ipv4_tcp_vrf() a=${NSA_IP} log_start run_cmd nettest -s -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a} log_test_addr ${a} $? 0 "VRF server, device client, local connection" log_start show_hint "Should fail 'No route to host' since client is out of VRF scope" run_cmd nettest -s -I ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} log_test_addr ${a} $? 1 "VRF server, unbound client, local connection" log_start run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -d ${VRF} -0 ${a} log_test_addr ${a} $? 0 "Device server, VRF client, local connection" log_start run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a} log_test_addr ${a} $? 0 "Device server, device client, local connection" }
@@ -1499,7 +1499,7 @@ ipv4_udp_novrf() do log_start run_cmd nettest -D -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -D -r ${a} log_test_addr ${a} $? 0 "Global server"
@@ -1512,7 +1512,7 @@ ipv4_udp_novrf() a=${NSA_IP} log_start run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -D -r ${a} log_test_addr ${a} $? 0 "Device server"
@@ -1523,31 +1523,31 @@ ipv4_udp_novrf() do log_start run_cmd_nsb nettest -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -D -r ${a} -0 ${NSA_IP} log_test_addr ${a} $? 0 "Client" log_start run_cmd_nsb nettest -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP} log_test_addr ${a} $? 0 "Client, device bind" log_start run_cmd_nsb nettest -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP} log_test_addr ${a} $? 0 "Client, device send via cmsg" log_start run_cmd_nsb nettest -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF" log_start run_cmd_nsb nettest -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()"
@@ -1570,7 +1570,7 @@ ipv4_udp_novrf() do log_start run_cmd nettest -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -r ${a} -0 ${a} -1 ${a} log_test_addr ${a} $? 0 "Global server, local connection" done
@@ -1578,7 +1578,7 @@ ipv4_udp_novrf() a=${NSA_IP} log_start run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -r ${a} log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
@@ -1587,7 +1587,7 @@ ipv4_udp_novrf() log_start show_hint "Should fail 'Connection refused' since address is out of device scope" run_cmd nettest -s -D -I ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -r ${a} log_test_addr ${a} $? 1 "Device server, unbound client, local connection" done
@@ -1595,25 +1595,25 @@ ipv4_udp_novrf() a=${NSA_IP} log_start run_cmd nettest -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "Global server, device client, local connection" log_start run_cmd nettest -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -C -r ${a} log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection" log_start run_cmd nettest -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection" log_start run_cmd nettest -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
@@ -1626,28 +1626,28 @@ ipv4_udp_novrf() log_start show_hint "Should fail since addresses on loopback are out of device scope" run_cmd nettest -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 2 "Global server, device client, local connection" log_start show_hint "Should fail since addresses on loopback are out of device scope" run_cmd nettest -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection" log_start show_hint "Should fail since addresses on loopback are out of device scope" run_cmd nettest -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection" log_start show_hint "Should fail since addresses on loopback are out of device scope" run_cmd nettest -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
@@ -1657,7 +1657,7 @@ ipv4_udp_novrf() a=${NSA_IP} log_start run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a} log_test_addr ${a} $? 0 "Device server, device client, local conn"
@@ -1699,19 +1699,19 @@ ipv4_udp_vrf() log_start show_hint "Fails because ingress is in a VRF and global server is disabled" run_cmd nettest -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -D -r ${a} log_test_addr ${a} $? 1 "Global server" log_start run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -D -r ${a} log_test_addr ${a} $? 0 "VRF server" log_start run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -D -r ${a} log_test_addr ${a} $? 0 "Enslaved device server"
@@ -1723,7 +1723,7 @@ ipv4_udp_vrf() log_start show_hint "Should fail 'Connection refused' since global server is out of scope" run_cmd nettest -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${VRF} -r ${a} log_test_addr ${a} $? 1 "Global server, VRF client, local connection" done
@@ -1731,26 +1731,26 @@ ipv4_udp_vrf() a=${NSA_IP} log_start run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" log_start run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection" a=${NSA_IP} log_start run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" log_start run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
@@ -1765,19 +1765,19 @@ ipv4_udp_vrf() do log_start run_cmd nettest -D -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -D -r ${a} log_test_addr ${a} $? 0 "Global server" log_start run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -D -r ${a} log_test_addr ${a} $? 0 "VRF server" log_start run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -D -r ${a} log_test_addr ${a} $? 0 "Enslaved device server"
@@ -1792,13 +1792,13 @@ ipv4_udp_vrf() # log_start run_cmd_nsb nettest -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP} log_test $? 0 "VRF client" log_start run_cmd_nsb nettest -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP} log_test $? 0 "Enslaved device client"
@@ -1819,31 +1819,31 @@ ipv4_udp_vrf() a=${NSA_IP} log_start run_cmd nettest -D -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "Global server, VRF client, local conn" log_start run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" log_start run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "VRF server, device client, local conn" log_start run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" log_start run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
@@ -1851,7 +1851,7 @@ ipv4_udp_vrf() do log_start run_cmd nettest -D -s -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "Global server, VRF client, local conn" done
@@ -1860,7 +1860,7 @@ ipv4_udp_vrf() do log_start run_cmd nettest -s -D -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" done
@@ -2083,7 +2083,7 @@ ipv4_rt() do log_start run_cmd nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest ${varg} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -2097,7 +2097,7 @@ ipv4_rt() do log_start run_cmd nettest ${varg} -s -I ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest ${varg} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -2110,7 +2110,7 @@ ipv4_rt() a=${NSA_IP} log_start run_cmd nettest ${varg} -s -I ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest ${varg} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -2124,7 +2124,7 @@ ipv4_rt() # log_start run_cmd_nsb nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} & sleep 3 run_cmd ip link del ${VRF}
@@ -2135,7 +2135,7 @@ ipv4_rt() log_start run_cmd_nsb nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} & sleep 3 run_cmd ip link del ${VRF}
@@ -2151,7 +2151,7 @@ ipv4_rt() do log_start run_cmd nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${VRF} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -2165,7 +2165,7 @@ ipv4_rt() do log_start run_cmd nettest ${varg} -I ${VRF} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${VRF} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -2179,7 +2179,7 @@ ipv4_rt() log_start run_cmd nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -2190,7 +2190,7 @@ ipv4_rt() log_start run_cmd nettest ${varg} -I ${VRF} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -2201,7 +2201,7 @@ ipv4_rt() log_start run_cmd nettest ${varg} -I ${NSA_DEV} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -2551,7 +2551,7 @@ ipv6_tcp_md5_novrf() # basic use case log_start run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 0 "MD5: Single address config"
@@ -2559,7 +2559,7 @@ ipv6_tcp_md5_novrf() log_start show_hint "Should timeout due to MD5 mismatch" run_cmd nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 2 "MD5: Server no config, client uses password"
@@ -2567,7 +2567,7 @@ ipv6_tcp_md5_novrf() log_start show_hint "Should timeout since client uses wrong password" run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: Client uses wrong password"
@@ -2575,7 +2575,7 @@ ipv6_tcp_md5_novrf() log_start show_hint "Should timeout due to MD5 mismatch" run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 2 "MD5: Client address does not match address configured with password"
@@ -2586,7 +2586,7 @@ ipv6_tcp_md5_novrf() # client in prefix log_start run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 0 "MD5: Prefix config"
@@ -2594,7 +2594,7 @@ ipv6_tcp_md5_novrf() log_start show_hint "Should timeout since client uses wrong password" run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: Prefix config, client uses wrong password"
@@ -2602,7 +2602,7 @@ ipv6_tcp_md5_novrf() log_start show_hint "Should timeout due to MD5 mismatch" run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW} log_test $? 2 "MD5: Prefix config, client address not in configured prefix" }
@@ -2619,7 +2619,7 @@ ipv6_tcp_md5() # basic use case log_start run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Single address config"
@@ -2627,7 +2627,7 @@ ipv6_tcp_md5() log_start show_hint "Should timeout since server does not have MD5 auth" run_cmd nettest -6 -s -I ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Server no config, client uses password"
@@ -2635,7 +2635,7 @@ ipv6_tcp_md5() log_start show_hint "Should timeout since client uses wrong password" run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: VRF: Client uses wrong password"
@@ -2643,7 +2643,7 @@ ipv6_tcp_md5() log_start show_hint "Should timeout since server config differs from client" run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
@@ -2654,7 +2654,7 @@ ipv6_tcp_md5() # client in prefix log_start run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Prefix config"
@@ -2662,7 +2662,7 @@ ipv6_tcp_md5() log_start show_hint "Should timeout since client uses wrong password" run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
@@ -2670,7 +2670,7 @@ ipv6_tcp_md5() log_start show_hint "Should timeout since client address is outside of prefix" run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
@@ -2681,14 +2681,14 @@ ipv6_tcp_md5() log_start run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF" log_start run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
@@ -2696,7 +2696,7 @@ ipv6_tcp_md5() show_hint "Should timeout since client in default VRF uses VRF password" run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
@@ -2704,21 +2704,21 @@ ipv6_tcp_md5() show_hint "Should timeout since client in VRF uses default VRF password" run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} & run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw" log_start run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF" log_start run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
@@ -2726,7 +2726,7 @@ ipv6_tcp_md5() show_hint "Should timeout since client in default VRF uses VRF password" run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW} log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
@@ -2734,7 +2734,7 @@ ipv6_tcp_md5() show_hint "Should timeout since client in VRF uses default VRF password" run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} & run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW} log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
@@ -2762,7 +2762,7 @@ ipv6_tcp_novrf() do log_start run_cmd nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "Global server" done
@@ -2783,7 +2783,7 @@ ipv6_tcp_novrf() do log_start run_cmd_nsb nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -6 -r ${a} log_test_addr ${a} $? 0 "Client" done
@@ -2792,7 +2792,7 @@ ipv6_tcp_novrf() do log_start run_cmd_nsb nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -6 -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 0 "Client, device bind" done
@@ -2812,7 +2812,7 @@ ipv6_tcp_novrf() do log_start run_cmd nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} log_test_addr ${a} $? 0 "Global server, local connection" done
@@ -2820,7 +2820,7 @@ ipv6_tcp_novrf() a=${NSA_IP6} log_start run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} -0 ${a} log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
@@ -2829,7 +2829,7 @@ ipv6_tcp_novrf() log_start show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" run_cmd nettest -6 -s -I ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} log_test_addr ${a} $? 1 "Device server, unbound client, local connection" done
@@ -2837,7 +2837,7 @@ ipv6_tcp_novrf() a=${NSA_IP6} log_start run_cmd nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} log_test_addr ${a} $? 0 "Global server, device client, local connection"
@@ -2846,7 +2846,7 @@ ipv6_tcp_novrf() log_start show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope" run_cmd nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 1 "Global server, device client, local connection" done
@@ -2855,7 +2855,7 @@ ipv6_tcp_novrf() do log_start run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "Device server, device client, local conn" done
@@ -2888,7 +2888,7 @@ ipv6_tcp_vrf() log_start show_hint "Should fail 'Connection refused' since global server with VRF is disabled" run_cmd nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 1 "Global server" done
@@ -2897,7 +2897,7 @@ ipv6_tcp_vrf() do log_start run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "VRF server" done
@@ -2906,7 +2906,7 @@ ipv6_tcp_vrf() a=${NSA_LINKIP6}%${NSB_DEV} log_start run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "VRF server"
@@ -2914,7 +2914,7 @@ ipv6_tcp_vrf() do log_start run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "Device server" done
@@ -2933,7 +2933,7 @@ ipv6_tcp_vrf() log_start show_hint "Should fail 'Connection refused' since global server with VRF is disabled" run_cmd nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 1 "Global server, local connection"
@@ -2954,7 +2954,7 @@ ipv6_tcp_vrf() do log_start run_cmd nettest -6 -s -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "Global server" done
@@ -2963,7 +2963,7 @@ ipv6_tcp_vrf() do log_start run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "VRF server" done
@@ -2972,13 +2972,13 @@ ipv6_tcp_vrf() a=${NSA_LINKIP6}%${NSB_DEV} log_start run_cmd nettest -6 -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "Global server" log_start run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "VRF server"
@@ -2986,7 +2986,7 @@ ipv6_tcp_vrf() do log_start run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 0 "Device server" done
@@ -3006,7 +3006,7 @@ ipv6_tcp_vrf() log_start show_hint "Fails 'Connection refused' since client is not in VRF" run_cmd nettest -6 -s -I ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} log_test_addr ${a} $? 1 "Global server, local connection" done
@@ -3019,7 +3019,7 @@ ipv6_tcp_vrf() do log_start run_cmd_nsb nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -6 -r ${a} -d ${VRF} log_test_addr ${a} $? 0 "Client, VRF bind" done
@@ -3028,7 +3028,7 @@ ipv6_tcp_vrf() log_start show_hint "Fails since VRF device does not allow linklocal addresses" run_cmd_nsb nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -6 -r ${a} -d ${VRF} log_test_addr ${a} $? 1 "Client, VRF bind"
@@ -3036,7 +3036,7 @@ ipv6_tcp_vrf() do log_start run_cmd_nsb nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest -6 -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 0 "Client, device bind" done
@@ -3061,7 +3061,7 @@ ipv6_tcp_vrf() do log_start run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a} log_test_addr ${a} $? 0 "VRF server, VRF client, local connection" done
@@ -3069,7 +3069,7 @@ ipv6_tcp_vrf() a=${NSA_IP6} log_start run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} log_test_addr ${a} $? 0 "VRF server, device client, local connection"
@@ -3077,13 +3077,13 @@ ipv6_tcp_vrf() log_start show_hint "Should fail since unbound client is out of VRF scope" run_cmd nettest -6 -s -I ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} log_test_addr ${a} $? 1 "VRF server, unbound client, local connection" log_start run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a} log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
@@ -3091,7 +3091,7 @@ ipv6_tcp_vrf() do log_start run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a} log_test_addr ${a} $? 0 "Device server, device client, local connection" done
@@ -3131,13 +3131,13 @@ ipv6_udp_novrf() do log_start run_cmd nettest -6 -D -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "Global server" log_start run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "Device server" done
@@ -3145,7 +3145,7 @@ ipv6_udp_novrf() a=${NSA_LO_IP6} log_start run_cmd nettest -6 -D -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "Global server"
@@ -3155,7 +3155,7 @@ ipv6_udp_novrf() #log_start #show_hint "Should fail since loopback address is out of scope" #run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - #sleep 1 + wait_local_port_listen ${NSA} 12345 udp #run_cmd_nsb nettest -6 -D -r ${a} #log_test_addr ${a} $? 1 "Device server"
@@ -3175,25 +3175,25 @@ ipv6_udp_novrf() do log_start run_cmd_nsb nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6} log_test_addr ${a} $? 0 "Client" log_start run_cmd_nsb nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6} log_test_addr ${a} $? 0 "Client, device bind" log_start run_cmd_nsb nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6} log_test_addr ${a} $? 0 "Client, device send via cmsg" log_start run_cmd_nsb nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6} log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF"
@@ -3215,7 +3215,7 @@ ipv6_udp_novrf() do log_start run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a} log_test_addr ${a} $? 0 "Global server, local connection" done
@@ -3223,7 +3223,7 @@ ipv6_udp_novrf() a=${NSA_IP6} log_start run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
@@ -3232,7 +3232,7 @@ ipv6_udp_novrf() log_start show_hint "Should fail 'Connection refused' since address is out of device scope" run_cmd nettest -6 -s -D -I ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -r ${a} log_test_addr ${a} $? 1 "Device server, local connection" done
@@ -3240,19 +3240,19 @@ ipv6_udp_novrf() a=${NSA_IP6} log_start run_cmd nettest -6 -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "Global server, device client, local connection" log_start run_cmd nettest -6 -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a} log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection" log_start run_cmd nettest -6 -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a} log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection"
@@ -3261,28 +3261,28 @@ ipv6_udp_novrf() log_start show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} log_test_addr ${a} $? 1 "Global server, device client, local connection" log_start show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection" log_start show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection" log_start show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope" run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()" done
@@ -3290,7 +3290,7 @@ ipv6_udp_novrf() a=${NSA_IP6} log_start run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a} log_test_addr ${a} $? 0 "Device server, device client, local conn"
@@ -3304,7 +3304,7 @@ ipv6_udp_novrf() run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV} log_start run_cmd nettest -6 -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${NSA_IP6} log_test $? 0 "UDP in - LLA to GUA"
@@ -3328,7 +3328,7 @@ ipv6_udp_vrf() log_start show_hint "Should fail 'Connection refused' since global server is disabled" run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 1 "Global server" done
@@ -3337,7 +3337,7 @@ ipv6_udp_vrf() do log_start run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "VRF server" done
@@ -3346,7 +3346,7 @@ ipv6_udp_vrf() do log_start run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "Enslaved device server" done
@@ -3368,7 +3368,7 @@ ipv6_udp_vrf() log_start show_hint "Should fail 'Connection refused' since global server is disabled" run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${a} log_test_addr ${a} $? 1 "Global server, VRF client, local conn" done
@@ -3377,7 +3377,7 @@ ipv6_udp_vrf() do log_start run_cmd nettest -6 -D -I ${VRF} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "VRF server, VRF client, local conn" done
@@ -3386,25 +3386,25 @@ ipv6_udp_vrf() log_start show_hint "Should fail 'Connection refused' since global server is disabled" run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 1 "Global server, device client, local conn" log_start run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "VRF server, device client, local conn" log_start run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn" log_start run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
@@ -3419,7 +3419,7 @@ ipv6_udp_vrf() do log_start run_cmd nettest -6 -D -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "Global server" done
@@ -3428,7 +3428,7 @@ ipv6_udp_vrf() do log_start run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "VRF server" done
@@ -3437,7 +3437,7 @@ ipv6_udp_vrf() do log_start run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${a} log_test_addr ${a} $? 0 "Enslaved device server" done
@@ -3455,7 +3455,7 @@ ipv6_udp_vrf() # log_start run_cmd_nsb nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6} log_test $? 0 "VRF client"
@@ -3466,7 +3466,7 @@ ipv6_udp_vrf() log_start run_cmd_nsb nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6} log_test $? 0 "Enslaved device client"
@@ -3481,13 +3481,13 @@ ipv6_udp_vrf() a=${NSA_IP6} log_start run_cmd nettest -6 -D -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "Global server, VRF client, local conn" #log_start run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
@@ -3495,13 +3495,13 @@ ipv6_udp_vrf() a=${VRF_IP6} log_start run_cmd nettest -6 -D -s -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "Global server, VRF client, local conn" log_start run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
@@ -3517,25 +3517,25 @@ ipv6_udp_vrf() a=${NSA_IP6} log_start run_cmd nettest -6 -D -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "Global server, device client, local conn" log_start run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "VRF server, device client, local conn" log_start run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${VRF} -r ${a} log_test_addr ${a} $? 0 "Device server, VRF client, local conn" log_start run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 0 "Device server, device client, local conn"
@@ -3547,7 +3547,7 @@ ipv6_udp_vrf() # link local addresses log_start run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6} log_test $? 0 "Global server, linklocal IP"
@@ -3558,7 +3558,7 @@ ipv6_udp_vrf() log_start run_cmd_nsb nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6} log_test $? 0 "Enslaved device client, linklocal IP"
@@ -3569,7 +3569,7 @@ ipv6_udp_vrf() log_start run_cmd nettest -6 -D -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6} log_test $? 0 "Enslaved device client, local conn - linklocal IP"
@@ -3582,7 +3582,7 @@ ipv6_udp_vrf() run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV} log_start run_cmd nettest -6 -s -D & - sleep 1 + wait_local_port_listen ${NSA} 12345 udp run_cmd_nsb nettest -6 -D -r ${NSA_IP6} log_test $? 0 "UDP in - LLA to GUA"
@@ -3761,7 +3761,7 @@ ipv6_rt() do log_start run_cmd nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest ${varg} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -3775,7 +3775,7 @@ ipv6_rt() do log_start run_cmd nettest ${varg} -I ${VRF} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest ${varg} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -3789,7 +3789,7 @@ ipv6_rt() do log_start run_cmd nettest ${varg} -I ${NSA_DEV} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest ${varg} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -3804,7 +3804,7 @@ ipv6_rt() # log_start run_cmd_nsb nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} & sleep 3 run_cmd ip link del ${VRF}
@@ -3815,7 +3815,7 @@ ipv6_rt() log_start run_cmd_nsb nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSB} 12345 tcp run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} & sleep 3 run_cmd ip link del ${VRF}
@@ -3832,7 +3832,7 @@ ipv6_rt() do log_start run_cmd nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${VRF} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -3846,7 +3846,7 @@ ipv6_rt() do log_start run_cmd nettest ${varg} -I ${VRF} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${VRF} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -3859,7 +3859,7 @@ ipv6_rt() a=${NSA_IP6} log_start run_cmd nettest ${varg} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -3870,7 +3870,7 @@ ipv6_rt() log_start run_cmd nettest ${varg} -I ${VRF} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -3881,7 +3881,7 @@ ipv6_rt() log_start run_cmd nettest ${varg} -I ${NSA_DEV} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} & sleep 3 run_cmd ip link del ${VRF}
@@ -3940,7 +3940,7 @@ netfilter_tcp_reset() do log_start run_cmd nettest -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -r ${a} log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx" done
@@ -3958,7 +3958,7 @@ netfilter_icmp() do log_start run_cmd nettest ${arg} -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest ${arg} -r ${a} log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach" done
@@ -3997,7 +3997,7 @@ netfilter_tcp6_reset() do log_start run_cmd nettest -6 -s & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 -r ${a} log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx" done
@@ -4015,7 +4015,7 @@ netfilter_icmp6() do log_start run_cmd nettest -6 -s ${arg} & - sleep 1 + wait_local_port_listen ${NSA} 12345 tcp run_cmd_nsb nettest -6 ${arg} -r ${a} log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach" done
@@ -4211,12 +4211,12 @@ use_case_snat_on_vrf() run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF} run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} & - sleep 1 + wait_local_port_listen ${NSB} ${port} tcp run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port} log_test $? 0 "IPv4 TCP connection over VRF with SNAT" run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} & - sleep 1 + wait_local_port_listen ${NSB} ${port} tcp run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port} log_test $? 0 "IPv6 TCP connection over VRF with SNAT"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 216/529 media: redrat3: use int type to store negative error codes
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <[email protected]>
[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
Change "ret" from u8 to int type in redrat3_enable_detector() to store negative error codes or zero returned by redrat3_send_cmd() and usb_submit_urb() - this better aligns with the coding standards and maintains code consistency.
No effect on runtime.
--- drivers/media/rc/redrat3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/redrat3.c +1 -1
@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)static int redrat3_enable_detector (struct redrat3_dev *rr3) {struct device *dev = rr3->dev; -u8 ret; +int ret; ret =redrat3_send_cmd (RR3_RC_DET_ENABLE , rr3);if (ret !=0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 217/529 selftests: traceroute: Use require_command()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
Use require_command() so that the test will return SKIP (4) when a required command is not present.
Before:
# ./traceroute.sh SKIP: Could not run IPV6 test without traceroute6 SKIP: Could not run IPV4 test without traceroute $ echo $? 0
After:
# ./traceroute.sh TEST: traceroute6 not installed [SKIP] $ echo $? 4
--- tools/testing/selftests/net/traceroute.sh | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
tools/testing/selftests/net/traceroute.sh +3 -10
@@ -209,11 +209,6 @@ setup_traceroute6() run_traceroute6() { - if [ ! -x "$(command -v traceroute6)" ]; then - echo "SKIP: Could not run IPV6 test without traceroute6" - return - fi - setup_traceroute6 # traceroute6 host-2 from host-1 (expects 2000:102::2)
@@ -278,11 +273,6 @@ setup_traceroute() run_traceroute() { - if [ ! -x "$(command -v traceroute)" ]; then - echo "SKIP: Could not run IPV4 test without traceroute" - return - fi - setup_traceroute # traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
@@ -316,6 +306,9 @@ do esac done +require_command traceroute6 +require_command traceroute + run_tests printf "\nTests passed: %3d\n" ${nsuccess}
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 218/529 netfilter: nf_reject: dont reply to icmp error messages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit db99b2f2b3e2cd8227ac9990ca4a8a31a1e95e56 ]
tcp reject code won't reply to a tcp reset.
But the icmp reject 'netdev' family versions will reply to icmp dst-unreach errors, unlike icmp_send() and icmp6_send() which are used by the inet family implementation (and internally by the REJECT target).
Check for the icmp(6) type and do not respond if its an unreachable error.
Without this, something like 'ip protocol icmp reject', when used in a netdev chain attached to 'lo', cause a packet loop.
Same for two hosts that both use such a rule: each error packet will be replied to.
Such situation persist until the (bogus) rule is amended to ratelimit or checks the icmp type before the reject statement.
As the inet versions don't do this make the netdev ones follow along.
--- net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++++++++++++++++++++++++ net/ipv6/netfilter/nf_reject_ipv6.c | 30 +++++++++++++++++++++++++++++ 2 files changed, 55 insertions(+)
net/ipv4/netfilter/nf_reject_ipv4.c +25 -0
@@ -71,6 +71,27 @@ struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net, }EXPORT_SYMBOL_GPL (nf_reject_skb_v4_tcp_reset); +static bool nf_skb_is_icmp_unreach (const struct sk_buff *skb) +{ +const struct iphdr *iph =ip_hdr (skb); +u8 *tp, _type; +int thoff; + +if (iph->protocol !=IPPROTO_ICMP ) +return false; + + thoff =skb_network_offset (skb) +sizeof (*iph); + + tp =skb_header_pointer (skb, + thoff + offsetof(struct icmphdr , type), +sizeof (_type), &_type); + +if (!tp) +return false; + +return *tp ==ICMP_DEST_UNREACH ; +} + struct sk_buff *nf_reject_skb_v4_unreach(struct net *net, struct sk_buff *oldskb, const struct net_device *dev,
@@ -91,6 +112,10 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,if (ip_hdr (oldskb)->frag_off &htons (IP_OFFSET ))return NULL ; +/* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */ +if (nf_skb_is_icmp_unreach (oldskb)) +return NULL ; +/* RFC says return as much as we can without exceeding 576 bytes. */ len = min_t(unsigned int, 536, oldskb->len);
net/ipv6/netfilter/nf_reject_ipv6.c +30 -0
@@ -91,6 +91,32 @@ struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net, }EXPORT_SYMBOL_GPL (nf_reject_skb_v6_tcp_reset); +static bool nf_skb_is_icmp6_unreach (const struct sk_buff *skb) +{ +const struct ipv6hdr *ip6h =ipv6_hdr (skb); +u8 proto = ip6h->nexthdr; +u8 _type, *tp; +int thoff; +__be16 fo; + + thoff =ipv6_skip_exthdr (skb, ((u8 *)(ip6h +1 ) - skb->data), &proto, &fo); + +if (thoff <0 || thoff >= skb->len || fo !=0 ) +return false; + +if (proto !=IPPROTO_ICMPV6 ) +return false; + + tp =skb_header_pointer (skb, + thoff + offsetof(struct icmp6hdr , icmp6_type), +sizeof (_type), &_type); + +if (!tp) +return false; + +return *tp ==ICMPV6_DEST_UNREACH ; +} + struct sk_buff *nf_reject_skb_v6_unreach(struct net *net, struct sk_buff *oldskb, const struct net_device *dev,
@@ -104,6 +130,10 @@ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,if (!nf_reject_ip6hdr_validate (oldskb))return NULL ; +/* Don't reply to ICMPV6_DEST_UNREACH with ICMPV6_DEST_UNREACH */ +if (nf_skb_is_icmp6_unreach (oldskb)) +return NULL ; +/* Include "As much of invoking packet as possible without the ICMPv6 * packet exceeding the minimum IPv6 MTU" in the ICMP payload. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 219/529 x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <[email protected]>
[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated physical CPUs are available") states that when PV_DEDICATED=1 (vCPU has dedicated pCPU), qspinlock should be preferred regardless of PV_UNHALT. However, the current implementation doesn't reflect this: when PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
This is suboptimal because:
1. Native qspinlocks should outperform virt_spin_lock() for dedicated vCPUs irrespective of HALT exiting
2. virt_spin_lock() should only be preferred when vCPUs may be preempted (non-dedicated case)
So reorder the PV spinlock checks to:
1. First handle dedicated pCPU case (disable virt_spin_lock_key)
2. Second check single CPU, and nopvspin configuration
3. Only then check PV_UNHALT support
This ensures we always use native qspinlock for dedicated vCPUs, delivering pretty performance gains at high contention levels.
--- arch/x86/kernel/kvm.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/x86/kernel/kvm.c +10 -10
@@ -1066,16 +1066,6 @@ static void kvm_wait(u8 *ptr, u8 val)*/ void __init kvm_spinlock_init (void ) { -/* -* In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an -* advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is -* preferred over native qspinlock when vCPU is preempted. -*/ -if (!kvm_para_has_feature (KVM_FEATURE_PV_UNHALT )) { -pr_info ("PV spinlocks disabled, no host support\n" ); -return ; - } -/* * Disable PV spinlocks and use native qspinlock when dedicated pCPUs * are available.
@@ -1095,6 +1085,16 @@ void __init kvm_spinlock_init(void) goto out; } +/* +* In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an +* advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is +* preferred over native qspinlock when vCPU is preempted. +*/ +if (!kvm_para_has_feature (KVM_FEATURE_PV_UNHALT )) { +pr_info ("PV spinlocks disabled, no host support\n" ); +return ; + } +pr_info ("PV spinlocks enabled\n" );__pv_init_lock_hash ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 220/529 selftests: Disable dad for ipv6 in fcnal-test.sh
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
Constrained test environment; duplicate address detection is not needed and causes races so disable it.
--- tools/testing/selftests/net/fcnal-test.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/fcnal-test.sh +2 -0
@@ -423,6 +423,8 @@ create_ns() ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1 ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1 + ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0 + ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0 } # create veth pair to connect namespaces and apply addresses.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 221/529 eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <[email protected]>
[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range() and from there __pci_ioport_map() for the PCI IO space.
If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will always fail and the driver will complain it couldn't map the PIO space and return an error.
NO_IOPORT_MAP seems to cover the case where what 8139too is trying to do cannot ever work so make 8139TOO_PIO depend on being it false and avoid creating an unusable driver.
--- drivers/net/ethernet/realtek/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/realtek/Kconfig +1 -1
@@ -58,7 +58,7 @@ config 8139TOO config 8139TOO_PIO bool "Use PIO instead of MMIO" default y - depends on 8139TOO + depends on 8139TOO && !NO_IOPORT_MAP help This instructs the driver to use programmed I/O ports (PIO) instead of PCI shared memory (MMIO). This can possibly solve some problems
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 222/529 selftests: Replace sleep with slowwait
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <[email protected]>
[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
Replace the sleep in kill_procs with slowwait.
--- tools/testing/selftests/net/fcnal-test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/fcnal-test.sh +1 -1
@@ -194,7 +194,7 @@ show_hint() kill_procs() { killall nettest ping ping6 >/dev/null 2>&1 - sleep 1 + slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"' } do_run_cmd()
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 223/529 udp_tunnel: use netdev_warn() instead of netdev_WARN()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
netdev_WARN() uses WARN/WARN_ON to print a backtrace along with file and line information. In this case, udp_tunnel_nic_register() returning an error is just a failed operation, not a kernel bug.
udp_tunnel_nic_register() can fail due to a memory allocation failure (kzalloc() or udp_tunnel_nic_alloc()).
This is a normal runtime error and not a kernel bug.
Replace netdev_WARN() with netdev_warn() accordingly.
--- net/ipv4/udp_tunnel_nic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/udp_tunnel_nic.c +1 -1
@@ -899,7 +899,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused, err =udp_tunnel_nic_register (dev);if (err) -netdev_WARN (dev,"failed to register for UDP tunnel offloads: %d" , err); +netdev_warn (dev,"failed to register for UDP tunnel offloads: %d" , err);return notifier_from_errno (err); }/* All other events will need the udp_tunnel_nic state */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 224/529 HID: asus: add Z13 folio to generic group for multitouch to work
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit b595974b4afe0e171dd707da570964ff642742e3 ]
The Asus Z13 folio has a multitouch touchpad that needs to bind to the hid-multitouch driver in order to work properly. So bind it to the HID_GROUP_GENERIC group to release the touchpad and move it to the bottom so that the comment applies to it.
While at it, change the generic KEYBOARD3 name to Z13_FOLIO.
--- drivers/hid/hid-asus.c | 6 +++--- drivers/hid/hid-ids.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/hid/hid-asus.c +3 -3
@@ -1282,9 +1282,6 @@ static const struct hid_device_id asus_devices[] = { {HID_USB_DEVICE (USB_VENDOR_ID_ASUSTEK ,USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2 ), QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, - { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, -USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3 ), - QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR ), QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
@@ -1314,6 +1311,9 @@ static const struct hid_device_id asus_devices[] = {* Note bind to the HID_GROUP_GENERIC group, so that we only bind to the keyboard * part, while letting hid-multitouch.c handle the touchpad. */ + {HID_DEVICE (BUS_USB ,HID_GROUP_GENERIC , +USB_VENDOR_ID_ASUSTEK ,USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO ), + QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T101HA_KEYBOARD) }, { }
drivers/hid/hid-ids.h +1 -1
@@ -213,7 +213,7 @@#define USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD3 0x1822#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD 0x1866#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2 0x19b6 -#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3 0x1a30 +#define USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO 0x1a30#define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR 0x18c6#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY 0x1abe#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X 0x1b4c
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 225/529 watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sangwook Shin <[email protected]>
[ Upstream commit df3c6e0b6d83450563d6266e1dacc7eaf25511f4 ]
Fix the issue of max_timeout being calculated larger than actual value. The calculation result of freq / (S3C2410_WTCON_PRESCALE_MAX + 1) / S3C2410_WTCON_MAXDIV is smaller than the actual value because the remainder is discarded during the calculation process. This leads to a larger calculated value for max_timeout compared to the actual settable value. To resolve this issue, the order of calculations in the computation process has been adjusted.
--- drivers/watchdog/s3c2410_wdt.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/watchdog/s3c2410_wdt.c +8 -2
@@ -26,6 +26,7 @@#include <linux/mfd/syscon.h> #include <linux/regmap.h> #include <linux/delay.h> +#include <linux/math64.h> #define S3C2410_WTCON 0x00#define S3C2410_WTDAT 0x04
@@ -302,9 +303,14 @@ static inline unsigned long s3c2410wdt_get_freq(struct s3c2410_wdt *wdt)static inline unsigned int s3c2410wdt_max_timeout (struct s3c2410_wdt *wdt) {const unsigned long freq =s3c2410wdt_get_freq (wdt); +const u64 n_max = (u64)(S3C2410_WTCON_PRESCALE_MAX +1 ) * +S3C2410_WTCON_MAXDIV *S3C2410_WTCNT_MAXCNT ; +u64 t_max =div64_ul (n_max, freq); -return S3C2410_WTCNT_MAXCNT / (freq / (S3C2410_WTCON_PRESCALE_MAX +1 ) - /S3C2410_WTCON_MAXDIV ); +if (t_max >UINT_MAX ) + t_max =UINT_MAX ; + +return t_max; }static int s3c2410wdt_disable_wdt_reset (struct s3c2410_wdt *wdt,bool mask)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 226/529 crypto: sun8i-ce - remove channel timeout field
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 9a23ea1f7558bdd3f8d2b35b1c2e16a2f9bf671e ]
Using the number of bytes in the request as DMA timeout is really inconsistent, as large requests could possibly set a timeout of hundreds of seconds.
Remove the per-channel timeout field and use a single, static DMA timeout of 3 seconds for all requests.
--- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 5 ++--- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 2 -- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c | 1 - drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 2 +- 6 files changed, 3 insertions(+), 9 deletions(-)
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c +0 -1
@@ -264,7 +264,6 @@ static int sun8i_ce_cipher_prepare(struct crypto_engine *engine, void *async_req goto theend_sgs; } - chan->timeout = areq->cryptlen; rctx->nr_sgs = ns; rctx->nr_sgd = nd;return 0 ;
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c +2 -3
@@ -186,11 +186,10 @@ int sun8i_ce_run_task(struct sun8i_ce_dev *ce, int flow, const char *name)mutex_unlock (&ce->mlock);wait_for_completion_interruptible_timeout (&ce->chanlist[flow].complete, -msecs_to_jiffies (ce->chanlist[flow].timeout)); +msecs_to_jiffies (CE_DMA_TIMEOUT_MS ));if (ce->chanlist[flow].status ==0 ) { -dev_err (ce->dev,"DMA timeout for %s (tm=%d) on flow %d\n" , name, - ce->chanlist[flow].timeout, flow); +dev_err (ce->dev,"DMA timeout for %s on flow %d\n" , name, flow); err = -EFAULT ; }/* No need to lock for this read, the channel is locked so
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c +0 -2
@@ -457,8 +457,6 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)else cet->t_dlen =cpu_to_le32 (areq->nbytes /4 + j); - chan->timeout = areq->nbytes; - err =sun8i_ce_run_task (ce, flow,crypto_ahash_alg_name (tfm));dma_unmap_single (ce->dev, addr_pad, j *4 ,DMA_TO_DEVICE );
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c +0 -1
@@ -137,7 +137,6 @@ int sun8i_ce_prng_generate(struct crypto_rng *tfm, const u8 *src, cet->t_dst[0 ].addr =cpu_to_le32 (dma_dst); cet->t_dst[0 ].len =cpu_to_le32 (todo /4 ); - ce->chanlist[flow].timeout =2000 ; err =sun8i_ce_run_task (ce,3 ,"PRNG" );mutex_unlock (&ce->rnglock);
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c +0 -1
@@ -79,7 +79,6 @@ static int sun8i_ce_trng_read(struct hwrng *rng, void *data, size_t max, bool wa cet->t_dst[0 ].addr =cpu_to_le32 (dma_dst); cet->t_dst[0 ].len =cpu_to_le32 (todo /4 ); - ce->chanlist[flow].timeout = todo; err =sun8i_ce_run_task (ce,3 ,"TRNG" );mutex_unlock (&ce->rnglock);
drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h +1 -1
@@ -106,6 +106,7 @@#define MAX_SG 8#define CE_MAX_CLOCKS 4 +#define CE_DMA_TIMEOUT_MS 3000#define MAXFLOW 4
@@ -195,7 +196,6 @@ struct sun8i_ce_flow {struct completion complete;int status;dma_addr_t t_phy; -int timeout;struct ce_task *tl;void *backup_iv;void *bounce_iv;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 227/529 PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
[ Upstream commit 09fefb24ed5e15f3b112f6c04b21a90ea23eaf8b ]
dw_pcie_edma_irq_verify() is supposed to verify the eDMA IRQs in devicetree by fetching them using either 'dma' or 'dmaX' IRQ names. Former is used when the platform uses a single IRQ for all eDMA channels and latter is used when the platform uses separate IRQ per channel. But currently, dw_pcie_edma_irq_verify() bails out early if edma::nr_irqs is 1, i.e., when a single IRQ is used. This gives an impression that the driver could work with any single IRQ in devicetree, not necessarily with name 'dma'.
But dw_pcie_edma_irq_vector(), which actually requests the IRQ, does require the single IRQ to be named as 'dma'. So this creates inconsistency between dw_pcie_edma_irq_verify() and dw_pcie_edma_irq_vector().
Thus, to fix this inconsistency, make sure dw_pcie_edma_irq_verify() also verifies the single IRQ name by removing the bail out code.
--- drivers/pci/controller/dwc/pcie-designware.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/pci/controller/dwc/pcie-designware.c +1 -3
@@ -927,9 +927,7 @@ static int dw_pcie_edma_irq_verify(struct dw_pcie *pci)char name[6 ];int ret; -if (pci->edma.nr_irqs ==1 ) -return 0 ; -else if (pci->edma.nr_irqs >1 ) +if (pci->edma.nr_irqs >1 )return pci->edma.nr_irqs != ch_cnt ? -EINVAL :0 ; ret =platform_get_irq_byname_optional (pdev,"dma" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 228/529 crypto: caam - double the entropy delay interval for retry
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaurav Jain <[email protected]>
[ Upstream commit 9048beca9c5614d486e2b492c0a7867164bf56a8 ]
during entropy evaluation, if the generated samples fail any statistical test, then, all of the bits will be discarded, and a second set of samples will be generated and tested.
the entropy delay interval should be doubled before performing the retry.
also, ctrlpriv->rng4_sh_init and inst_handles both reads RNG DRNG status register, but only inst_handles is updated before every retry. so only check inst_handles and removing ctrlpriv->rng4_sh_init
--- drivers/crypto/caam/ctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/crypto/caam/ctrl.c +2 -2
@@ -692,12 +692,12 @@ static int caam_ctrl_rng_init(struct device *dev)*/ if (needs_entropy_delay_adjustment ()) ent_delay =12000 ; -if (!(ctrlpriv->rng4_sh_init || inst_handles)) { +if (!inst_handles) {dev_info (dev,"Entropy delay = %u\n" , ent_delay);kick_trng (dev, ent_delay); - ent_delay +=400 ; + ent_delay = ent_delay *2 ; }/* * if instantiate_rng(...) fails, the loop will rerun
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 229/529 net/cls_cgroup: Fix task_get_classid() during qdisc run
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
During recent testing with the netem qdisc to inject delays into TCP traffic, we observed that our CLS BPF program failed to function correctly due to incorrect classid retrieval from task_get_classid(). The issue manifests in the following call stack:
bpf_get_cgroup_classid+5
cls_bpf_classify+507
__tcf_classify+90
tcf_classify+217
__dev_queue_xmit+798
bond_dev_queue_xmit+43
__bond_start_xmit+211
bond_start_xmit+70
dev_hard_start_xmit+142
sch_direct_xmit+161
__qdisc_run+102 <<<<< Issue location
__dev_xmit_skb+1015
__dev_queue_xmit+637
neigh_hh_output+159
ip_finish_output2+461
__ip_finish_output+183
ip_finish_output+41
ip_output+120
ip_local_out+94
__ip_queue_xmit+394
ip_queue_xmit+21
__tcp_transmit_skb+2169
tcp_write_xmit+959
__tcp_push_pending_frames+55
tcp_push+264
tcp_sendmsg_locked+661
tcp_sendmsg+45
inet_sendmsg+67
sock_sendmsg+98
sock_write_iter+147
vfs_write+786
ksys_write+181
__x64_sys_write+25
do_syscall_64+56
entry_SYSCALL_64_after_hwframe+100The problem occurs when multiple tasks share a single qdisc. In such cases, __qdisc_run() may transmit skbs created by different tasks. Consequently, task_get_classid() retrieves an incorrect classid since it references the current task's context rather than the skb's originating task.
Given that dev_queue_xmit() always executes with bh disabled, we can use softirq_count() instead to obtain the correct classid.
The simple steps to reproduce this issue:
1. Add network delay to the network interface:
such as: tc qdisc add dev bond0 root netem delay 1.5ms
2. Build two distinct net_cls cgroups, each with a network-intensive task
3. Initiate parallel TCP streams from both tasks to external servers.
Under this specific condition, the issue reliably occurs. The kernel eventually dequeues an SKB that originated from Task-A while executing in the context of Task-B.
It is worth noting that it will change the established behavior for a slightly different scenario:
<sock S is created by task A>
<class ID for task A is changed>
<skb is created by sock S xmit and classified>
prior to this patch the skb will be classified with the 'new' task A classid, now with the old/original one. The bpf_get_cgroup_classid_curr() function is a more appropriate choice for this case.
--- include/net/cls_cgroup.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/cls_cgroup.h +1 -1
@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)* calls by looking at the number of nested bh disable calls because * softirqs always disables bh. */ -if (in_serving_softirq ()) { +if (softirq_count ()) {struct sock *sk =skb_to_full_sk (skb);/* If there is an sock_cgroup_classid we'll use that. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 230/529 wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quan Zhou <[email protected]>
[ Upstream commit 25ef5b5d02ac03fe8dd91cf25bd011a570fbeba2 ]
Enable 160MHz beamformee support on mt7922 by updating HE capability element configuration. Previously, only 160MHz channel width was set, but beamformee for 160MHz was not properly advertised. This patch adds BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4 capability to allow devices to utilize 160MHz BW for beamforming.
Tested by connecting to 160MHz-bandwidth beamforming AP and verified HE capability.
--- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7921/main.c +2 -0
@@ -135,6 +135,8 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band,if (is_mt7922 (phy->mt76->dev)) { he_cap_elem->phy_cap_info[0 ] |=IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G ; + he_cap_elem->phy_cap_info[4 ] |= +IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4 ; he_cap_elem->phy_cap_info[8 ] |=IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 231/529 wifi: mt76: mt7996: Temporarily disable EPCS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Lin <[email protected]>
[ Upstream commit e6291bb7a5935b2f1d337fd7a58eab7ada6678ad ]
EPCS is not yet ready, so do not claim to support it.
--- drivers/net/wireless/mediatek/mt76/mt7996/init.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/init.c +0 -1
@@ -730,7 +730,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band, eht_cap->has_eht = true; eht_cap_elem->mac_cap_info[0 ] = -IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |IEEE80211_EHT_MAC_CAP0_OM_CONTROL |u8_encode_bits (IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454 ,IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 232/529 ALSA: serial-generic: remove shared static buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <[email protected]>
[ Upstream commit 84973249011fda3ff292f83439a062fec81ef982 ]
If multiple instances of this driver are instantiated and try to send concurrently then the single static buffer snd_serial_generic_tx_work() will cause corruption in the data output.
Move the buffer into the per-instance driver data to avoid this.
--- sound/drivers/serial-generic.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
sound/drivers/serial-generic.c +7 -5
@@ -37,6 +37,8 @@ MODULE_LICENSE("GPL");#define SERIAL_TX_STATE_ACTIVE 1#define SERIAL_TX_STATE_WAKEUP 2 +#define INTERNAL_BUF_SIZE 256 +struct snd_serial_generic {struct serdev_device *serdev;
@@ -51,6 +53,7 @@ struct snd_serial_generic {struct work_struct tx_work;unsigned long tx_state; +char tx_buf[INTERNAL_BUF_SIZE ]; };static void snd_serial_generic_tx_wakeup (struct snd_serial_generic *drvdata)
@@ -61,11 +64,8 @@ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)schedule_work (&drvdata->tx_work); } -#define INTERNAL_BUF_SIZE 256 -static void snd_serial_generic_tx_work (struct work_struct *work) { -static char buf[INTERNAL_BUF_SIZE ];int num_bytes; struct snd_serial_generic *drvdata = container_of(work, struct snd_serial_generic, tx_work);
@@ -78,8 +78,10 @@ static void snd_serial_generic_tx_work(struct work_struct *work)if (!test_bit (SERIAL_MODE_OUTPUT_OPEN , &drvdata->filemode))break ; - num_bytes =snd_rawmidi_transmit_peek (substream, buf,INTERNAL_BUF_SIZE ); - num_bytes =serdev_device_write_buf (drvdata->serdev, buf, num_bytes); + num_bytes =snd_rawmidi_transmit_peek (substream, drvdata->tx_buf, +INTERNAL_BUF_SIZE ); + num_bytes =serdev_device_write_buf (drvdata->serdev, drvdata->tx_buf, + num_bytes);if (!num_bytes)break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 233/529 drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <[email protected]>
[ Upstream commit dea75df7afe14d6217576dbc28cc3ec1d1f712fb ]
Replace kmalloc_array() + copy_from_user() with memdup_array_user().
This shrinks the source code and improves separation between the kernel and userspace slabs.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +5 -14
@@ -1732,30 +1732,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data, {struct amdgpu_device *adev =drm_to_adev (dev);union drm_amdgpu_wait_fences *wait = data; -uint32_t fence_count = wait->in.fence_count; -struct drm_amdgpu_fence *fences_user;struct drm_amdgpu_fence *fences;int r;/* Get the fences from userspace */ - fences =kmalloc_array (fence_count,sizeof (struct drm_amdgpu_fence ), -GFP_KERNEL ); -if (fences ==NULL ) -return -ENOMEM ; - - fences_user =u64_to_user_ptr (wait->in.fences); -if (copy_from_user (fences, fences_user, -sizeof (struct drm_amdgpu_fence ) * fence_count)) { - r = -EFAULT ; - goto err_free_fences; - } + fences =memdup_array_user (u64_to_user_ptr (wait->in.fences), + wait->in.fence_count, +sizeof (struct drm_amdgpu_fence )); +if (IS_ERR (fences)) +return PTR_ERR (fences);if (wait->in.wait_all) r =amdgpu_cs_wait_all_fences (adev, filp, wait, fences);else r =amdgpu_cs_wait_any_fence (adev, filp, wait, fences); -err_free_fences:kfree (fences);return r;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 234/529 drm/amd: Avoid evicting resources at S5
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit 531df041f2a5296174abd8292d298eb62fe1ea97 ]
Normally resources are evicted on dGPUs at suspend or hibernate and on APUs at hibernate. These steps are unnecessary when using the S4 callbacks to put the system into S5.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +4 -0
@@ -4113,6 +4113,10 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev)if ((adev->in_s3 || adev->in_s0ix) && (adev->flags &AMD_IS_APU ))return 0 ; +/* No need to evict when going to S5 through S4 callbacks */ +if (system_state ==SYSTEM_POWER_OFF ) +return 0 ; + ret =amdgpu_ttm_evict_resources (adev,TTM_PL_VRAM );if (ret)DRM_WARN ("evicting device resources failed\n" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 235/529 drm/amd/display: Fix DVI-D/HDMI adapters
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 489f0f600ce2c0dae640df9035e1d82677d2580f ]
When the EDID has the HDMI bit, we should simply select the HDMI signal type even on DVI ports.
For reference see, the legacy amdgpu display code:amdgpu_atombios_encoder_get_encoder_mode
which selects ATOM_ENCODER_MODE_HDMI for the same case.
This commit fixes DVI connectors to work with DVI-D/HDMI adapters so that they can now produce output over these connectors for HDMI monitors with higher bandwidth modes. With this change, even HDMI audio works through DVI.
For testing, I used a CAA-DMDHFD3 DVI-D/HDMI adapter with the following GPUs:
Tahiti (DCE 6) - DC can now output 4K 30 Hz over DVI Polaris 10 (DCE 11.2) - DC can now output 4K 60 Hz over DVI
--- drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/display/dc/link/link_detection.c +4 -0
@@ -1113,6 +1113,10 @@ static bool detect_link_and_local_sink(struct dc_link *link,if (sink->sink_signal ==SIGNAL_TYPE_HDMI_TYPE_A && !sink->edid_caps.edid_hdmi) sink->sink_signal =SIGNAL_TYPE_DVI_SINGLE_LINK ; +else if (dc_is_dvi_signal (sink->sink_signal) && + aud_support->hdmi_audio_native && + sink->edid_caps.edid_hdmi) + sink->sink_signal =SIGNAL_TYPE_HDMI_TYPE_A ;if (link->local_sink &&dc_is_dp_signal (sink_caps.signal))dp_trace_init (link);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 236/529 drm/amd/display: Disable VRR on DCE 6
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 043c87d7d56e135393f8aab927148096e2d17589 ]
DCE 6 was not advertised as being able to support VRR, so let's mark it as unsupported for now.
The VRR implementation in amdgpu_dm depends on the VUPDATE interrupt which is not registered for DCE 6.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++- drivers/gpu/drm/amd/display/dc/dc_helper.c | 5 +++++ drivers/gpu/drm/amd/display/dc/dm_services.h | 2 ++ 3 files changed, 10 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +3 -1
@@ -9243,6 +9243,8 @@ static void get_freesync_config_for_crtc( }else { config.state =VRR_STATE_INACTIVE ; } + }else { + config.state =VRR_STATE_UNSUPPORTED ; } out: new_crtc_state->freesync_config = config;
@@ -10838,7 +10840,7 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector, dm_con_state =to_dm_connector_state (connector->state); -if (!adev->dm.freesync_module) +if (!adev->dm.freesync_module || !dc_supports_vrr (sink->ctx->dce_version)) goto update;/* Some eDP panels only have the refresh rate range info in DisplayID */
drivers/gpu/drm/amd/display/dc/dc_helper.c +5 -0
@@ -744,3 +744,8 @@ char *dce_version_to_string(const int version)return "Unknown" ; } } + +bool dc_supports_vrr (const enum dce_version v) +{ +return v >=DCE_VERSION_8_0 ; +}
drivers/gpu/drm/amd/display/dc/dm_services.h +2 -0
@@ -294,4 +294,6 @@ void dm_dtn_log_end(struct dc_context *ctx,char *dce_version_to_string (const int version); +bool dc_supports_vrr (const enum dce_version v); +#endif /* __DM_SERVICES_H__ */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 237/529 page_pool: always add GFP_NOWARN for ATOMIC allocations
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit f3b52167a0cb23b27414452fbc1278da2ee884fc ]
Driver authors often forget to add GFP_NOWARN for page allocation from the datapath. This is annoying to users as OOMs are a fact of life, and we pretty much expect network Rx to hit page allocation failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations by default.
--- net/core/page_pool.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/core/page_pool.c +6 -0
@@ -422,6 +422,12 @@ static struct page *__page_pool_alloc_pages_slow(struct page_pool *pool,struct page *page;int i, nr_pages; +/* Unconditionally set NOWARN if allocating from NAPI. +* Drivers forget to set it, and OOM reports on packet Rx are useless. +*/ +if ((gfp &GFP_ATOMIC ) ==GFP_ATOMIC ) + gfp |= __GFP_NOWARN; +/* Don't support bulk alloc for high-order pages */ if (unlikely (pp_order))return __page_pool_alloc_page_order (pool, gfp);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 238/529 ethernet: Extend device_get_mac_address() to use NVMEM
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit d2d3f529e7b6ff2aa432b16a2317126621c28058 ]
A lot of modern SoC have the ability to store MAC addresses in their NVMEM. So extend the generic function device_get_mac_address() to obtain the MAC address from an nvmem cell named 'mac-address' in case there is no firmware node which contains the MAC address directly.
--- net/ethernet/eth.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/ethernet/eth.c +4 -1
@@ -615,7 +615,10 @@ EXPORT_SYMBOL(fwnode_get_mac_address);*/ int device_get_mac_address (struct device *dev,char *addr) { -return fwnode_get_mac_address (dev_fwnode (dev), addr); +if (!fwnode_get_mac_address (dev_fwnode (dev), addr)) +return 0 ; + +return nvmem_get_mac_address (dev, addr); }EXPORT_SYMBOL (device_get_mac_address);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 239/529 HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit 7d62beb102d6fa9a4e5e874be7fbf47a62fcc4f6 ]
Dell systems utilize an EC-based touchpad emulation when the ACPI touchpad _DSM is not invoked. This emulation acts as a secondary master on the I2C bus, designed for scenarios where the I2C touchpad driver is absent, such as in BIOS menus. Typically, loading the i2c-hid module triggers the _DSM at initialization, disabling the EC-based emulation.
However, if the i2c-hid module is missing from the boot kernel used for hibernation snapshot restoration, the _DSM remains uncalled, resulting in dual masters on the I2C bus and subsequent arbitration errors. This issue arises when i2c-hid resides in the rootfs instead of the kernel or initramfs.
To address this, switch from using the SYSTEM_SLEEP_PM_OPS() macro to dedicated callbacks, introducing a specific callback for restoring the S4 image. This callback ensures the _DSM is invoked.
--- drivers/hid/i2c-hid/i2c-hid-acpi.c | 8 ++++++++ drivers/hid/i2c-hid/i2c-hid-core.c | 28 +++++++++++++++++++++++++++- drivers/hid/i2c-hid/i2c-hid.h | 2 ++ 3 files changed, 37 insertions(+), 1 deletion(-)
drivers/hid/i2c-hid/i2c-hid-acpi.c +8 -0
@@ -76,6 +76,13 @@ static int i2c_hid_acpi_get_descriptor(struct i2c_hid_acpi *ihid_acpi)return hid_descriptor_address; } +static void i2c_hid_acpi_restore_sequence (struct i2chid_ops *ops) +{ + struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops); + +i2c_hid_acpi_get_descriptor (ihid_acpi); +} +static void i2c_hid_acpi_shutdown_tail (struct i2chid_ops *ops) { struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops);
@@ -96,6 +103,7 @@ static int i2c_hid_acpi_probe(struct i2c_client *client) ihid_acpi->adev =ACPI_COMPANION (dev); ihid_acpi->ops.shutdown_tail = i2c_hid_acpi_shutdown_tail; + ihid_acpi->ops.restore_sequence = i2c_hid_acpi_restore_sequence; ret =i2c_hid_acpi_get_descriptor (ihid_acpi);if (ret <0 )
drivers/hid/i2c-hid/i2c-hid-core.c +27 -1
@@ -937,6 +937,14 @@ static void i2c_hid_core_shutdown_tail(struct i2c_hid *ihid) ihid->ops->shutdown_tail (ihid->ops); } +static void i2c_hid_core_restore_sequence (struct i2c_hid *ihid) +{ +if (!ihid->ops->restore_sequence) +return ; + + ihid->ops->restore_sequence (ihid->ops); +} +static int i2c_hid_core_suspend (struct i2c_hid *ihid,bool force_poweroff) {struct i2c_client *client = ihid->client;
@@ -1320,8 +1328,26 @@ static int i2c_hid_core_pm_resume(struct device *dev)return i2c_hid_core_resume (ihid); } +static int i2c_hid_core_pm_restore (struct device *dev) +{ +struct i2c_client *client =to_i2c_client (dev); +struct i2c_hid *ihid =i2c_get_clientdata (client); + +if (ihid->is_panel_follower) +return 0 ; + +i2c_hid_core_restore_sequence (ihid); + +return i2c_hid_core_resume (ihid); +} +const struct dev_pm_ops i2c_hid_core_pm = { -SYSTEM_SLEEP_PM_OPS (i2c_hid_core_pm_suspend, i2c_hid_core_pm_resume) + .suspend =pm_sleep_ptr (i2c_hid_core_pm_suspend), + .resume =pm_sleep_ptr (i2c_hid_core_pm_resume), + .freeze =pm_sleep_ptr (i2c_hid_core_pm_suspend), + .thaw =pm_sleep_ptr (i2c_hid_core_pm_resume), + .poweroff =pm_sleep_ptr (i2c_hid_core_pm_suspend), + .restore =pm_sleep_ptr (i2c_hid_core_pm_restore), };EXPORT_SYMBOL_GPL (i2c_hid_core_pm);
drivers/hid/i2c-hid/i2c-hid.h +2 -0
@@ -27,11 +27,13 @@ static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)* @power_up: do sequencing to power up the device. * @power_down: do sequencing to power down the device. * @shutdown_tail: called at the end of shutdown. +* @restore_sequence: hibernation restore sequence. */ struct i2chid_ops {int (*power_up)(struct i2chid_ops *ops);void (*power_down)(struct i2chid_ops *ops);void (*shutdown_tail)(struct i2chid_ops *ops); +void (*restore_sequence)(struct i2chid_ops *ops); }; int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 240/529 drm/amdgpu: reject gang submissions under SRIOV
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit d7ddcf921e7d0d8ebe82e89635bc9dc26ba9540d ]
Gang submission means that the kernel driver guarantees that multiple submissions are executed on the HW at the same time on different engines.
Background is that those submissions then depend on each other and each can't finish stand alone.
SRIOV now uses world switch to preempt submissions on the engines to allow sharing the HW resources between multiple VFs.
The problem is now that the SRIOV world switch can't know about such inter dependencies and will cause a timeout if it waits for a partially running gang submission.
To conclude SRIOV and gang submissions are fundamentally incompatible at the moment. For now just disable them.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +1 -1
@@ -286,7 +286,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, } } -if (!p->gang_size) { +if (!p->gang_size || (amdgpu_sriov_vf (p->adev) && p->gang_size >1 )) { ret = -EINVAL ; goto free_all_kdata; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 241/529 selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nai-Chen Cheng <[email protected]>
[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
The selftests 'make clean' does not clean the net/lib because it only processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves compiled objects in net/lib after cleaning, requiring manual cleanup.
Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib dependency is properly cleaned.
--- tools/testing/selftests/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/Makefile +1 -1
@@ -269,7 +269,7 @@ gen_tar: install @echo "Created ${TAR_PATH}" clean: - @for TARGET in $(TARGETS); do \ + @for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \ BUILD_TARGET=$$BUILD/$$TARGET; \ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\ done;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 242/529 scsi: ufs: core: Disable timestamp functionality if not supported
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit fb1f4568346153d2f80fdb4ffcfa0cf4fb257d3c ]
Some Kioxia UFS 4 devices do not support the qTimestamp attribute. Set the UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT for these devices such that no error messages appear in the kernel log about failures to set the qTimestamp attribute.
Message-ID: <[email protected]>
--- drivers/ufs/core/ufshcd.c | 6 +++++- include/ufs/ufs_quirks.h | 3 +++ 2 files changed, 8 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +5 -1
@@ -275,6 +275,9 @@ static const struct ufs_dev_quirk ufs_fixups[] = { { .wmanufacturerid = UFS_VENDOR_TOSHIBA, .model = "THGLF2G9D8KBADG", .quirk = UFS_DEVICE_QUIRK_PA_TACTIVATE }, + { .wmanufacturerid = UFS_VENDOR_TOSHIBA, + .model = "THGJFJT1E45BATP", + .quirk = UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT }, {} };
@@ -8731,7 +8734,8 @@ static void ufshcd_set_timestamp_attr(struct ufs_hba *hba)struct ufs_dev_info *dev_info = &hba->dev_info;struct utp_upiu_query_v4_0 *upiu_data; -if (dev_info->wspecversion <0x400 ) +if (dev_info->wspecversion <0x400 || + hba->dev_quirks &UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT )return ;ufshcd_hold (hba);
include/ufs/ufs_quirks.h +3 -0
@@ -113,4 +113,7 @@ struct ufs_dev_quirk {*/ #define UFS_DEVICE_QUIRK_PA_HIBER8TIME (1 << 12) +/* Some UFS 4 devices do not support the qTimestamp attribute */ +#define UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT (1 << 13) +#endif /* UFS_QUIRKS_H_ */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 243/529 scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
If lpfc_reset_flush_io_context fails to execute, then the wrong return status code may be passed back to upper layers when issuing a target reset TMF command. Fix by checking the return status from lpfc_reset_flush_io_context() first in order to properly return FAILED or FAST_IO_FAIL.
Message-ID: <[email protected]>
--- drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_scsi.c +10 -4
@@ -5920,7 +5920,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport)/** * lpfc_reset_flush_io_context - * @vport: The virtual port (scsi_host) for the flush context -* @tgt_id: If aborting by Target contect - specifies the target id +* @tgt_id: If aborting by Target context - specifies the target id * @lun_id: If aborting by Lun context - specifies the lun id * @context: specifies the context level to flush at. *
@@ -6094,8 +6094,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd) pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE ;spin_unlock_irqrestore (&pnode->lock, flags); } -lpfc_reset_flush_io_context (vport, tgt_id, lun_id, -LPFC_CTX_TGT ); + status =lpfc_reset_flush_io_context (vport, tgt_id, lun_id, +LPFC_CTX_TGT ); +if (status !=SUCCESS ) { +lpfc_printf_vlog (vport,KERN_ERR ,LOG_FCP , +"0726 Target Reset flush status x%x\n" , + status); +return status; + }return FAST_IO_FAIL ; }
@@ -6191,7 +6197,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)int rc, ret =SUCCESS ;lpfc_printf_vlog (vport,KERN_ERR ,LOG_FCP , -"3172 SCSI layer issued Host Reset Data:\n" ); +"3172 SCSI layer issued Host Reset\n" );lpfc_offline_prep (phba,LPFC_MBX_WAIT );lpfc_offline (phba);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 244/529 scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit a4809b98eb004fcbf7c4d45eb5a624d1c682bb73 ]
In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the F_Port_Ctrl ndlp object. In cases when an ABTS is issued, the outstanding kref is needed for when a second XRI_ABORTED CQE is received. The final kref for the ndlp is designed to be decremented in lpfc_sli4_els_xri_aborted instead. Also, add a new log message to allow for future diagnostics when debugging related issues.
Message-ID: <[email protected]>
--- drivers/scsi/lpfc/lpfc_els.c | 6 +++++- drivers/scsi/lpfc/lpfc_init.c | 7 ------- 2 files changed, 5 insertions(+), 8 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +5 -1
@@ -12094,7 +12094,11 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba, sglq_entry->state =SGL_FREED ;spin_unlock_irqrestore (&phba->sli4_hba.sgl_list_lock, iflag); - +lpfc_printf_log (phba,KERN_INFO ,LOG_ELS |LOG_SLI | +LOG_DISCOVERY |LOG_NODE , +"0732 ELS XRI ABORT on Node: ndlp=x%px " +"xri=x%x\n" , + ndlp, xri);if (ndlp) { lpfc_set_rrq_active(phba, ndlp, sglq_entry->sli4_lxritag,
drivers/scsi/lpfc/lpfc_init.c +0 -7
@@ -3047,13 +3047,6 @@ lpfc_cleanup(struct lpfc_vport *vport)lpfc_vmid_vport_cleanup (vport);list_for_each_entry_safe (ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) { -if (vport->port_type !=LPFC_PHYSICAL_PORT && - ndlp->nlp_DID == Fabric_DID) { -/* Just free up ndlp with Fabric_DID for vports */ -lpfc_nlp_put (ndlp); -continue ; - } -if (ndlp->nlp_DID == Fabric_Cntl_DID && ndlp->nlp_state ==NLP_STE_UNUSED_NODE ) {lpfc_nlp_put (ndlp);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 245/529 scsi: lpfc: Define size of debugfs entry for xri rebalancing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs entry is used. The debugfs file operations for xri rebalancing have been previously implemented, but lack definition for its information buffer size. Similar to other pre-existing debugfs entry buffers, define LPFC_HDWQINFO_SIZE as 8192 bytes.
Message-ID: <[email protected]>
--- drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/lpfc/lpfc_debugfs.h +3 -0
@@ -44,6 +44,9 @@/* hbqinfo output buffer size */ #define LPFC_HBQINFO_SIZE 8192 +/* hdwqinfo output buffer size */ +#define LPFC_HDWQINFO_SIZE 8192 +/* nvmestat output buffer size */ #define LPFC_NVMESTAT_SIZE 8192#define LPFC_IOKTIME_SIZE 8192
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 246/529 allow finish_no_open(file, ERR_PTR(-E...))
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
... allowing any ->lookup() return value to be passed to it.
--- fs/open.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/open.c +6 -4
@@ -1029,18 +1029,20 @@ EXPORT_SYMBOL(finish_open);* finish_no_open - finish ->atomic_open() without opening the file * * @file: file pointer -* @dentry: dentry or NULL (as returned from ->lookup()) +* @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup()) * -* This can be used to set the result of a successful lookup in ->atomic_open(). +* This can be used to set the result of a lookup in ->atomic_open(). * * NB: unlike finish_open() this function does consume the dentry reference and * the caller need not dput() it. * -* Returns "0" which must be the return value of ->atomic_open() after having -* called this function. +* Returns 0 or -E..., which must be the return value of ->atomic_open() after +* having called this function. */ int finish_no_open (struct file *file,struct dentry *dentry) { +if (IS_ERR (dentry)) +return PTR_ERR (dentry); file->f_path.dentry = dentry;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 247/529 usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Forest Crossman <[email protected]>
[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
The usbmon binary interface currently truncates captures of large transfers from higher-speed USB devices. Because a single event capture is limited to one-fifth of the total buffer size, the current maximum size of a captured URB is around 240 KiB. This is insufficient when capturing traffic from modern devices that use transfers of several hundred kilobytes or more, as truncated URBs can make it impossible for user-space USB analysis tools like Wireshark to properly defragment and reassemble higher-level protocol packets in the captured data.
The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has not been changed since the binary interface was introduced in 2006.
To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The original comment for BUFF_MAX based the limit's calculation on a saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2 Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the buffer should be at least 50 MB. The new limit of 64 MiB covers that, plus a little extra for any overhead.
With this change, both users and developers should now be able to debug and reverse engineer modern USB devices even when running unmodified distro kernels.
Please note that this change does not affect the default buffer size. A larger buffer is only allocated when a user explicitly requests it via the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size should not unduly increase memory usage for users that don't deliberately request a larger buffer.
--- drivers/usb/mon/mon_bin.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/usb/mon/mon_bin.c +8 -6
@@ -68,18 +68,20 @@* The magic limit was calculated so that it allows the monitoring * application to pick data once in two ticks. This way, another application, * which presumably drives the bus, gets to hog CPU, yet we collect our data. -* If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an -* enormous overhead built into the bus protocol, so we need about 1000 KB. +* +* Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For +* modern 20 Gbps buses, this value increases to over 50 MB. The maximum +* buffer size is set to 64 MiB to accommodate this. * * This is still too much for most cases, where we just snoop a few * descriptor fetches for enumeration. So, the default is a "reasonable" -* amount for systems with HZ=250 and incomplete bus saturation. +* amount for typical, low-throughput use cases. * * XXX What about multi-megabyte URBs which take minutes to transfer? */ -#define BUFF_MAX CHUNK_ALIGN(1200*1024) -#define BUFF_DFL CHUNK_ALIGN(300*1024) -#define BUFF_MIN CHUNK_ALIGN(8*1024) +#define BUFF_MAX CHUNK_ALIGN(64*1024*1024) +#define BUFF_DFL CHUNK_ALIGN(300*1024) +#define BUFF_MIN CHUNK_ALIGN(8*1024)/* * The per-event API header (2 per URB).
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 248/529 usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <[email protected]>
[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs, when in host mode, it is intended that the controller goes to suspend state to save power and wait for interrupts from connected peripheral to wake it up. This is particularly used in cases where a HID or Audio device is connected. In such scenarios, the usb controller can enter auto suspend and resume action after getting interrupts from the connected device.
--- drivers/usb/host/xhci-plat.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-plat.c +1 -0
@@ -168,6 +168,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const sreturn ret;pm_runtime_set_active (&pdev->dev); +pm_runtime_use_autosuspend (&pdev->dev);pm_runtime_enable (&pdev->dev);pm_runtime_get_noresume (&pdev->dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 249/529 f2fs: fix infinite loop in __insert_extent_tree()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangzijie <[email protected]>
[ Upstream commit 23361bd54966b437e1ed3eb1a704572f4b279e58 ]
When we get wrong extent info data, and look up extent_node in rb tree, it will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this by return NULL and print some kernel messages in that case.
--- fs/f2fs/extent_cache.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/f2fs/extent_cache.c +6 -0
@@ -562,7 +562,13 @@ static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi, p = &(*p)->rb_right; leftmost = false; }else { +f2fs_err_ratelimited (sbi,"%s: corrupted extent, type: %d, " +"extent node in rb tree [%u, %u, %u], age [%llu, %llu], " +"extent node to insert [%u, %u, %u], age [%llu, %llu]" , + __func__, et->type, en->ei.fofs, en->ei.blk, en->ei.len, en->ei.age, + en->ei.last_blocks, ei->fofs, ei->blk, ei->len, ei->age, ei->last_blocks);f2fs_bug_on (sbi,1 ); +return NULL ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 250/529 ipv6: np->rxpmtu race annotation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
Add READ_ONCE() annotations because np->rxpmtu can be changed while udpv6_recvmsg() and rawv6_recvmsg() read it.
Since this is a very rarely used feature, and that udpv6_recvmsg() and rawv6_recvmsg() read np->rxopt anyway, change the test order so that np->rxpmtu does not need to be in a hot cache line.
--- net/ipv6/raw.c | 2 +- net/ipv6/udp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/ipv6/raw.c +1 -1
@@ -438,7 +438,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,if (flags &MSG_ERRQUEUE )return ipv6_recv_error (sk, msg, len, addr_len); -if (np->rxpmtu && np->rxopt.bits.rxpmtu) +if (np->rxopt.bits.rxpmtu &&READ_ONCE (np->rxpmtu))return ipv6_recv_rxpmtu (sk, msg, len, addr_len); skb =skb_recv_datagram (sk, flags, &err);
net/ipv6/udp.c +1 -1
@@ -347,7 +347,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,if (flags &MSG_ERRQUEUE )return ipv6_recv_error (sk, msg, len, addr_len); -if (np->rxpmtu && np->rxopt.bits.rxpmtu) +if (np->rxopt.bits.rxpmtu &&READ_ONCE (np->rxpmtu))return ipv6_recv_rxpmtu (sk, msg, len, addr_len); try_again:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 251/529 RDMA/irdma: Update Kconfig
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit 060842fed53f77a73824c9147f51dc6746c1267a ]
Update Kconfig to add dependency on idpf module and add IPU E2000 to the list of supported devices.
--- drivers/infiniband/hw/irdma/Kconfig | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/infiniband/hw/irdma/Kconfig +4 -3
@@ -4,9 +4,10 @@ config INFINIBAND_IRDMA depends on INET depends on IPV6 || !IPV6 depends on PCI - depends on ICE && I40E + depends on IDPF && ICE && I40E select GENERIC_ALLOCATOR select AUXILIARY_BUS help - This is an Intel(R) Ethernet Protocol Driver for RDMA driver - that support E810 (iWARP/RoCE) and X722 (iWARP) network devices. + This is an Intel(R) Ethernet Protocol Driver for RDMA that + supports IPU E2000 (RoCEv2), E810 (iWARP/RoCEv2) and X722 (iWARP) + network devices.
Signature · 1 line
2.51.0
RE: [PATCH 6.6 251/529] RDMA/irdma: Update Kconfig
Quoted 12 lines
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Friday, November 21, 2025 7:09 AM
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; Nikolova, Tatyana E <[email protected]>; Jacob Moroni <[email protected]>; Leon Romanovsky <[email protected]>; Sasha Levin <[email protected]>
Subject: [PATCH 6.6 251/529] RDMA/irdma: UpdateKconfig
Quoted 1 line
6.6-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
Even though IDPF driver exists in older kernels, it doesn't provide RDMA support so there is no need for IRDMA to depend on IDPF in kernels <= 6.17.
060842fed53f ("RDMA/irdma: Update Kconfig") patch shouldn't be backported in kernels <= 6.17
Thank you,
Tatyana
Quoted 45 lines
------------------
From: Tatyana Nikolova <[email protected]>
[ Upstream commit
060842fed53f77a73824c9147f51dc6746c1267a]Update
Kconfigto add dependency on idpf module and add IPU E2000 to the list of supported devices.Signed-off-by Tatyana Nikolova <[email protected]>Tested-by Jacob Moroni <[email protected]>Signed-off-by Leon Romanovsky <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/infiniband/hw/irdma/Kconfig | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)drivers/infiniband/hw/irdma/Kconfig +1
-3@@ -4,9 +4,10 @@ config INFINIBAND_IRDMA depends on INET depends on IPV6 || !IPV6 depends on PCI - depends on ICE && I40E + depends on IDPF && ICE && I40E select GENERIC_ALLOCATOR select AUXILIARY_BUS help - This is an Intel(R) Ethernet Protocol Driver for RDMA driver - that support E810 (iWARP/RoCE) and X722 (iWARP) networkdevices.
drivers/infiniband/hw/irdma/Kconfig +2
-0+ This is an Intel(R) Ethernet Protocol Driver for RDMA that + supports IPU E2000 (RoCEv2), E810 (iWARP/RoCEv2) and X722(iWARP)
drivers/infiniband/hw/irdma/Kconfig +1
-1+ network devices. --2.51.0
Sasha Levin
maintainerRe: [PATCH 6.6 251/529] RDMA/irdma: Update Kconfig
Quoted 12 lines · Tatyana E
Quoted 12 lines
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Friday, November 21, 2025 7:09 AM
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; Nikolova, Tatyana E <[email protected]>; Jacob Moroni <[email protected]>; Leon Romanovsky <[email protected]>; Sasha Levin <[email protected]>
Subject: [PATCH 6.6 251/529] RDMA/irdma: UpdateKconfig
Quoted 7 lines
Quoted 1 line
6.6-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
Even though IDPF driver exists in older kernels, it doesn't provide RDMA support so there is no need for IRDMA to depend on IDPF in kernels <= 6.17.
060842fed53f("RDMA/irdma: UpdateKconfig") patch shouldn't be backported in kernels <= 6.17
I'll drop it, thanks for the report!
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 252/529 jfs: Verify inode mode when loading from disk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does.
--- fs/jfs/inode.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/jfs/inode.c +7 -1
@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)*/ inode->i_link[inode->i_size] ='\0' ; } - }else { + }else if (S_ISCHR (inode->i_mode) ||S_ISBLK (inode->i_mode) || +S_ISFIFO (inode->i_mode) ||S_ISSOCK (inode->i_mode)) { inode->i_op = &jfs_file_inode_operations;init_special_inode (inode, inode->i_mode, inode->i_rdev); + }else { +printk (KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n" , + inode->i_mode, inode->i_ino); +iget_failed (inode); +return ERR_PTR (-EIO ); }unlock_new_inode (inode);return inode;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 253/529 jfs: fix uninitialized waitqueue in transaction manager
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <[email protected]>
[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
The transaction manager initialization in txInit() was not properly initializing TxBlock[0].waitor waitqueue, causing a crash when txEnd(0) is called on read-only filesystems.
When a filesystem is mounted read-only, txBegin() returns tid=0 to indicate no transaction. However, txEnd(0) still gets called and tries to access TxBlock[0].waitor via tid_to_tblock(0), but this waitqueue was never initialized because the initialization loop started at index 1 instead of 0.
This causes a 'non-static key' lockdep warning and system crash:
INFO: trying to register non-static key in txEnd
Fix by ensuring all transaction blocks including TxBlock[0] have their waitqueues properly initialized during txInit().
--- fs/jfs/jfs_txnmgr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/jfs/jfs_txnmgr.c +5 -4
@@ -272,14 +272,15 @@ int txInit(void)if (TxBlock ==NULL )return -ENOMEM ; -for (k =1 ; k < nTxBlock -1 ; k++) { - TxBlock[k].next = k +1 ; +for (k =0 ; k < nTxBlock; k++) {init_waitqueue_head (&TxBlock[k].gcwait);init_waitqueue_head (&TxBlock[k].waitor); } + +for (k =1 ; k < nTxBlock -1 ; k++) { + TxBlock[k].next = k +1 ; + } TxBlock[k].next =0 ; -init_waitqueue_head (&TxBlock[k].gcwait); -init_waitqueue_head (&TxBlock[k].waitor); TxAnchor.freetid =1 ;init_waitqueue_head (&TxAnchor.freewait);
Signature · 1 line
2.51.0
syzbot
syzbotRe: [PATCH 6.6 253/529] jfs: fix uninitialized waitqueue in transaction manager
I see the command but can't find the corresponding bug. The email is sent to [email protected] address but the HASH does not correspond to any known bug. Please double check the…
Quoted 62 lines
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <[email protected]>
[ Upstream commit
300b072df72694ea330c4c673c035253e07827b8]The transaction manager initialization in
txInit()was not properly initializing TxBlock[0].waitor waitqueue, causing a crash when txEnd(0) is called on read-only filesystems.When a filesystem is mounted read-only,
txBegin()returns tid=0 to indicate no transaction. However, txEnd(0) still gets called and tries to access TxBlock[0].waitor viatid_to_tblock(0), but this waitqueue was never initialized because the initialization loop started at index 1 instead of 0.This causes a 'non-static key' lockdep warning and system crash:
INFO: trying to register non-static key in txEndFix by ensuring all transaction blocks including TxBlock[0] have their waitqueues properly initialized during
txInit().Reported-by [email protected]Signed-off-by Shaurya Rane <[email protected]>Signed-off-by Dave Kleikamp <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- fs/jfs/jfs_txnmgr.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)fs/jfs/jfs_txnmgr.c +5
-4@@ -272,14 +272,15 @@ int txInit(void)if (TxBlock ==NULL )return -ENOMEM ; -for (k =1 ; k < nTxBlock -1 ; k++) { - TxBlock[k].next = k +1 ; +for (k =0 ; k < nTxBlock; k++) {init_waitqueue_head (&TxBlock[k].gcwait);init_waitqueue_head (&TxBlock[k].waitor); } + +for (k =1 ; k < nTxBlock -1 ; k++) { + TxBlock[k].next = k +1 ; + } TxBlock[k].next =0 ; -init_waitqueue_head (&TxBlock[k].gcwait); -init_waitqueue_head (&TxBlock[k].waitor); TxAnchor.freetid =1 ;init_waitqueue_head (&TxAnchor.freewait);Signature · 1 line
2.51.0
I see the command but can't find the corresponding bug. The email is sent to [email protected] address but the HASH does not correspond to any known bug. Please double check the address.
Greg Kroah-Hartman
maintainerPATCH 254/529 ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
[ Upstream commit 9565c9d53c5b440f0dde6fa731a99c1b14d879d2 ]
Setting format to s16le is required for compressed playback on compatible soundcards.
--- sound/soc/qcom/sc8280xp.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/qcom/sc8280xp.c +3 -0
@@ -7,6 +7,7 @@#include <sound/soc.h> #include <sound/soc-dapm.h> #include <sound/pcm.h> +#include <sound/pcm_params.h> #include <linux/soundwire/sdw.h> #include <sound/jack.h> #include <linux/input-event-codes.h>
@@ -58,8 +59,10 @@ static int sc8280xp_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd, SNDRV_PCM_HW_PARAM_RATE);struct snd_interval *channels =hw_param_interval (params,SNDRV_PCM_HW_PARAM_CHANNELS ); +struct snd_mask *fmt =hw_param_mask (params,SNDRV_PCM_HW_PARAM_FORMAT ); rate->min = rate->max =48000 ; +snd_mask_set_format (fmt,SNDRV_PCM_FORMAT_S16_LE ); channels->min =2 ; channels->max =2 ;switch (cpu_dai->id) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 255/529 net: phy: clear link parameters on admin link down
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit 60f887b1290b43a4f5a3497982a725687b193fa4 ]
When a PHY is halted (e.g. ip link set dev lan2 down), several fields in struct phy_device may still reflect the last active connection. This leads to ethtool showing stale values even though the link is down.
Reset selected fields in _phy_state_machine() when transitioning to PHY_HALTED and the link was previously up:
- speed/duplex -> UNKNOWN, but only in autoneg mode (in forced mode these fields carry configuration, not status)
- master_slave_state -> UNKNOWN if previously supported
- mdix -> INVALID (state only, same meaning as "unknown")
- lp_advertising -> always cleared
The cleanup is skipped if the PHY is in PHY_ERROR state, so the last values remain available for diagnostics.
--- drivers/net/phy/phy.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/net/phy/phy.c +13 -0
@@ -1482,6 +1482,19 @@ void phy_state_machine(struct work_struct *work) }break ;case PHY_HALTED : +if (phydev->link) { +if (phydev->autoneg ==AUTONEG_ENABLE ) { + phydev->speed =SPEED_UNKNOWN ; + phydev->duplex =DUPLEX_UNKNOWN ; + } +if (phydev->master_slave_state != +MASTER_SLAVE_STATE_UNSUPPORTED ) + phydev->master_slave_state = +MASTER_SLAVE_STATE_UNKNOWN ; + phydev->mdix =ETH_TP_MDI_INVALID ; +linkmode_zero (phydev->lp_advertising); + } + fallthrough;case PHY_ERROR :if (phydev->link) { phydev->link =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 256/529 net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Marko <[email protected]>
[ Upstream commit 6287982aa54946449bccff3e6488d3a15e458392 ]
LAN969x switchdev support depends on the SparX-5 core,so make it selectable for ARCH_LAN969X.
--- drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/microchip/sparx5/Kconfig +1 -1
@@ -3,7 +3,7 @@ config SPARX5_SWITCH depends on NET_SWITCHDEV depends on HAS_IOMEM depends on OF - depends on ARCH_SPARX5 || COMPILE_TEST + depends on ARCH_SPARX5 || ARCH_LAN969X || COMPILE_TEST depends on PTP_1588_CLOCK_OPTIONAL depends on BRIDGE || BRIDGE=n select PHYLINK
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 257/529 iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seyediman Seyedarab <[email protected]>
[ Upstream commit 75c02a037609f34db17e91be195cedb33b61bae0 ]
snprintf() returns the number of bytes that would have been written, not the number actually written. Using this for offset tracking can cause buffer overruns if truncation occurs.
Replace snprintf() with scnprintf() to ensure the offset stays within bounds.
Since scnprintf() never returns a negative value, and zero is not possible in this context because 'bytes' starts at 0 and 'size - bytes' is DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the string literals used, the return value is always positive. An integer overflow is also completely out of reach here due to the small and fixed buffer size. The error check in latency_show_one() is therefore unnecessary. Remove it and make dmar_latency_snapshot() return void.
--- drivers/iommu/intel/debugfs.c | 10 ++-------- drivers/iommu/intel/perf.c | 10 ++++------ drivers/iommu/intel/perf.h | 5 ++--- 3 files changed, 8 insertions(+), 17 deletions(-)
drivers/iommu/intel/debugfs.c +2 -8
@@ -562,17 +562,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct);static void latency_show_one (struct seq_file *m,struct intel_iommu *iommu,struct dmar_drhd_unit *drhd) { -int ret; -seq_printf (m,"IOMMU: %s Register Base Address: %llx\n" , iommu->name, drhd->reg_base_addr); - ret =dmar_latency_snapshot (iommu, debug_buf,DEBUG_BUFFER_SIZE ); -if (ret <0 ) -seq_puts (m,"Failed to get latency snapshot" ); -else -seq_puts (m, debug_buf); -seq_puts (m,"\n" ); +dmar_latency_snapshot (iommu, debug_buf,DEBUG_BUFFER_SIZE ); +seq_printf (m,"%s\n" , debug_buf); }static int latency_show (struct seq_file *m,void *v)
drivers/iommu/intel/perf.c +4 -6
@@ -113,7 +113,7 @@ static char *latency_type_names[] = { " svm_prq" }; -int dmar_latency_snapshot (struct intel_iommu *iommu,char *str,size_t size) +void dmar_latency_snapshot (struct intel_iommu *iommu,char *str,size_t size) {struct latency_statistic *lstat = iommu->perf_statistic;unsigned long flags;
@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)memset (str,0 , size);for (i =0 ; i <COUNTS_NUM ; i++) - bytes +=snprintf (str + bytes, size - bytes, + bytes +=scnprintf (str + bytes, size - bytes,"%s" , latency_counter_names[i]);spin_lock_irqsave (&latency_lock, flags);
@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)if (!dmar_latency_enabled (iommu, i))continue ; - bytes +=snprintf (str + bytes, size - bytes, + bytes +=scnprintf (str + bytes, size - bytes,"\n%s" , latency_type_names[i]);for (j =0 ; j <COUNTS_NUM ; j++) {
@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)break ; } - bytes +=snprintf (str + bytes, size - bytes, + bytes +=scnprintf (str + bytes, size - bytes,"%12lld" , val); } }spin_unlock_irqrestore (&latency_lock, flags); - -return bytes; }
drivers/iommu/intel/perf.h +2 -3
@@ -41,7 +41,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);bool dmar_latency_enabled (struct intel_iommu *iommu,enum latency_type type);void dmar_latency_update (struct intel_iommu *iommu,enum latency_type type,u64 latency); -int dmar_latency_snapshot (struct intel_iommu *iommu,char *str,size_t size); +void dmar_latency_snapshot (struct intel_iommu *iommu,char *str,size_t size);#else static inline int dmar_latency_enable (struct intel_iommu *iommu,enum latency_type type)
@@ -65,9 +65,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten { } -static inline int +static inline void dmar_latency_snapshot (struct intel_iommu *iommu,char *str,size_t size) { -return 0 ; }#endif /* CONFIG_DMAR_PERF */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 258/529 wifi: ath10k: Fix connection after GTK rekeying
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <[email protected]>
[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
It appears that not all hardware/firmware implementations support group key deletion correctly, which can lead to connection hangs and deauthentication following GTK rekeying (delete and install).
To avoid this issue, instead of attempting to delete the key using the special WMI_CIPHER_NONE value, we now replace the key with an invalid (random) value.
This behavior has been observed with WCN39xx chipsets.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
--- drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath10k/mac.c +10 -2
@@ -14,6 +14,7 @@#include <linux/acpi.h> #include <linux/of.h> #include <linux/bitfield.h> +#include <linux/random.h> #include "hif.h" #include "core.h"
@@ -287,8 +288,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif, key->flags |=IEEE80211_KEY_FLAG_GENERATE_IV ;if (cmd ==DISABLE_KEY ) { - arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE ]; - arg.key_data =NULL ; +if (flags &WMI_KEY_GROUP ) { +/* Not all hardware handles group-key deletion operation +* correctly. Replace the key with a junk value to invalidate it. +*/ +get_random_bytes (key->key, key->keylen); + }else { + arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE ]; + arg.key_data =NULL ; + } }return ath10k_wmi_vdev_install_key (arvif->ar, &arg);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 259/529 net: intel: fm10k: Fix parameter idx set but not used
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
Variable idx is set in the loop, but is never used resulting in dead code. Building with GCC 16, which enables -Werror=unused-but-set-parameter= by default results in build error. This patch removes the idx parameter, since all the callers of the fm10k_unbind_hw_stats_q as 0 as idx anyways.
--- drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++--- drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +- 4 files changed, 5 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/fm10k/fm10k_common.c +2 -3
@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,/** * fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues * @q: pointer to the ring of hardware statistics queue -* @idx: index pointing to the start of the ring iteration * @count: number of queues to iterate over * * Function invalidates the index values for the queues so any updates that * may have happened are ignored and the base for the queue stats is reset. **/ -void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 idx,u32 count) +void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 count) {u32 i; -for (i =0 ; i < count; i++, idx++, q++) { +for (i =0 ; i < count; i++, q++) { q->rx_stats_idx =0 ; q->tx_stats_idx =0 ; }
drivers/net/ethernet/intel/fm10k/fm10k_common.h +1 -1
@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,void fm10k_update_hw_stats_q (struct fm10k_hw *hw,struct fm10k_hw_stats_q *q,u32 idx,u32 count);#define fm10k_unbind_hw_stats_32b (s) ((s)->base_h = 0) -void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 idx,u32 count); +void fm10k_unbind_hw_stats_q (struct fm10k_hw_stats_q *q,u32 count);s32 fm10k_get_host_state_generic (struct fm10k_hw *hw,bool *host_ready);#endif /* _FM10K_COMMON_H_ */
drivers/net/ethernet/intel/fm10k/fm10k_pf.c +1 -1
@@ -1510,7 +1510,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,fm10k_unbind_hw_stats_32b (&stats->nodesc_drop);/* Unbind Queue Statistics */ -fm10k_unbind_hw_stats_q (stats->q,0 , hw->mac.max_queues); +fm10k_unbind_hw_stats_q (stats->q, hw->mac.max_queues);/* Reinitialize bases for all stats */ fm10k_update_hw_stats_pf (hw, stats);
drivers/net/ethernet/intel/fm10k/fm10k_vf.c +1 -1
@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw, struct fm10k_hw_stats *stats) {/* Unbind Queue Statistics */ -fm10k_unbind_hw_stats_q (stats->q,0 , hw->mac.max_queues); +fm10k_unbind_hw_stats_q (stats->q, hw->mac.max_queues);/* Reinitialize bases for all stats */ fm10k_update_hw_stats_vf (hw, stats);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 260/529 r8169: set EEE speed down ratio to 1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChunHao Lin <[email protected]>
[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
EEE speed down means speed down MAC MCU clock. It is not from spec. It is kind of Realtek specific power saving feature. But enable it may cause some issues, like packet drop or interrupt loss. Different hardware may have different issues.
EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed down rate. The larger this value is, the more power can save. But it actually save less power then we expected. And, as mentioned above, will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0) , which means not to speed down, to improve compatibility.
--- drivers/net/ethernet/realtek/r8169_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +3 -3
@@ -3362,7 +3362,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)r8168_mac_ocp_modify (tp,0xd412 ,0x0fff , sw_cnt_1ms_ini); } -r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0070 ); +r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0000 );r8168_mac_ocp_modify (tp,0xe052 ,0x6000 ,0x8008 );r8168_mac_ocp_modify (tp,0xe0d6 ,0x01ff ,0x017f );r8168_mac_ocp_modify (tp,0xd420 ,0x0fff ,0x047f );
@@ -3467,7 +3467,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)r8168_mac_ocp_modify (tp,0xd412 ,0x0fff , sw_cnt_1ms_ini); } -r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0070 ); +r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0000 );r8168_mac_ocp_write (tp,0xea80 ,0x0003 );r8168_mac_ocp_modify (tp,0xe052 ,0x0000 ,0x0009 );r8168_mac_ocp_modify (tp,0xd420 ,0x0fff ,0x047f );
@@ -3660,7 +3660,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)r8168_mac_ocp_modify (tp,0xc0b4 ,0x0000 ,0x000c );r8168_mac_ocp_modify (tp,0xeb6a ,0x00ff ,0x0033 );r8168_mac_ocp_modify (tp,0xeb50 ,0x03e0 ,0x0040 ); -r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0030 ); +r8168_mac_ocp_modify (tp,0xe056 ,0x00f0 ,0x0000 );r8168_mac_ocp_modify (tp,0xe040 ,0x1000 ,0x0000 );r8168_mac_ocp_modify (tp,0xea1c ,0x0003 ,0x0001 );r8168_mac_ocp_modify (tp,0xe0c0 ,0x4f0f ,0x4403 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 261/529 PCI: cadence: Check for the existence of cdns_pcie::ops before using it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Wang <[email protected]>
[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
cdns_pcie::ops might not be populated by all the Cadence glue drivers. This is going to be true for the upcoming Sophgo platform which doesn't set the ops.
Hence, add a check to prevent NULL pointer dereference.
--- drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +- drivers/pci/controller/cadence/pcie-cadence.c | 4 ++-- drivers/pci/controller/cadence/pcie-cadence.h | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-host.c +1 -1
@@ -452,7 +452,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)cdns_pcie_writel (pcie,CDNS_PCIE_AT_OB_REGION_PCI_ADDR1 (0 ), addr1);cdns_pcie_writel (pcie,CDNS_PCIE_AT_OB_REGION_DESC1 (0 ), desc1); -if (pcie->ops->cpu_addr_fixup) +if (pcie->ops && pcie->ops->cpu_addr_fixup) cpu_addr = pcie->ops->cpu_addr_fixup (pcie, cpu_addr); addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
drivers/pci/controller/cadence/pcie-cadence.c +2 -2
@@ -90,7 +90,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,cdns_pcie_writel (pcie,CDNS_PCIE_AT_OB_REGION_DESC1 (r), desc1);/* Set the CPU address */ -if (pcie->ops->cpu_addr_fixup) +if (pcie->ops && pcie->ops->cpu_addr_fixup) cpu_addr = pcie->ops->cpu_addr_fixup (pcie, cpu_addr); addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
@@ -120,7 +120,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie, }/* Set the CPU address */ -if (pcie->ops->cpu_addr_fixup) +if (pcie->ops && pcie->ops->cpu_addr_fixup) cpu_addr = pcie->ops->cpu_addr_fixup (pcie, cpu_addr); addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
drivers/pci/controller/cadence/pcie-cadence.h +3 -3
@@ -494,7 +494,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)static inline int cdns_pcie_start_link (struct cdns_pcie *pcie) { -if (pcie->ops->start_link) +if (pcie->ops && pcie->ops->start_link)return pcie->ops->start_link (pcie);return 0 ;
@@ -502,13 +502,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)static inline void cdns_pcie_stop_link (struct cdns_pcie *pcie) { -if (pcie->ops->stop_link) +if (pcie->ops && pcie->ops->stop_link) pcie->ops->stop_link (pcie); }static inline bool cdns_pcie_link_up (struct cdns_pcie *pcie) { -if (pcie->ops->link_up) +if (pcie->ops && pcie->ops->link_up)return pcie->ops->link_up (pcie);return true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 262/529 sparc/module: Add R_SPARC_UA64 relocation handling
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koakuma <[email protected]>
[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
This is needed so that the kernel can handle R_SPARC_UA64 relocations, which is emitted by LLVM's IAS.
--- arch/sparc/include/asm/elf_64.h | 1 + arch/sparc/kernel/module.c | 1 + 2 files changed, 2 insertions(+)
arch/sparc/include/asm/elf_64.h +1 -0
@@ -58,6 +58,7 @@#define R_SPARC_7 43#define R_SPARC_5 44#define R_SPARC_6 45 +#define R_SPARC_UA64 54/* Bits present in AT_HWCAP, primarily for Sparc32. */ #define HWCAP_SPARC_FLUSH 0x00000001
arch/sparc/kernel/module.c +1 -0
@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,break ;#ifdef CONFIG_SPARC64 case R_SPARC_64 : +case R_SPARC_UA64 : location[0 ] = v >>56 ; location[1 ] = v >>48 ; location[2 ] = v >>40 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 263/529 sparc64: fix prototypes of reads[bwl]()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 7205ef77dfe167df1b83aea28cf00fc02d662990 ]
Conventions for readsl() are the same as for readl() - any __iomem pointer is acceptable, both const and volatile ones being OK. Same for readsb() and readsw().
--- arch/sparc/include/asm/io_64.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/sparc/include/asm/io_64.h +3 -3
@@ -250,19 +250,19 @@ void insl(unsigned long, void *, unsigned long);#define insw insw#define insl insl -static inline void readsb (void __iomem *port,void *buf,unsigned long count) +static inline void readsb (const volatile void __iomem *port,void *buf,unsigned long count) {insb ((unsigned long __force )port, buf, count); }#define readsb readsb -static inline void readsw (void __iomem *port,void *buf,unsigned long count) +static inline void readsw (const volatile void __iomem *port,void *buf,unsigned long count) {insw ((unsigned long __force )port, buf, count); }#define readsw readsw -static inline void readsl (void __iomem *port,void *buf,unsigned long count) +static inline void readsl (const volatile void __iomem *port,void *buf,unsigned long count) {insl ((unsigned long __force )port, buf, count); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 264/529 vfio: return -ENOTTY for unsupported device feature
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Mastro <[email protected]>
[ Upstream commit 16df67f2189a71a8310bcebddb87ed569e8352be ]
The two implementers of vfio_device_ops.device_feature, vfio_cdx_ioctl_feature and vfio_pci_core_ioctl_feature, return -ENOTTY in the fallthrough case when the feature is unsupported. For consistency, the base case, vfio_ioctl_device_feature, should do the same when device_feature == NULL, indicating an implementation has no feature extensions.
--- drivers/vfio/vfio_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/vfio_main.c +1 -1
@@ -1195,7 +1195,7 @@ static int vfio_ioctl_device_feature(struct vfio_device *device, feature.argsz - minsz);default :if (unlikely (!device->ops->device_feature)) -return -EINVAL ; +return -ENOTTY ;return device->ops->device_feature (device, feature.flags, arg->data, feature.argsz - minsz);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 265/529 PCI/PM: Skip resuming to D0 if device is disconnected
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 299fad4133677b845ce962f78c9cf75bded63f61 ]
When a device is surprise-removed (e.g., due to a dock unplug), the PCI core unconfigures all downstream devices and sets their error state to pci_channel_io_perm_failure. This marks them as disconnected via pci_dev_is_disconnected().
During device removal, the runtime PM framework may attempt to resume the device to D0 via pm_runtime_get_sync(), which calls into pci_power_up(). Since the device is already disconnected, this resume attempt is unnecessary and results in a predictable errors like this, typically when undocking from a TBT3 or USB4 dock with PCIe tunneling:
pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
Avoid powering up disconnected devices by checking their status early in pci_power_up() and returning -EIO.
--- drivers/pci/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/pci/pci.c +5 -0
@@ -1257,6 +1257,11 @@ int pci_power_up(struct pci_dev *dev)return -EIO ; } +if (pci_dev_is_disconnected (dev)) { + dev->current_state = PCI_D3cold; +return -EIO ; + } +pci_read_config_word (dev, dev->pm_cap +PCI_PM_CTRL , &pmcsr);if (PCI_POSSIBLE_ERROR (pmcsr)) { pci_err(dev, "Unable to change power state from %s to D0, device inaccessible\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 266/529 remoteproc: qcom: q6v5: Avoid handling handover twice
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <[email protected]>
[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
A remoteproc could theoretically signal handover twice. This is unexpected and would break the reference counting for the handover resources (power domains, clocks, regulators, etc), so add a check to prevent that from happening.
--- drivers/remoteproc/qcom_q6v5.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/remoteproc/qcom_q6v5.c +5 -0
@@ -164,6 +164,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data) {struct qcom_q6v5 *q6v5 = data; +if (q6v5->handover_issued) { +dev_err (q6v5->dev,"Handover signaled, but it already happened\n" ); +return IRQ_HANDLED ; + } +if (q6v5->handover) q6v5->handover (q6v5);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 267/529 wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithyanantham Paramasivam <[email protected]>
[ Upstream commit 82993345aef6987a916337ebd2fca3ff4a6250a7 ]
Increase DP_REO_CMD_RING_SIZE from 128 to 256 to avoid queuing failures observed during stress test scenarios.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/dp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/dp.h +1 -1
@@ -162,7 +162,7 @@ struct ath12k_pdev_dp {#define DP_REO_REINJECT_RING_SIZE 32#define DP_RX_RELEASE_RING_SIZE 1024#define DP_REO_EXCEPTION_RING_SIZE 128 -#define DP_REO_CMD_RING_SIZE 128 +#define DP_REO_CMD_RING_SIZE 256#define DP_REO_STATUS_RING_SIZE 2048#define DP_RXDMA_BUF_RING_SIZE 4096#define DP_RXDMA_REFILL_RING_SIZE 2048
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 268/529 drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthi Kandasamy <[email protected]>
[ Upstream commit c8bedab2d9a1a0daa49ac20f9928a943f7205582 ]
[WHY]
Ensure AVI infoframe updates from stream updates are applied to the active stream so OS overrides are not lost.
[HOW]
Copy avi_infopacket to stream when valid flag is set.
Follow existing infopacket copy pattern and perform a basic validity check before assignment.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 7 ++++++- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 ++++++ drivers/gpu/drm/amd/display/dc/dc_stream.h | 3 +++ 3 files changed, 15 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +6 -1
@@ -2952,6 +2952,9 @@ static void copy_stream_update_to_stream(struct dc *dc,if (update->adaptive_sync_infopacket) stream->adaptive_sync_infopacket = *update->adaptive_sync_infopacket; +if (update->avi_infopacket) + stream->avi_infopacket = *update->avi_infopacket; +if (update->dither_option) stream->dither_option = *update->dither_option;
@@ -3158,7 +3161,8 @@ static void commit_planes_do_stream_update(struct dc *dc, stream_update->vsp_infopacket || stream_update->hfvsif_infopacket || stream_update->adaptive_sync_infopacket || - stream_update->vtem_infopacket) { + stream_update->vtem_infopacket || + stream_update->avi_infopacket) {resource_build_info_frame (pipe_ctx); dc->hwss.update_info_frame (pipe_ctx);
@@ -4241,6 +4245,7 @@ static bool full_update_required(struct dc *dc, stream_update->hfvsif_infopacket || stream_update->vtem_infopacket || stream_update->adaptive_sync_infopacket || + stream_update->avi_infopacket || stream_update->dpms_off || stream_update->allow_freesync || stream_update->vrr_active_variable ||
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +6 -0
@@ -3225,8 +3225,14 @@ static void set_avi_info_frame(unsigned int fr_ind = pipe_ctx->stream->timing.fr_index;enum dc_timing_3d_format format; +if (stream->avi_infopacket.valid) { + *info_packet = stream->avi_infopacket; +return ; + } +memset (&hdmi_info,0 ,sizeof (union hdmi_info_packet )); + color_space = pipe_ctx->stream->output_color_space;if (color_space ==COLOR_SPACE_UNKNOWN ) color_space = (stream->timing.pixel_encoding == PIXEL_ENCODING_RGB) ?
drivers/gpu/drm/amd/display/dc/dc_stream.h +3 -0
@@ -197,6 +197,7 @@ struct dc_stream_state {struct dc_info_packet hfvsif_infopacket;struct dc_info_packet vtem_infopacket;struct dc_info_packet adaptive_sync_infopacket; +struct dc_info_packet avi_infopacket;uint8_t dsc_packed_pps[128 ];struct rect src;/* composition area */ struct rect dst;/* stream addressable area */
@@ -323,6 +324,8 @@ struct dc_stream_update {struct dc_info_packet *hfvsif_infopacket;struct dc_info_packet *vtem_infopacket;struct dc_info_packet *adaptive_sync_infopacket; +struct dc_info_packet *avi_infopacket; +bool *dpms_off;bool integer_scaling_update;bool *allow_freesync;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 269/529 NFSv4: handle ERR_GRACE on delegation recalls
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
RFC7530 states that clients should be prepared for the return of NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
--- fs/nfs/nfs4proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/nfs4proc.c +2 -2
@@ -7658,10 +7658,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,return err;do { err =_nfs4_do_setlk (state,F_SETLK , fl,NFS_LOCK_NEW ); -if (err != -NFS4ERR_DELAY ) +if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE )break ;ssleep (1 ); - }while (err == -NFS4ERR_DELAY ); + }while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE );return nfs4_handle_delegation_recall_error (server, state, stateid, fl, err); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 270/529 NFSv4.1: fix mount hang after CREATE_SESSION failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
When client initialization goes through server trunking discovery, it schedules the state manager and then sleeps waiting for nfs_client initialization completion.
The state manager can fail during state recovery, and specifically in lease establishment as nfs41_init_clientid() will bail out in case of errors returned from nfs4_proc_create_session(), without ever marking the client ready. The session creation can fail for a variety of reasons e.g. during backchannel parameter negotiation, with status -EINVAL.
The error status will propagate all the way to the nfs4_state_manager but the client status will not be marked, and thus the mount process will remain blocked waiting.
Fix it by adding -EINVAL error handling to nfs4_state_manager().
--- fs/nfs/nfs4state.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4state.c +3 -0
@@ -2746,6 +2746,9 @@ static void nfs4_state_manager(struct nfs_client *clp)case -ENETUNREACH :nfs_mark_client_ready (clp, -EIO );break ; +case -EINVAL : +nfs_mark_client_ready (clp, status); +break ;default :ssleep (1 );break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 271/529 nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack.
Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that.
--- fs/nfs/nfs4proc.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/nfs4proc.c +2 -0
@@ -362,7 +362,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent *p++ =htonl (attrs);/* bitmap */ *p++ =htonl (12 );/* attribute buffer length */ *p++ =htonl (NF4DIR ); +spin_lock (&dentry->d_lock); p =xdr_encode_hyper (p,NFS_FILEID (d_inode (dentry->d_parent))); +spin_unlock (&dentry->d_lock); readdir->pgbase = (char *)p - (char *)start; readdir->count -= readdir->pgbase;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 272/529 net: bridge: Install FDB for bridge MAC on VLAN 0
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <[email protected]>
[ Upstream commit cd9a9562b2559973aa1b68c3af63021a2c5fd022 ]
Currently, after the bridge is created, the FDB does not hold an FDB entry for the bridge MAC on VLAN 0:
# ip link add name br up type bridge # ip -br link show dev br br UNKNOWN 92:19:8c:4e:01:ed <BROADCAST,MULTICAST,UP,LOWER_UP> # bridge fdb show | grep 92:19:8c:4e:01:ed 92:19:8c:4e:01:ed dev br vlan 1 master br permanent
Later when the bridge MAC is changed, or in fact when the address is given during netdevice creation, the entry appears:
# ip link add name br up address 00:11:22:33:44:55 type bridge # bridge fdb show | grep 00:11:22:33:44:55 00:11:22:33:44:55 dev br vlan 1 master br permanent 00:11:22:33:44:55 dev br master br permanent
However when the bridge address is set by the user to the current bridge address before the first port is enslaved, none of the address handlers gets invoked, because the address is not actually changed. The address is however marked as NET_ADDR_SET. Then when a port is enslaved, the address is not changed, because it is NET_ADDR_SET. Thus the VLAN 0 entry is not added, and it has not been added previously either:
# ip link add name br up type bridge # ip -br link show dev br br UNKNOWN 7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP> # ip link set dev br addr 7e:f0:a8:1a:be:c2 # ip link add name v up type veth # ip link set dev v master br # ip -br link show dev br br UNKNOWN 7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP> # bridge fdb | grep 7e:f0:a8:1a:be:c2 7e:f0:a8:1a:be:c2 dev br vlan 1 master br permanent
Then when the bridge MAC is used as DMAC, and br_handle_frame_finish() looks up an FDB entry with VLAN=0, it doesn't find any, and floods the traffic instead of passing it up.
Fix this by simply adding the VLAN 0 FDB entry for the bridge itself always on netdevice creation. This also makes the behavior consistent with how ports are treated: ports always have an FDB entry for each member VLAN as well as VLAN 0.
--- net/bridge/br.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bridge/br.c +5 -0
@@ -37,6 +37,11 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, vint err;if (netif_is_bridge_master (dev)) { +struct net_bridge *br =netdev_priv (dev); + +if (event ==NETDEV_REGISTER ) +br_fdb_change_mac_address (br, dev->dev_addr); + err =br_vlan_bridge_event (dev, event, ptr);if (err)return notifier_from_errno (err);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 273/529 scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <[email protected]>
[ Upstream commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba ]
The fc_ct_ms_fill() helper currently formats the OS name and version into entry->value using "%s v%s". Since init_utsname()->sysname and ->release are unbounded strings, snprintf() may attempt to write more than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a -Wformat-truncation warning with W=1.
In file included from drivers/scsi/libfc/fc_elsct.c:18:drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’:drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may be truncated writing up to 64 bytes into a region of size between 62 and 126 [-Werror=format-truncation=]
359 | "%s v%s",
| ^~
360 | init_utsname()->sysname,
361 | init_utsname()->release);
| ~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between
3 and 131 bytes into a destination of size 128
357 | snprintf((char *)&entry->value,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
358 | FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
359 | "%s v%s",
| ~~~~~~~~~
360 | init_utsname()->sysname,
| ~~~~~~~~~~~~~~~~~~~~~~~~
361 | init_utsname()->release);
| ~~~~~~~~~~~~~~~~~~~~~~~~Fix this by using "%.62s v%.62s", which ensures sysname and release are truncated to fit within the 128-byte field defined by FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN.
[mkp: clarified commit description]
--- drivers/scsi/libfc/fc_encode.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/libfc/fc_encode.h +1 -1
@@ -354,7 +354,7 @@ static inline int fc_ct_ms_fill(struct fc_lport *lport,put_unaligned_be16 (len, &entry->len);snprintf ((char *)&entry->value,FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN , -"%s v%s" , +"%.62s v%.62s" ,init_utsname ()->sysname,init_utsname ()->release);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 274/529 accel/habanalabs/gaudi2: fix BMON disable configuration
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vered Yavniely <[email protected]>
[ Upstream commit b4fd8e56c9a3b614370fde2d45aec1032eb67ddd ]
Change the BMON_CR register value back to its original state before enabling, so that BMON does not continue to collect information after being disabled.
--- drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c +1 -1
@@ -2409,7 +2409,7 @@ static int gaudi2_config_bmon(struct hl_device *hdev, struct hl_debug_params *paWREG32 (base_reg + mmBMON_ADDRH_E3_OFFSET,0 );WREG32 (base_reg + mmBMON_REDUCTION_OFFSET,0 );WREG32 (base_reg + mmBMON_STM_TRC_OFFSET,0x7 | (0xA <<8 )); -WREG32 (base_reg + mmBMON_CR_OFFSET,0x77 |0xf <<24 ); +WREG32 (base_reg + mmBMON_CR_OFFSET,0x41 ); }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 275/529 scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <[email protected]>
[ Upstream commit 4be7599d6b27bade41bfccca42901b917c01c30c ]
Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in _transport_convert_phy_link_rate(). This maps the new 22.5 Gbps negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link speeds.
Message-Id: <[email protected]>
--- drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/mpt3sas/mpt3sas_transport.c +3 -0
@@ -166,6 +166,9 @@ _transport_convert_phy_link_rate(u8 link_rate)case MPI25_SAS_NEG_LINK_RATE_12_0 : rc =SAS_LINK_RATE_12_0_GBPS ;break ; +case MPI26_SAS_NEG_LINK_RATE_22_5 : + rc =SAS_LINK_RATE_22_5_GBPS ; +break ;case MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED : rc =SAS_PHY_DISABLED ;break ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 276/529 accel/habanalabs: return ENOMEM if less than requested pages were pinned
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomer Tayar <[email protected]>
[ Upstream commit 9f5067531c9b79318c4e48a933cb2694f53f3de2 ]
EFAULT is currently returned if less than requested user pages are pinned. This value means a "bad address" which might be confusing to the user, as the address of the given user memory is not necessarily "bad".
Modify the return value to ENOMEM, as "out of memory" is more suitable in this case.
--- drivers/accel/habanalabs/common/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accel/habanalabs/common/memory.c +1 -1
@@ -2323,7 +2323,7 @@ static int get_user_memory(struct hl_device *hdev, u64 addr, u64 size,if (rc <0 ) goto destroy_pages; npages = rc; - rc = -EFAULT ; + rc = -ENOMEM ; goto put_pages; } userptr->npages = npages;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 277/529 accel/habanalabs/gaudi2: read preboot status after recovering from dirty state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Sinyuk <[email protected]>
[ Upstream commit a0d866bab184161ba155b352650083bf6695e50e ]
Dirty state can occur when the host VM undergoes a reset while the device does not. In such a case, the driver must reset the device before it can be used again. As part of this reset, the device capabilities are zeroed. Therefore, the driver must read the Preboot status again to learn the Preboot state, capabilities, and security configuration.
--- drivers/accel/habanalabs/gaudi2/gaudi2.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/accel/habanalabs/gaudi2/gaudi2.c +7 -1
@@ -2985,7 +2985,6 @@ static int gaudi2_early_init(struct hl_device *hdev) rc =hl_fw_read_preboot_status (hdev);if (rc) {if (hdev->reset_on_preboot_fail) -/* we are already on failure flow, so don't check if hw_fini fails. */ hdev->asic_funcs->hw_fini (hdev, true, false); goto pci_fini; }
@@ -2997,6 +2996,13 @@ static int gaudi2_early_init(struct hl_device *hdev)dev_err (hdev->dev,"failed to reset HW in dirty state (%d)\n" , rc); goto pci_fini; } + + rc =hl_fw_read_preboot_status (hdev); +if (rc) { +if (hdev->reset_on_preboot_fail) + hdev->asic_funcs->hw_fini (hdev, true, false); + goto pci_fini; + } }return 0 ;
Signature · 1 line
2.51.0
Re: [PATCH 6.6 277/529] accel/habanalabs/gaudi2: read preboot status after recovering from dirty state
Quoted 14 lines · Greg Kroah-Hartman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Sinyuk <[email protected]>
[ Upstream commit
a0d866bab184161ba155b352650083bf6695e50e]Dirty state can occur when the host VM undergoes a reset while the device does not. In such a case, the driver must reset the device before it can be used again. As part of this reset, the device capabilities are zeroed. Therefore, the driver must read the Preboot status again to learn the Preboot state, capabilities, and security configuration.
Quoted 4 lines
Signed-off-by Konstantin Sinyuk <[email protected]>Reviewed-by Koby Elbaz <[email protected]>Signed-off-by Koby Elbaz <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Looks good for 6.6-stable.
Thanks,
Konstantin.
Greg Kroah-Hartman
maintainerPATCH 278/529 accel/habanalabs: support mapping cb with vmalloc-backed coherent memory
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moti Haimovski <[email protected]>
[ Upstream commit 513024d5a0e34fd34247043f1876b6138ca52847 ]
When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return addresses from the vmalloc range. If such an address is mapped without VM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the VM_PFNMAP restriction.
Fix this by checking for vmalloc addresses and setting VM_MIXEDMAP in the VMA before mapping. This ensures safe mapping and avoids kernel crashes. The memory is still driver-allocated and cannot be accessed directly by userspace.
--- drivers/accel/habanalabs/gaudi/gaudi.c | 19 +++++++++++++++++++ drivers/accel/habanalabs/gaudi2/gaudi2.c | 7 +++++++ 2 files changed, 26 insertions(+)
drivers/accel/habanalabs/gaudi/gaudi.c +19 -0
@@ -4173,10 +4173,29 @@ static int gaudi_mmap(struct hl_device *hdev, struct vm_area_struct *vma,vm_flags_set (vma,VM_IO |VM_PFNMAP |VM_DONTEXPAND |VM_DONTDUMP |VM_DONTCOPY |VM_NORESERVE ); +#ifdef _HAS_DMA_MMAP_COHERENT +/* +* If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP +* so vm_insert_page() can handle it safely. Without this, the kernel +* may BUG_ON due to VM_PFNMAP. +*/ +if (is_vmalloc_addr (cpu_addr)) +vm_flags_set (vma,VM_MIXEDMAP ); + rc =dma_mmap_coherent (hdev->dev, vma, cpu_addr, (dma_addr -HOST_PHYS_BASE ), size);if (rc)dev_err (hdev->dev,"dma_mmap_coherent error %d" , rc); +#else + + rc =remap_pfn_range (vma, vma->vm_start, +virt_to_phys (cpu_addr) >>PAGE_SHIFT , + size, vma->vm_page_prot); +if (rc) +dev_err (hdev->dev,"remap_pfn_range error %d" , rc); + +#endif +return rc; }
drivers/accel/habanalabs/gaudi2/gaudi2.c +7 -0
@@ -6345,6 +6345,13 @@ static int gaudi2_mmap(struct hl_device *hdev, struct vm_area_struct *vma, VM_DONTCOPY | VM_NORESERVE);#ifdef _HAS_DMA_MMAP_COHERENT +/* +* If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP +* so vm_insert_page() can handle it safely. Without this, the kernel +* may BUG_ON due to VM_PFNMAP. +*/ +if (is_vmalloc_addr (cpu_addr)) +vm_flags_set (vma,VM_MIXEDMAP ); rc =dma_mmap_coherent (hdev->dev, vma, cpu_addr, dma_addr, size);if (rc)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 279/529 fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: chuguangqing <[email protected]>
[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
--- fs/ext4/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/xattr.c +1 -1
@@ -1552,7 +1552,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,WARN_ON_ONCE (ext4_handle_valid (journal_current_handle ()) && !(current->flags &PF_MEMALLOC_NOFS )); - ea_data =kvmalloc (value_len,GFP_KERNEL ); + ea_data =kvmalloc (value_len,GFP_NOFS );if (!ea_data) {mb_cache_entry_put (ea_inode_cache, ce);return NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 280/529 ext4: increase IO priority of fastcommit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <[email protected]>
[ Upstream commit 46e75c56dfeafb6756773b71cabe187a6886859a ]
The following code paths may result in high latency or even task hangs:
1. fastcommit io is throttled by wbt.
2. jbd2_fc_wait_bufs() might wait for a long time whileJBD2_FAST_COMMIT_ONGOING is set in journal->flags, and then jbd2_journal_commit_transaction() waits for the JBD2_FAST_COMMIT_ONGOING bit for a long time while holding the write lock of j_state_lock.
3. start_this_handle() waits for read lock of j_state_lock which
results in high latency or task hang.
Given the fact that ext4_fc_commit() already modifies the current process' IO priority to match that of the jbd2 thread, it should be reasonable to match jbd2's IO submission flags as well.
Message-ID: <[email protected]>
--- fs/ext4/fast_commit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/fast_commit.c +1 -1
@@ -675,7 +675,7 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t starstatic void ext4_fc_submit_bh (struct super_block *sb,bool is_tail) { -blk_opf_t write_flags =REQ_SYNC ; +blk_opf_t write_flags =JBD2_JOURNAL_REQ_FLAGS ;struct buffer_head *bh =EXT4_SB (sb)->s_fc_bh;/* Add REQ_FUA | REQ_PREFLUSH only its tail */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 281/529 amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifan Zhang <[email protected]>
[ Upstream commit 99d7181bca34e96fbf61bdb6844918bdd4df2814 ]
There is race in amdgpu_amdkfd_device_fini_sw and interrupt. if amdgpu_amdkfd_device_fini_sw run in b/w kfd_cleanup_nodes and
kfree(kfd), and KGD interrupt generated.
kernel panic log:
BUG: kernel NULL pointer dereference, address: 0000000000000098
amdgpu 0000:c8:00.0: amdgpu: Requesting 4 partitions through PSP
PGD d78c68067 P4D d78c68067
kfd kfd: amdgpu: Allocated 3969056 bytes on gart
PUD 1465b8067 PMD @
Oops: @002 [#1] SMP NOPTI
kfd kfd: amdgpu: Total number of KFD nodes to be created: 4
CPU: 115 PID: @ Comm: swapper/115 Kdump: loaded Tainted: G S W OE K RIP: 0010:_raw_spin_lock_irqsave+0x12/0x40 Code: 89 e@ 41 5c c3 cc cc cc cc 66 66 2e Of 1f 84 00 00 00 00 00 OF 1f 40 00 Of 1f 44% 00 00 41 54 9c 41 5c fa 31 cO ba 01 00 00 00 <fO> OF b1 17 75 Ba 4c 89 e@ 41 Sc
89 c6 e8 07 38 5d
RSP: 0018: ffffc90@1a6b0e28 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000018 0000000000000001 RSI: ffff8883bb623e00 RDI: 0000000000000098 ffff8883bb000000 RO8: ffff888100055020 ROO: ffff888100055020 0000000000000000 R11: 0000000000000000 R12: 0900000000000002 ffff888F2b97da0@ R14: @000000000000098 R15: ffff8883babdfo00
CS: 010 DS: 0000 ES: 0000 CRO: 0000000080050033
CR2: 0000000000000098 CR3: 0000000e7cae2006 CR4: 0000000002770ce0 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 0000000000000000 DR6: 00000000fffeO7FO DR7: 0000000000000400
PKRU: 55555554
Call Trace: <IRQ>
kgd2kfd_interrupt+@x6b/0x1f@ [amdgpu]
? amdgpu_fence_process+0xa4/0x150 [amdgpu]
kfd kfd: amdgpu: Node: 0, interrupt_bitmap: 3 YcpxFl Rant tErace
amdgpu_irq_dispatch+0x165/0x210 [amdgpu] amdgpu_ih_process+0x80/0x100 [amdgpu]
amdgpu: Virtual CRAT table created for GPU
amdgpu_irq_handler+0x1f/@x60 [amdgpu]
__handle_irq_event_percpu+0x3d/0x170
amdgpu: Topology: Add dGPU node [0x74a2:0x1002]
handle_irq_event+0x5a/@xcO
handle_edge_irq+0x93/0x240
kfd kfd: amdgpu: KFD node 1 partition @ size 49148M
asm_call_irq_on_stack+0xf/@x20
</IRQ> common_interrupt+0xb3/0x130 asm_common_interrupt+0x1le/0x40
5.10.134-010.a1i5000.a18.x86_64 #1
--- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_device.c +9 -1
@@ -1017,7 +1017,15 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry) }for (i =0 ; i < kfd->num_nodes; i++) { - node = kfd->nodes[i]; +/* Race if another thread in b/w +* kfd_cleanup_nodes and kfree(kfd), +* when kfd->nodes[i] = NULL +*/ +if (kfd->nodes[i]) + node = kfd->nodes[i]; +else +return ; +spin_lock_irqsave (&node->interrupt_lock, flags); if (node->interrupts_active
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 282/529 ASoC: stm32: sai: manage context in set_sysclk callback
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Moysan <[email protected]>
[ Upstream commit 27fa1a8b2803dfd88c39f03b0969c55f667cdc43 ]
The mclk direction now needs to be specified in endpoint node with "system-clock-direction-out" property. However some calls to the set_sysclk callback, related to CPU DAI clock, result in unbalanced calls to clock API.
The set_sysclk callback in STM32 SAI driver is intended only for mclk management. So it is relevant to ensure that calls to set_sysclk are related to mclk only.
Since the master clock is handled only at runtime, skip the calls to set_sysclk in the initialization phase.
--- sound/soc/stm/stm32_sai_sub.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/stm/stm32_sai_sub.c +8 -0
@@ -551,6 +551,14 @@ static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai,struct stm32_sai_sub_data *sai =snd_soc_dai_get_drvdata (cpu_dai);int ret; +/* +* The mclk rate is determined at runtime from the audio stream rate. +* Skip calls to the set_sysclk callback that are not relevant during the +* initialization phase. +*/ +if (!snd_soc_card_is_instantiated (cpu_dai->component->card)) +return 0 ; +if (dir ==SND_SOC_CLOCK_OUT && sai->sai_mclk) { ret = stm32_sai_sub_reg_up(sai, STM_SAI_CR1_REGX, SAI_XCR1_NODIV,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 283/529 ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Primoz Fiser <[email protected]>
[ Upstream commit 733a763dd8b3ac2858dd238a91bb3a2fdff4739e ]
The problem of having class-D initialization sequence in probe using regmap_register_patch() is that it will do hardware register writes immediately after being called as it bypasses regcache. Afterwards, in aic3x_init() we also perform codec soft reset, rendering class-D init sequence pointless. This issue is even more apparent when using reset GPIO line, since in that case class-D amplifier initialization fails with "Failed to init class D: -5" message as codec is already held in reset state after requesting the reset GPIO and hence hardware I/O fails with -EIO errno.
Thus move class-D amplifier initialization sequence from probe function to aic3x_set_power() just before the usual regcache sync. Use bypassed regmap_multi_reg_write_bypassed() function to make sure, class-D init sequence is performed in proper order as described in the datasheet.
--- sound/soc/codecs/tlv320aic3x.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-)
sound/soc/codecs/tlv320aic3x.c +14 -18
@@ -121,6 +121,16 @@ static const struct reg_default aic3x_reg[] = { { 108, 0x00 }, { 109, 0x00 }, }; +static const struct reg_sequence aic3007_class_d[] = { +/* Class-D speaker driver init; datasheet p. 46 */ + {AIC3X_PAGE_SELECT ,0x0D }, + {0xD ,0x0D }, + {0x8 ,0x5C }, + {0x8 ,0x5D }, + {0x8 ,0x5C }, + {AIC3X_PAGE_SELECT ,0x00 }, +}; +static bool aic3x_volatile_reg (struct device *dev,unsigned int reg) {switch (reg) {
@@ -1393,6 +1403,10 @@ static int aic3x_set_power(struct snd_soc_component *component, int power)gpiod_set_value (aic3x->gpio_reset,0 ); } +if (aic3x->model ==AIC3X_MODEL_3007 ) +regmap_multi_reg_write_bypassed (aic3x->regmap, aic3007_class_d, +ARRAY_SIZE (aic3007_class_d)); +/* Sync reg_cache with the hardware */ regcache_cache_only (aic3x->regmap, false);regcache_sync (aic3x->regmap);
@@ -1723,17 +1737,6 @@ static void aic3x_configure_ocmv(struct device *dev, struct aic3x_priv *aic3x) } } - -static const struct reg_sequence aic3007_class_d[] = { -/* Class-D speaker driver init; datasheet p. 46 */ - {AIC3X_PAGE_SELECT ,0x0D }, - {0xD ,0x0D }, - {0x8 ,0x5C }, - {0x8 ,0x5D }, - {0x8 ,0x5C }, - {AIC3X_PAGE_SELECT ,0x00 }, -}; -int aic3x_probe (struct device *dev,struct regmap *regmap,kernel_ulong_t driver_data) {struct aic3x_priv *aic3x;
@@ -1825,13 +1828,6 @@ int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driveraic3x_configure_ocmv (dev, aic3x); -if (aic3x->model ==AIC3X_MODEL_3007 ) { - ret =regmap_register_patch (aic3x->regmap, aic3007_class_d, -ARRAY_SIZE (aic3007_class_d)); -if (ret !=0 ) -dev_err (dev,"Failed to init class D: %d\n" , ret); - } - ret =devm_snd_soc_register_component (dev, &soc_component_dev_aic3x, &aic3x_dai,1 );if (ret)return ret;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 284/529 net/mlx5e: Dont query FEC statistics when FEC is disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <[email protected]>
[ Upstream commit 6b81b8a0b1978284e007566d7a1607b47f92209f ]
Update mlx5e_stats_fec_get() to check the active FEC mode and skip statistics collection when FEC is disabled.
--- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +6 -6
@@ -1339,16 +1339,13 @@ static void fec_set_rs_stats(struct ethtool_fec_stats *fec_stats, u32 *ppcnt) }static void fec_set_block_stats (struct mlx5e_priv *priv, +int mode,struct ethtool_fec_stats *fec_stats) {struct mlx5_core_dev *mdev = priv->mdev;u32 out[MLX5_ST_SZ_DW (ppcnt_reg)] = {};u32 in[MLX5_ST_SZ_DW (ppcnt_reg)] = {};int sz =MLX5_ST_SZ_BYTES (ppcnt_reg); -int mode =fec_active_mode (mdev); - -if (mode ==MLX5E_FEC_NOFEC ) -return ;MLX5_SET (ppcnt_reg, in, local_port,1 );MLX5_SET (ppcnt_reg, in, grp,MLX5_PHYSICAL_LAYER_COUNTERS_GROUP );
@@ -1389,11 +1386,14 @@ static void fec_set_corrected_bits_total(struct mlx5e_priv *priv,void mlx5e_stats_fec_get (struct mlx5e_priv *priv,struct ethtool_fec_stats *fec_stats) { -if (!MLX5_CAP_PCAM_FEATURE (priv->mdev, ppcnt_statistical_group)) +int mode =fec_active_mode (priv->mdev); + +if (mode ==MLX5E_FEC_NOFEC || + !MLX5_CAP_PCAM_FEATURE (priv->mdev, ppcnt_statistical_group))return ;fec_set_corrected_bits_total (priv, fec_stats); -fec_set_block_stats (priv, fec_stats); +fec_set_block_stats (priv, mode, fec_stats); }#define PPORT_ETH_EXT_OFF (c) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 285/529 net: macb: avoid dealing with endianness in macb_set_hwaddr()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <[email protected]>
[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
bp->dev->dev_addr is of type unsigned char *. Casting it to a u32 pointer and dereferencing implies dealing manually with endianness, which is error-prone.
Replace by calls to get_unaligned_le32|le16() helpers.
This was found using sparse:
⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
warning: incorrect type in assignment (different base types)
expected unsigned int [usertype] bottom
got restricted __le32 [usertype]
warning: incorrect type in assignment (different base types)
expected unsigned short [usertype] top
got restricted __le16 [usertype]
...
--- drivers/net/ethernet/cadence/macb_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +2 -2
@@ -281,9 +281,9 @@ static void macb_set_hwaddr(struct macb *bp)u32 bottom;u16 top; - bottom =cpu_to_le32 (*((u32 *)bp->dev->dev_addr)); + bottom =get_unaligned_le32 (bp->dev->dev_addr);macb_or_gem_writel (bp,SA1B , bottom); - top =cpu_to_le16 (*((u16 *)(bp->dev->dev_addr +4 ))); + top =get_unaligned_le16 (bp->dev->dev_addr +4 );macb_or_gem_writel (bp,SA1T , top);if (gem_has_ptp (bp)) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 286/529 Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadiusz Bokowy <[email protected]>
[ Upstream commit 7722d6fb54e428a8f657fccf422095a8d7e2d72c ]
Some Barrot based USB Bluetooth dongles erroneously send one extra random byte for the HCI_OP_READ_LOCAL_EXT_FEATURES command. The consequence of that is that the next HCI transfer is misaligned by one byte causing undefined behavior. In most cases the response event for the next command fails with random error code.
Since the HCI_OP_READ_LOCAL_EXT_FEATURES command is used during HCI controller initialization, the initialization fails rendering the USB dongle not usable.
Quoted 6 lines
[59.464099] usb 1-1.3: new full-speed USB device number 11 using xhci_hcd [59.561617] usb 1-1.3: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91 [59.561642] usb 1-1.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0 [59.561656] usb 1-1.3: Product: UGREEN BT6.0 Adapter [61.720116] Bluetooth: hci1: command 0x1005 tx timeout [61.720167] Bluetooth: hci1: Opcode 0x1005 failed: -110
This patch was tested with the 33fa:0012 device. The info from the /sys/kernel/debug/usb/devices is shown below:
T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 12 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=33fa ProdID=0012 Rev=88.91 S: Product=UGREEN BT6.0 Adapter C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Now the device is initialized properly:
Quoted 7 lines
[43.329852] usb 1-1.4: new full-speed USB device number 4 using dwc_otg [43.446790] usb 1-1.4: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91 [43.446813] usb 1-1.4: New USB device strings: Mfr=0, Product=2, SerialNumber=0 [43.446821] usb 1-1.4: Product: UGREEN BT6.0 Adapter [43.582024] Bluetooth: hci1: Unexpected continuation: 1 bytes [43.703025] Bluetooth: hci1: Unexpected continuation: 1 bytes [43.750141] Bluetooth: MGMT ver 1.23
--- drivers/bluetooth/btusb.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/bluetooth/btusb.c +17 -0
@@ -65,6 +65,7 @@ static struct usb_driver btusb_driver;#define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)#define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26)#define BTUSB_ACTIONS_SEMI BIT(27) +#define BTUSB_BARROT BIT(28)static const struct usb_device_id btusb_table[] = {/* Generic Bluetooth USB device */
@@ -770,6 +771,10 @@ static const struct usb_device_id quirks_table[] = { { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + /* Barrot Technology Bluetooth devices */ + { USB_DEVICE(0x33fa, 0x0010), .driver_info = BTUSB_BARROT }, + { USB_DEVICE(0x33fa, 0x0012), .driver_info = BTUSB_BARROT }, + /* Actions Semiconductor ATS2851 based devices */ { USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
@@ -1167,6 +1172,18 @@ static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count) }if (!hci_skb_expect (skb)) { +/* Each chunk should correspond to at least 1 or more +* events so if there are still bytes left that doesn't +* constitute a new event this is likely a bug in the +* controller. +*/ +if (count && count <HCI_EVENT_HDR_SIZE ) { +bt_dev_warn (data->hdev, +"Unexpected continuation: %d bytes" , + count); + count =0 ; + } +/* Complete frame */ btusb_recv_event (data, skb); skb =NULL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 287/529 Bluetooth: SCO: Fix UAF on sco_conn_free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline] BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352 CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted 6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci13 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x191/0x550 mm/kasan/report.c:482 kasan_report+0xc4/0x100 mm/kasan/report.c:595 sco_conn_free net/bluetooth/sco.c:87 [inline] kref_put include/linux/kref.h:65 [inline] sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441 hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline] hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313 hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121 hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147 hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689 hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319 worker_thread+0xbee/0x1200 kernel/workqueue.c:3400 kthread+0x3c7/0x870 kernel/kthread.c:463 ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 31370: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4382 [inline] __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xae/0x220 net/core/sock.c:2239 sk_alloc+0x34/0x5a0 net/core/sock.c:2295 bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151 sco_sock_alloc net/bluetooth/sco.c:562 [inline] sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593 bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135 __sock_create+0x3ad/0x780 net/socket.c:1589 sock_create net/socket.c:1647 [inline] __sys_socket_create net/socket.c:1684 [inline] __sys_socket+0xd5/0x330 net/socket.c:1731 __do_sys_socket net/socket.c:1745 [inline] __se_sys_socket net/socket.c:1743 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1743 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 31374: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2428 [inline] slab_free mm/slub.c:4701 [inline] kfree+0x199/0x3b0 mm/slub.c:4900 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x4aa/0x630 net/core/sock.c:2373 sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x230 net/socket.c:1439 __fput+0x3d1/0x9e0 fs/file_table.c:468 task_work_run+0x206/0x2a0 kernel/task_work.c:227 get_signal+0x1201/0x1410 kernel/signal.c:2807 arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f
--- net/bluetooth/sco.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/bluetooth/sco.c +7 -0
@@ -433,6 +433,13 @@ static void sco_sock_kill(struct sock *sk)BT_DBG ("sk %p state %d" , sk, sk->sk_state); +/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ +if (sco_pi (sk)->conn) { +sco_conn_lock (sco_pi (sk)->conn); +sco_pi (sk)->conn->sk =NULL ; +sco_conn_unlock (sco_pi (sk)->conn); + } +/* Kill poor orphan */ bt_sock_unlink (&sco_sk_list, sk);sock_set_flag (sk,SOCK_DEAD );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 288/529 Bluetooth: bcsp: receive data only if registered
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Pravdin <[email protected]>
[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack trace:
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
Call Trace:
<TASK>
hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7fTo prevent this, ensure that the HCI_UART_REGISTERED flag is set before processing received data. If the protocol is not registered, return -EUNATCH.
--- drivers/bluetooth/hci_bcsp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/hci_bcsp.c +3 -0
@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)struct bcsp_struct *bcsp = hu->priv;const unsigned char *ptr; +if (!test_bit (HCI_UART_REGISTERED , &hu->flags)) +return -EUNATCH ; +BT_DBG ("hu %p count %d rx_state %d rx_count %ld" , hu, count, bcsp->rx_state, bcsp->rx_count);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 289/529 ALSA: usb-audio: add mono main switch to Presonus S1824c
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <[email protected]>
[ Upstream commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c ]
The 1824c does not have the A/B switch that the 1810c has, but instead it has a mono main switch that sums the two main output channels to mono.
--- sound/usb/mixer_s1810c.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-)
sound/usb/mixer_s1810c.c +23 -3
@@ -93,6 +93,7 @@ struct s1810c_ctl_packet {#define SC1810C_CTL_LINE_SW 0#define SC1810C_CTL_MUTE_SW 1 +#define SC1824C_CTL_MONO_SW 2#define SC1810C_CTL_AB_SW 3#define SC1810C_CTL_48V_SW 4
@@ -123,6 +124,7 @@ struct s1810c_state_packet {#define SC1810C_STATE_48V_SW 58#define SC1810C_STATE_LINE_SW 59#define SC1810C_STATE_MUTE_SW 60 +#define SC1824C_STATE_MONO_SW 61#define SC1810C_STATE_AB_SW 62struct s1810_mixer_state {
@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = { .private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8) }; +static const struct snd_kcontrol_new snd_s1824c_mono_sw = { + .iface =SNDRV_CTL_ELEM_IFACE_MIXER , + .name ="Mono Main Out Switch" , + .info = snd_ctl_boolean_mono_info, + .get = snd_s1810c_switch_get, + .put = snd_s1810c_switch_set, + .private_value = (SC1824C_STATE_MONO_SW |SC1824C_CTL_MONO_SW <<8 ) +}; +static const struct snd_kcontrol_new snd_s1810c_48v_sw = { .iface =SNDRV_CTL_ELEM_IFACE_MIXER , .name ="48V Phantom Power On Mic Inputs Switch" ,
@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer)if (ret <0 )return ret; - ret =snd_s1810c_switch_init (mixer, &snd_s1810c_ab_sw); -if (ret <0 ) -return ret; +// The 1824c has a Mono Main switch instead of a +// A/B select switch. +if (mixer->chip->usb_id ==USB_ID (0x194f ,0x010d )) { + ret =snd_s1810c_switch_init (mixer, &snd_s1824c_mono_sw); +if (ret <0 ) +return ret; + }else if (mixer->chip->usb_id ==USB_ID (0x194f ,0x010c )) { + ret =snd_s1810c_switch_init (mixer, &snd_s1810c_ab_sw); +if (ret <0 ) +return ret; + } +return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 290/529 exfat: limit log print for IO error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <[email protected]>
[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
For exFAT filesystems with 4MB read_ahead_size, removing the storage device when the read operation is in progress, which cause the last read syscall spent 150s [1]. The main reason is that exFAT generates excessive log messages [2].
After applying this patch, approximately 300,000 lines of log messages were suppressed, and the delay of the last read() syscall was reduced to about 4 seconds.
[1]:write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120> read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032> write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>read(4, 0x7fccf28ae000, 131072) = -1 EIO (Input/output error) <150.186215>
[2]:
[ 333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) [ 333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) [ 333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
--- fs/exfat/fatent.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
fs/exfat/fatent.c +6 -5
@@ -89,35 +89,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,int err;if (!is_valid_cluster (sbi, loc)) { -exfat_fs_error (sb,"invalid access to FAT (entry 0x%08x)" , +exfat_fs_error_ratelimit (sb, +"invalid access to FAT (entry 0x%08x)" , loc);return -EIO ; } err =__exfat_ent_get (sb, loc, content);if (err) { -exfat_fs_error (sb, +exfat_fs_error_ratelimit (sb,"failed to access to FAT (entry 0x%08x, err:%d)" , loc, err);return err; }if (*content ==EXFAT_FREE_CLUSTER ) { -exfat_fs_error (sb, +exfat_fs_error_ratelimit (sb,"invalid access to FAT free cluster (entry 0x%08x)" , loc);return -EIO ; }if (*content ==EXFAT_BAD_CLUSTER ) { -exfat_fs_error (sb, +exfat_fs_error_ratelimit (sb,"invalid access to FAT bad cluster (entry 0x%08x)" , loc);return -EIO ; }if (*content !=EXFAT_EOF_CLUSTER && !is_valid_cluster (sbi, *content)) { -exfat_fs_error (sb, +exfat_fs_error_ratelimit (sb,"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)" , loc, *content);return -EIO ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 291/529 6pack: drop redundant locking and refcounting
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingfang Deng <[email protected]>
[ Upstream commit 38b04ed7072e54086102eae2d05d03ffcdb4b695 ]
The TTY layer already serializes line discipline operations with tty->ldisc_sem, so the extra disc_data_lock and refcnt in 6pack are unnecessary.
Removing them simplifies the code and also resolves a lockdep warning reported by syzbot. The warning did not indicate a real deadlock, since the write-side lock was only taken in process context with hardirqs disabled.
--- drivers/net/hamradio/6pack.c | 57 ++++-------------------------------- 1 file changed, 5 insertions(+), 52 deletions(-)
drivers/net/hamradio/6pack.c +5 -52
@@ -121,8 +121,6 @@ struct sixpack {struct timer_list tx_t;struct timer_list resync_t; -refcount_t refcnt; -struct completion dead;spinlock_t lock; };
@@ -359,42 +357,13 @@ static void sp_bump(struct sixpack *sp, char cmd)/* ----------------------------------------------------------------------- */ -/* -* We have a potential race on dereferencing tty->disc_data, because the tty -* layer provides no locking at all - thus one cpu could be running -* sixpack_receive_buf while another calls sixpack_close, which zeroes -* tty->disc_data and frees the memory that sixpack_receive_buf is using. The -* best way to fix this is to use a rwlock in the tty struct, but for now we -* use a single global rwlock for all ttys in ppp line discipline. -*/ -static DEFINE_RWLOCK (disc_data_lock); - -static struct sixpack *sp_get (struct tty_struct *tty) -{ -struct sixpack *sp; - -read_lock (&disc_data_lock); - sp = tty->disc_data; -if (sp) -refcount_inc (&sp->refcnt); -read_unlock (&disc_data_lock); - -return sp; -} - -static void sp_put (struct sixpack *sp) -{ -if (refcount_dec_and_test (&sp->refcnt)) -complete (&sp->dead); -} -/* * Called by the TTY driver when there's room for more data. If we have * more packets to send, we send them here. */ static void sixpack_write_wakeup (struct tty_struct *tty) { -struct sixpack *sp =sp_get (tty); +struct sixpack *sp = tty->disc_data;int actual;if (!sp)
@@ -406,7 +375,7 @@ static void sixpack_write_wakeup(struct tty_struct *tty)clear_bit (TTY_DO_WRITE_WAKEUP , &tty->flags); sp->tx_enable =0 ;netif_wake_queue (sp->dev); - goto out; +return ; }if (sp->tx_enable) {
@@ -414,9 +383,6 @@ static void sixpack_write_wakeup(struct tty_struct *tty) sp->xleft -= actual; sp->xhead += actual; } - -out: -sp_put (sp); }/* ----------------------------------------------------------------------- */
@@ -436,7 +402,7 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,if (!count)return ; - sp =sp_get (tty); + sp = tty->disc_data;if (!sp)return ;
@@ -452,7 +418,6 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp, }sixpack_decode (sp, cp, count1); -sp_put (sp);tty_unthrottle (tty); }
@@ -567,8 +532,6 @@ static int sixpack_open(struct tty_struct *tty)spin_lock_init (&sp->lock);spin_lock_init (&sp->rxlock); -refcount_set (&sp->refcnt,1 ); -init_completion (&sp->dead);/* !!! length of the buffers. MTU is IP MTU, not PACLEN! */
@@ -650,19 +613,11 @@ static void sixpack_close(struct tty_struct *tty) {struct sixpack *sp; -write_lock_irq (&disc_data_lock); sp = tty->disc_data; - tty->disc_data =NULL ; -write_unlock_irq (&disc_data_lock);if (!sp)return ; -/* -* We have now ensured that nobody can start using ap from now on, but -* we have to wait for all existing users to finish. -*/ -if (!refcount_dec_and_test (&sp->refcnt)) -wait_for_completion (&sp->dead); + tty->disc_data =NULL ;/* We must stop the queue to avoid potentially scribbling * on the free buffers. The sp->dead completion is not sufficient
@@ -686,7 +641,7 @@ static void sixpack_close(struct tty_struct *tty)static int sixpack_ioctl (struct tty_struct *tty,unsigned int cmd,unsigned long arg) { -struct sixpack *sp =sp_get (tty); +struct sixpack *sp = tty->disc_data;struct net_device *dev;unsigned int tmp, err;
@@ -738,8 +693,6 @@ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd, err =tty_mode_ioctl (tty, cmd, arg); } -sp_put (sp); -return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 292/529 page_pool: Clamp pool size to max 16K pages
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
page_pool_init() returns E2BIG when the page_pool size goes above 32K pages. As some drivers are configuring the page_pool size according to the MTU and ring size, there are cases where this limit is exceeded and the queue creation fails.
The page_pool size doesn't have to cover a full queue, especially for larger ring size. So clamp the size instead of returning an error. Do this in the core to avoid having each driver do the clamping.
The current limit was deemed to high [1] so it was reduced to 16K to avoid page waste.
[1] https://lore.kernel.org/all/[email protected]/
--- net/core/page_pool.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/core/page_pool.c +1 -5
@@ -180,11 +180,7 @@ static int page_pool_init(struct page_pool *pool,return -EINVAL ;if (pool->p.pool_size) - ring_qsize = pool->p.pool_size; - -/* Sanity limit mem that can be pinned down */ -if (ring_qsize >32768 ) -return -E2BIG ; + ring_qsize =min (pool->p.pool_size,16384 );/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL. * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 293/529 orangefs: fix xattr related buffer overflow...
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <[email protected]>
[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
Willy Tarreau <[email protected]> forwarded me a message from Disclosure <[email protected]> with the following warning:
Quoted 5 lines
The helper
xattr_key()uses the pointer variable in the loop condition rather than dereferencing it. Askeyis incremented, it remains non-NULL (until it runs into unmapped memory), so the loop does not terminate on valid C strings and will walk memory indefinitely, consuming CPU or hanging the thread.
I easily reproduced this with setfattr and getfattr, causing a kernel oops, hung user processes and corrupted orangefs files. Disclosure sent along a diff (not a patch) with a suggested fix, which I based this patch on.
After xattr_key started working right, xfstest generic/069 exposed an xattr related memory leak that lead to OOM. xattr_key returns a hashed key. When adding xattrs to the orangefs xattr cache, orangefs used hash_add, a kernel hashing macro. hash_add also hashes the key using hash_log which resulted in additions to the xattr cache going to the wrong hash bucket. generic/069 tortures a single file and orangefs does a getattr for the xattr "security.capability" every time. Orangefs negative caches on xattrs which includes a kmalloc. Since adds to the xattr cache were going to the wrong bucket, every getattr for "security.capability" resulted in another kmalloc, none of which were ever freed.
I changed the two uses of hash_add to hlist_add_head instead and the memory leak ceased and generic/069 quit throwing furniture.
--- fs/orangefs/xattr.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/orangefs/xattr.c +7 -5
@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)static unsigned int xattr_key (const char *key) {unsigned int i =0 ; -while (key) +if (!key) +return 0 ; +while (*key) i += *key++;return i %16 ; }
@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name, cx->length =-1 ; cx->timeout = jiffies + orangefs_getattr_timeout_msecs*HZ /1000 ; -hash_add (orangefs_inode->xattr_cache, &cx->node, -xattr_key (cx->key)); +hlist_add_head ( &cx->node, + &orangefs_inode->xattr_cache[xattr_key (cx->key)]); } } goto out_release_op;
@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,memcpy (cx->val, buffer, length); cx->length = length; cx->timeout = jiffies +HZ ; -hash_add (orangefs_inode->xattr_cache, &cx->node, -xattr_key (cx->key)); +hlist_add_head (&cx->node, + &orangefs_inode->xattr_cache[xattr_key (cx->key)]); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 294/529 ftrace: Fix softlockup in ftrace_module_enable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Riabchun <[email protected]>
[ Upstream commit 4099b98203d6b33d990586542fa5beee408032a3 ]
A soft lockup was observed when loading amdgpu module.
If a module has a lot of tracable functions, multiple calls to kallsyms_lookup can spend too much time in RCU critical section and with disabled preemption, causing kernel panic. This is the same issue that was fixed in
commit d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY kernels") and commit 42ea22e754ba ("ftrace: Add cond_resched() to ftrace_graph_set_hash()").
Fix it the same way by adding cond_resched() in ftrace_module_enable.
--- kernel/trace/ftrace.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/ftrace.c +2 -0
@@ -6873,6 +6873,8 @@ void ftrace_module_enable(struct module *mod)if (!within_module (rec->ip, mod))break ; +cond_resched (); +/* Weak functions should still be ignored */ if (!test_for_valid_rec (rec)) {/* Clear all other flags. Should not be enabled anyway */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 295/529 ksmbd: use sock_create_kern interface to create kernel socket
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit 3677ca67b9791481af16d86e47c3c7d1f2442f95 ]
we should use sock_create_kern() if the socket resides in kernel space.
--- fs/smb/server/transport_tcp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/smb/server/transport_tcp.c +4 -3
@@ -476,12 +476,13 @@ static int create_socket(struct interface *iface)struct socket *ksmbd_socket;bool ipv4 = false; - ret =sock_create (PF_INET6 ,SOCK_STREAM ,IPPROTO_TCP , &ksmbd_socket); + ret =sock_create_kern (current->nsproxy->net_ns,PF_INET6 ,SOCK_STREAM , +IPPROTO_TCP , &ksmbd_socket);if (ret) {if (ret != -EAFNOSUPPORT )pr_err ("Can't create socket for ipv6, fallback to ipv4: %d\n" , ret); - ret =sock_create (PF_INET ,SOCK_STREAM ,IPPROTO_TCP , - &ksmbd_socket); + ret =sock_create_kern (current->nsproxy->net_ns,PF_INET , +SOCK_STREAM ,IPPROTO_TCP , &ksmbd_socket);if (ret) {pr_err ("Can't create socket for ipv4: %d\n" , ret); goto out_clear;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 296/529 smb: client: transport: avoid reconnects triggered by pending task work
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fiona Ebner <[email protected]>
[ Upstream commit 00be6f26a2a7c671f1402d74c4d3c30a5844660a ]
When io_uring is used in the same task as CIFS, there might be unnecessary reconnects, causing issues in user-space applications like QEMU with a log like:
Quoted 1 line
CIFS: VFS: \\10.10.100.81 Error -512 sending data on socket to server
Certain io_uring completions might be added to task_work with notify_method being TWA_SIGNAL and thus TIF_NOTIFY_SIGNAL is set for the task.
In __smb_send_rqst(), signals are masked before calling smb_send_kvec(), but the masking does not apply to TIF_NOTIFY_SIGNAL.
If sk_stream_wait_memory() is reached via sock_sendmsg() while TIF_NOTIFY_SIGNAL is set, signal_pending(current) will evaluate to true there, and -EINTR will be propagated all the way from sk_stream_wait_memory() to sock_sendmsg() in smb_send_kvec(). Afterwards, __smb_send_rqst() will see that not everything was written and reconnect.
--- fs/smb/client/transport.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/smb/client/transport.c +9 -1
@@ -22,6 +22,7 @@#include <linux/mempool.h> #include <linux/sched/signal.h> #include <linux/task_io_accounting_ops.h> +#include <linux/task_work.h> #include "cifspdu.h" #include "cifsglob.h" #include "cifsproto.h"
@@ -211,9 +212,16 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,* send a packet. In most cases if we fail to send * after the retries we will kill the socket and * reconnect which may clear the network problem. +* +* Even if regular signals are masked, EINTR might be +* propagated from sk_stream_wait_memory() to here when +* TIF_NOTIFY_SIGNAL is used for task work. For example, +* certain io_uring completions will use that. Treat +* having EINTR with pending task work the same as EAGAIN +* to avoid unnecessary reconnects. */ rc =sock_sendmsg (ssocket, smb_msg); -if (rc == -EAGAIN ) { +if (rc == -EAGAIN ||unlikely (rc == -EINTR &&task_work_pending (current))) { retries++;if (retries >=14 || (!server->noblocksnd && (retries >2 ))) {
Signature · 1 line
2.51.0