6.18.2-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainerPATCH 258/614 perf tools: Fix missing feature check for inherit + SAMPLE_READ
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 367377f45c0b568882567f797b7b18b263505be7 ]
It should also have PERF_SAMPLE_TID to enable inherit and PERF_SAMPLE_READ on recent kernels. Not having _TID makes the feature check wrongly detect the inherit and _READ support.
It was reported that the following command failed due to the error in the missing feature check on Intel SPR machines.
$ perf record -e '{cpu/mem-loads-aux/S,cpu/mem-loads,ldlat=3/PS}' -- ls
Error:
Failure to open event 'cpu/mem-loads,ldlat=3/PS' on PMU 'cpu' which will be removed.
Invalid event (cpu/mem-loads,ldlat=3/PS) in per-thread mode, enable system wide with '-a'.--- tools/perf/util/evsel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/evsel.c +1 -1
@@ -2473,7 +2473,7 @@ static bool evsel__detect_missing_features(struct evsel *evsel, struct perf_cpu/* Please add new feature detection here. */ attr.inherit = true; - attr.sample_type =PERF_SAMPLE_READ ; + attr.sample_type =PERF_SAMPLE_READ |PERF_SAMPLE_TID ;if (has_attr_feature (&attr,/*flags=*/ 0 )) goto found; perf_missing_features.inherit_sample_read = true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 259/614 drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <[email protected]>
[ Upstream commit 527e132573dfa793818a536b18eec49598a6f6f5 ]
The TIDSS hardware does not have independent maximum or minimum pixel clock limits for each video port. Instead, these limits are determined by the SoC's clock architecture. Previously, this constraint was modeled using the 'max_pclk_khz' and 'min_pclk_khz' fields in 'dispc_features', but this approach is static and does not account for the dynamic behavior of PLLs.
This patch removes the 'max_pclk_khz' and 'min_pclk_khz' fields from 'dispc_features'. The correct way to check if a requested mode's pixel clock is supported is by using 'clk_round_rate()' in the 'mode_valid()' hook. If the best frequency match for the mode clock falls within the supported tolerance, it is approved. TIDSS supports a 5% pixel clock tolerance, which is now reflected in the validation logic.
This change allows existing DSS-compatible drivers to be reused across SoCs that only differ in their pixel clock characteristics. The validation uses 'clk_round_rate()' for each mode, which may introduce additional delay (about 3.5 ms for 30 modes), but this is generally negligible. Users desiring faster validation may bypass these calls selectively, for example, checking only the highest resolution mode, as shown here[1].
[1]: https://lore.kernel.org/all/[email protected]/
Stable-dep-of: 86db652fc22f ("drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook")
--- drivers/gpu/drm/tidss/tidss_dispc.c | 86 +++++++++++------------------ drivers/gpu/drm/tidss/tidss_dispc.h | 3 - 2 files changed, 31 insertions(+), 58 deletions(-)
drivers/gpu/drm/tidss/tidss_dispc.c +31 -55
@@ -57,12 +57,6 @@ static const u16 tidss_k2g_common_regs[DISPC_COMMON_REG_TABLE_LEN] = { };const struct dispc_features dispc_k2g_feats = { - .min_pclk_khz =4375 , - - .max_pclk_khz = { - [DISPC_VP_DPI ] =150000 , - }, -/* * XXX According TRM the RGB input buffer width up to 2560 should * work on 3 taps, but in practice it only works up to 1280.
@@ -145,11 +139,6 @@ static const u16 tidss_am65x_common_regs[DISPC_COMMON_REG_TABLE_LEN] = { };const struct dispc_features dispc_am65x_feats = { - .max_pclk_khz = { - [DISPC_VP_DPI ] =165000 , - [DISPC_VP_OLDI_AM65X ] =165000 , - }, - .scaling = { .in_width_max_5tap_rgb =1280 , .in_width_max_3tap_rgb =2560 ,
@@ -245,11 +234,6 @@ static const u16 tidss_j721e_common_regs[DISPC_COMMON_REG_TABLE_LEN] = { };const struct dispc_features dispc_j721e_feats = { - .max_pclk_khz = { - [DISPC_VP_DPI ] =170000 , - [DISPC_VP_INTERNAL ] =600000 , - }, - .scaling = { .in_width_max_5tap_rgb =2048 , .in_width_max_3tap_rgb =4096 ,
@@ -316,11 +300,6 @@ const struct dispc_features dispc_j721e_feats = { };const struct dispc_features dispc_am625_feats = { - .max_pclk_khz = { - [DISPC_VP_DPI ] =165000 , - [DISPC_VP_INTERNAL ] =170000 , - }, - .scaling = { .in_width_max_5tap_rgb =1280 , .in_width_max_3tap_rgb =2560 ,
@@ -377,15 +356,6 @@ const struct dispc_features dispc_am625_feats = { };const struct dispc_features dispc_am62a7_feats = { -/* -* if the code reaches dispc_mode_valid with VP1, -* it should return MODE_BAD. -*/ - .max_pclk_khz = { - [DISPC_VP_TIED_OFF ] =0 , - [DISPC_VP_DPI ] =165000 , - }, - .scaling = { .in_width_max_5tap_rgb =1280 , .in_width_max_3tap_rgb =2560 ,
@@ -442,10 +412,6 @@ const struct dispc_features dispc_am62a7_feats = { };const struct dispc_features dispc_am62l_feats = { - .max_pclk_khz = { - [DISPC_VP_DPI ] =165000 , - }, - .subrev =DISPC_AM62L , .common ="common" ,
@@ -1331,33 +1297,54 @@ static void dispc_vp_set_default_color(struct dispc_device *dispc, DISPC_OVR_DEFAULT_COLOR2, (v >> 32) & 0xffff); } +/* +* Calculate the percentage difference between the requested pixel clock rate +* and the effective rate resulting from calculating the clock divider value. +*/ +unsigned int dispc_pclk_diff (unsigned long rate,unsigned long real_rate) +{ +int r = rate /100 , rr = real_rate /100 ; + +return (unsigned int )(abs (((rr - r) *100 ) / r)); +} + +static int check_pixel_clock (struct dispc_device *dispc,u32 hw_videoport, +unsigned long clock) +{ +unsigned long round_clock; + + round_clock =clk_round_rate (dispc->vp_clk[hw_videoport], clock); +/* +* To keep the check consistent with dispc_vp_set_clk_rate(), we +* use the same 5% check here. +*/ +if (dispc_pclk_diff (clock, round_clock) >5 ) +return -EINVAL ; + +return 0 ; +} +enum drm_mode_status dispc_vp_mode_valid (struct dispc_device *dispc,u32 hw_videoport,const struct drm_display_mode *mode) {u32 hsw, hfp, hbp, vsw, vfp, vbp;enum dispc_vp_bus_type bus_type; -int max_pclk; bus_type = dispc->feat->vp_bus_type[hw_videoport]; - max_pclk = dispc->feat->max_pclk_khz[bus_type]; - -if (WARN_ON (max_pclk ==0 )) +if (WARN_ON (bus_type ==DISPC_VP_TIED_OFF ))return MODE_BAD ; -if (mode->clock < dispc->feat->min_pclk_khz) -return MODE_CLOCK_LOW ; - -if (mode->clock > max_pclk) -return MODE_CLOCK_HIGH ; -if (mode->hdisplay >4096 )return MODE_BAD ;if (mode->vdisplay >4096 )return MODE_BAD ; +if (check_pixel_clock (dispc, hw_videoport, mode->clock *1000 )) +return MODE_CLOCK_RANGE ; +/* TODO: add interlace support */ if (mode->flags &DRM_MODE_FLAG_INTERLACE )return MODE_NO_INTERLACE ;
@@ -1421,17 +1408,6 @@ void dispc_vp_disable_clk(struct dispc_device *dispc, u32 hw_videoport)clk_disable_unprepare (dispc->vp_clk[hw_videoport]); } -/* -* Calculate the percentage difference between the requested pixel clock rate -* and the effective rate resulting from calculating the clock divider value. -*/ -unsigned int dispc_pclk_diff (unsigned long rate,unsigned long real_rate) -{ -int r = rate /100 , rr = real_rate /100 ; - -return (unsigned int )(abs (((rr - r) *100 ) / r)); -} -int dispc_vp_set_clk_rate (struct dispc_device *dispc,u32 hw_videoport,unsigned long rate) {
drivers/gpu/drm/tidss/tidss_dispc.h +0 -3
@@ -77,9 +77,6 @@ enum dispc_dss_subrevision { };struct dispc_features { -int min_pclk_khz; -int max_pclk_khz[DISPC_VP_MAX_BUS_TYPE ]; -struct dispc_features_scaling scaling;enum dispc_dss_subrevision subrev;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 260/614 drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <[email protected]>
[ Upstream commit 86db652fc22f5674ffe3b1f7c91c397c69d26d94 ]
After integrating OLDI support[0], it is necessary to identify which VP instances use OLDI, since the OLDI driver owns the video port clock (as a serial clock). Clock operations on these VPs must be delegated to the OLDI driver, not handled by the TIDSS driver. This issue also emerged in upstream discussions when DSI-related clock management was attempted in the TIDSS driver[1].
To address this, add an 'is_ext_vp_clk' array to the 'tidss_device' structure, marking a VP as 'true' during 'tidss_oldi_init()' and as 'false' during 'tidss_oldi_deinit()'. TIDSS then uses 'is_ext_vp_clk' to skip clock validation checks in 'dispc_vp_mode_valid()' for VPs under OLDI control.
Since OLDI uses the DSS VP clock directly as a serial interface and manages its own rate, mode validation should be implemented in the OLDI bridge's 'mode_valid' hook. This patch adds that logic, ensuring proper delegation and avoiding spurious clock handling in the TIDSS driver.
[0]: https://lore.kernel.org/all/[email protected]/
[1]: https://lore.kernel.org/all/[email protected]/
--- drivers/gpu/drm/tidss/tidss_dispc.c | 7 +++++++ drivers/gpu/drm/tidss/tidss_drv.h | 2 ++ drivers/gpu/drm/tidss/tidss_oldi.c | 22 ++++++++++++++++++++++ 3 files changed, 31 insertions(+)
drivers/gpu/drm/tidss/tidss_dispc.c +7 -0
@@ -1313,6 +1313,13 @@ static int check_pixel_clock(struct dispc_device *dispc, u32 hw_videoport, {unsigned long round_clock; +/* +* For VP's with external clocking, clock operations must be +* delegated to respective driver, so we skip the check here. +*/ +if (dispc->tidss->is_ext_vp_clk[hw_videoport]) +return 0 ; + round_clock =clk_round_rate (dispc->vp_clk[hw_videoport], clock);/* * To keep the check consistent with dispc_vp_set_clk_rate(), we
drivers/gpu/drm/tidss/tidss_drv.h +2 -0
@@ -24,6 +24,8 @@ struct tidss_device {const struct dispc_features *feat;struct dispc_device *dispc; +bool is_ext_vp_clk[TIDSS_MAX_PORTS ]; +unsigned int num_crtcs;struct drm_crtc *crtcs[TIDSS_MAX_PORTS ];
drivers/gpu/drm/tidss/tidss_oldi.c +22 -0
@@ -309,6 +309,25 @@ static u32 *tidss_oldi_atomic_get_input_bus_fmts(struct drm_bridge *bridge,return input_fmts; } +static enum drm_mode_status +tidss_oldi_mode_valid (struct drm_bridge *bridge, +const struct drm_display_info *info, +const struct drm_display_mode *mode) +{ +struct tidss_oldi *oldi =drm_bridge_to_tidss_oldi (bridge); +unsigned long round_clock; + + round_clock =clk_round_rate (oldi->serial, mode->clock *7 *1000 ); +/* +* To keep the check consistent with dispc_vp_set_clk_rate(), +* we use the same 5% check here. +*/ +if (dispc_pclk_diff (mode->clock *7 *1000 , round_clock) >5 ) +return -EINVAL ; + +return 0 ; +} +static const struct drm_bridge_funcs tidss_oldi_bridge_funcs = { .attach = tidss_oldi_bridge_attach, .atomic_pre_enable = tidss_oldi_atomic_pre_enable,
@@ -317,6 +336,7 @@ static const struct drm_bridge_funcs tidss_oldi_bridge_funcs = { .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state, .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state, .atomic_reset = drm_atomic_helper_bridge_reset, + .mode_valid = tidss_oldi_mode_valid, };static int get_oldi_mode (struct device_node *oldi_tx,int *companion_instance)
@@ -430,6 +450,7 @@ void tidss_oldi_deinit(struct tidss_device *tidss)for (int i =0 ; i < tidss->num_oldis; i++) {if (tidss->oldis[i]) {drm_bridge_remove (&tidss->oldis[i]->bridge); + tidss->is_ext_vp_clk[tidss->oldis[i]->parent_vp] = false; tidss->oldis[i] =NULL ; } }
@@ -580,6 +601,7 @@ int tidss_oldi_init(struct tidss_device *tidss) oldi->bridge.timings = &default_tidss_oldi_timings; tidss->oldis[tidss->num_oldis++] = oldi; + tidss->is_ext_vp_clk[oldi->parent_vp] = true; oldi->tidss = tidss;drm_bridge_add (&oldi->bridge);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 261/614 clk: renesas: r9a09g077: Propagate rate changes to parent clocks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit 145dfd70b9c70e5bc03494a7ce8fa3748ac01af3 ]
Add the CLK_SET_RATE_PARENT flag to divider clock registration so that rate changes can propagate to parent clocks when needed. This allows the CPG divider clocks to request rate adjustments from their parent, ensuring correct frequency scaling and improved flexibility in clock rate selection.
--- drivers/clk/renesas/r9a09g077-cpg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/renesas/r9a09g077-cpg.c +2 -2
@@ -217,7 +217,7 @@ r9a09g077_cpg_div_clk_register(struct device *dev,if (core->dtable) clk_hw = clk_hw_register_divider_table(dev, core->name, - parent_name, 0, + parent_name, CLK_SET_RATE_PARENT, addr, GET_SHIFT(core->conf), GET_WIDTH(core->conf),
@@ -226,7 +226,7 @@ r9a09g077_cpg_div_clk_register(struct device *dev, &pub->rmw_lock); else clk_hw = clk_hw_register_divider(dev, core->name, - parent_name, 0, + parent_name, CLK_SET_RATE_PARENT, addr, GET_SHIFT(core->conf), GET_WIDTH(core->conf),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 262/614 clk: renesas: r9a06g032: Fix memory leak in error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit f8def051bbcf8677f64701e9699bf6d11e2780cd ]
The current code uses of_iomap() to map registers but never calls iounmap() on any error path after the mapping. This causes a memory leak when probe fails after successful ioremap, for example when of_clk_add_provider() or r9a06g032_add_clk_domain() fails.
Replace of_iomap() with devm_of_iomap() to automatically unmap the region on probe failure. Update the error check accordingly to use IS_ERR() and PTR_ERR() since devm_of_iomap() returns ERR_PTR on error.
--- drivers/clk/renesas/r9a06g032-clocks.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/renesas/r9a06g032-clocks.c +3 -3
@@ -1333,9 +1333,9 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev)if (IS_ERR (mclk))return PTR_ERR (mclk); - clocks->reg =of_iomap (np,0 ); -if (WARN_ON (!clocks->reg)) -return -ENOMEM ; + clocks->reg =devm_of_iomap (dev, np,0 ,NULL ); +if (IS_ERR (clocks->reg)) +return PTR_ERR (clocks->reg);r9a06g032_init_h2mode (clocks);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 263/614 lib/vsprintf: Check pointer before dereferencing in time_and_date()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 372a12bd5df0199aa234eaf8ef31ed7ecd61d40f ]
The pointer may be invalid when gets to the printf(). In particular the time_and_date() dereferencing it in some cases without checking.
Move the check from rtc_str() to time_and_date() to cover all cases.
--- lib/vsprintf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
lib/vsprintf.c +3 -3
@@ -1928,9 +1928,6 @@ char *rtc_str(char *buf, char *end, const struct rtc_time *tm,bool found = true;int count =2 ; -if (check_pointer (&buf, end, tm, spec)) -return buf; -switch (fmt[count]) {case 'd' : have_t = false;
@@ -1996,6 +1993,9 @@ static noinline_for_stackchar *time_and_date (char *buf,char *end,void *ptr,struct printf_spec spec,const char *fmt) { +if (check_pointer (&buf, end, ptr, spec)) +return buf; +switch (fmt[1 ]) {case 'R' :return rtc_str (buf, end, (const struct rtc_time *)ptr, spec, fmt);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 264/614 ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 8a7d58845fae061c62b50bc5eeb9bae4a1dedc3d ]
In '__ocfs2_move_extent()', relax 'BUG()' to 'ocfs2_error()' just to avoid crashing the whole kernel due to a filesystem corruption.
--- fs/ocfs2/move_extents.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/ocfs2/move_extents.c +7 -1
@@ -98,7 +98,13 @@ static int __ocfs2_move_extent(handle_t *handle, rec = &el->l_recs[index]; -BUG_ON (ext_flags != rec->e_flags); +if (ext_flags != rec->e_flags) { + ret =ocfs2_error (inode->i_sb, +"Inode %llu has corrupted extent %d with flags 0x%x at cpos %u\n" , + (unsigned long long )ino, index, rec->e_flags, cpos); + goto out; + } +/* * after moving/defraging to new location, the extent is not going * to be refcounted anymore.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 265/614 ocfs2: use correct endian in ocfs2_dinode_has_extents
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <[email protected]>
[ Upstream commit c9dff86eb78a4b6b02b1e407993c946ccaf9bfb4 ]
Fields in ocfs2_dinode is little endian, covert to host endian when checking those contents.
--- fs/ocfs2/inode.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/ocfs2/inode.c +6 -4
@@ -201,13 +201,15 @@ struct inode *ocfs2_iget(struct ocfs2_super *osb, u64 blkno, unsigned flags,static int ocfs2_dinode_has_extents (struct ocfs2_dinode *di) {/* inodes flagged with other stuff in id2 */ -if (di->i_flags & (OCFS2_SUPER_BLOCK_FL |OCFS2_LOCAL_ALLOC_FL | -OCFS2_CHAIN_FL |OCFS2_DEALLOC_FL )) +if (le32_to_cpu (di->i_flags) & + (OCFS2_SUPER_BLOCK_FL |OCFS2_LOCAL_ALLOC_FL |OCFS2_CHAIN_FL | +OCFS2_DEALLOC_FL ))return 0 ;/* i_flags doesn't indicate when id2 is a fast symlink */ -if (S_ISLNK (di->i_mode) && di->i_size && di->i_clusters ==0 ) +if (S_ISLNK (le16_to_cpu (di->i_mode)) &&le64_to_cpu (di->i_size) && + !le32_to_cpu (di->i_clusters))return 0 ; -if (di->i_dyn_features &OCFS2_INLINE_DATA_FL ) +if (le16_to_cpu (di->i_dyn_features) &OCFS2_INLINE_DATA_FL )return 0 ;return 1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 266/614 ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 593ee49222a0d751062fd9a5e4a963ade4ec028a ]
acpi_fwnode_graph_parse_endpoint() calls fwnode_get_parent() to obtain the parent fwnode but returns without calling fwnode_handle_put() on it. This potentially leads to a fwnode refcount leak and prevents the parent node from being released properly.
Call fwnode_handle_put() on the parent fwnode before returning to prevent the leak from occurring.
--- drivers/acpi/property.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/property.c +1 -0
@@ -1714,6 +1714,7 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,if (fwnode_property_read_u32 (fwnode,"reg" , &endpoint->id))fwnode_property_read_u32 (fwnode,"endpoint" , &endpoint->id); +fwnode_handle_put (port_fwnode);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 267/614 scsi: qla2xxx: Clear cmds after chip reset
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Battersby <[email protected]>
[ Upstream commit d46c69a087aa3d1513f7a78f871b80251ea0c1ae ]
Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems:
1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore.
2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs().
So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.
--- drivers/scsi/qla2xxx/qla_os.c | 20 ++++++++++++++++++-- drivers/scsi/qla2xxx/qla_target.c | 5 +---- drivers/scsi/qla2xxx/qla_target.h | 1 + 3 files changed, 20 insertions(+), 6 deletions(-)
drivers/scsi/qla2xxx/qla_os.c +18 -2
@@ -1881,10 +1881,26 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)continue ; } cmd = (struct qla_tgt_cmd *)sp; - cmd->aborted =1 ; + +if (cmd->sg_mapped) +qlt_unmap_sg (vha, cmd); + +if (cmd->state ==QLA_TGT_STATE_NEED_DATA ) { + cmd->aborted =1 ; + cmd->write_data_transferred =0 ; + cmd->state =QLA_TGT_STATE_DATA_IN ; + ha->tgt.tgt_ops->handle_data (cmd); + }else { + ha->tgt.tgt_ops->free_cmd (cmd); + }break ;case TYPE_TGT_TMCMD : -/* Skip task management functions. */ +/* +* Currently, only ABTS response gets on the +* outstanding_cmds[] +*/ + ha->tgt.tgt_ops->free_mcmd ( + (struct qla_tgt_mgmt_cmd *) sp);break ;default :break ;
drivers/scsi/qla2xxx/qla_target.c +1 -4
@@ -2443,7 +2443,7 @@ static int qlt_pci_map_calc_cnt(struct qla_tgt_prm *prm)return -1 ; } -static void qlt_unmap_sg (struct scsi_qla_host *vha,struct qla_tgt_cmd *cmd) +void qlt_unmap_sg (struct scsi_qla_host *vha,struct qla_tgt_cmd *cmd) {struct qla_hw_data *ha;struct qla_qpair *qpair;
@@ -3773,9 +3773,6 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)spin_lock_irqsave (&cmd->cmd_lock, flags);if (cmd->aborted) { -if (cmd->sg_mapped) -qlt_unmap_sg (vha, cmd); -spin_unlock_irqrestore (&cmd->cmd_lock, flags);/* * It's normal to see 2 calls in this path:
drivers/scsi/qla2xxx/qla_target.h +1 -0
@@ -1058,6 +1058,7 @@ extern int qlt_abort_cmd(struct qla_tgt_cmd *);extern void qlt_xmit_tm_rsp (struct qla_tgt_mgmt_cmd *);extern void qlt_free_mcmd (struct qla_tgt_mgmt_cmd *);extern void qlt_free_cmd (struct qla_tgt_cmd *cmd); +extern void qlt_unmap_sg (struct scsi_qla_host *vha,struct qla_tgt_cmd *cmd);extern void qlt_async_event (uint16_t ,struct scsi_qla_host *,uint16_t *);extern void qlt_enable_vha (struct scsi_qla_host *);extern void qlt_vport_create (struct scsi_qla_host *,struct qla_hw_data *);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 268/614 scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit acd194d9b5bac419e04968ffa44351afabb50bac ]
The driver calls ioport_map() to map I/O ports in sim710_probe_common() but never calls ioport_unmap() to release the mapping. This causes resource leaks in both the error path when request_irq() fails and in the normal device removal path via sim710_device_remove().
Add ioport_unmap() calls in the out_release error path and in sim710_device_remove().
--- drivers/scsi/sim710.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/sim710.c +2 -0
@@ -133,6 +133,7 @@ static int sim710_probe_common(struct device *dev, unsigned long base_addr, out_put_host:scsi_host_put (host); out_release: +ioport_unmap (hostdata->base);release_region (base_addr,64 ); out_free:kfree (hostdata);
@@ -148,6 +149,7 @@ static int sim710_device_remove(struct device *dev)scsi_remove_host (host);NCR_700_release (host); +ioport_unmap (hostdata->base);kfree (hostdata);free_irq (host->irq, host);release_region (host->base,64 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 269/614 leds: netxbig: Fix GPIO descriptor leak in error paths
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 03865dd8af52eb16c38062df2ed30a91b604780e ]
The function netxbig_gpio_ext_get() acquires GPIO descriptors but fails to release them when errors occur mid-way through initialization. The cleanup callback registered by devm_add_action_or_reset() only runs on success, leaving acquired GPIOs leaked on error paths.
Add goto-based error handling to release all acquired GPIOs before returning errors.
--- drivers/leds/leds-netxbig.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-)
drivers/leds/leds-netxbig.c +26 -10
@@ -364,6 +364,9 @@ static int netxbig_gpio_ext_get(struct device *dev,if (!addr)return -ENOMEM ; + gpio_ext->addr = addr; + gpio_ext->num_addr =0 ; +/* * We cannot use devm_ managed resources with these GPIO descriptors * since they are associated with the "GPIO extension device" which
@@ -375,45 +378,58 @@ static int netxbig_gpio_ext_get(struct device *dev, gpiod =gpiod_get_index (gpio_ext_dev,"addr" , i,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) -return PTR_ERR (gpiod); + goto err_set_code;gpiod_set_consumer_name (gpiod,"GPIO extension addr" ); addr[i] = gpiod; + gpio_ext->num_addr++; } - gpio_ext->addr = addr; - gpio_ext->num_addr = num_addr; ret =gpiod_count (gpio_ext_dev,"data" );if (ret <0 ) {dev_err (dev,"Failed to count GPIOs in DT property data-gpios\n" ); -return ret; + goto err_free_addr; } num_data = ret; data =devm_kcalloc (dev, num_data,sizeof (*data),GFP_KERNEL ); -if (!data) -return -ENOMEM ; +if (!data) { + ret = -ENOMEM ; + goto err_free_addr; + } + + gpio_ext->data = data; + gpio_ext->num_data =0 ;for (i =0 ; i < num_data; i++) { gpiod =gpiod_get_index (gpio_ext_dev,"data" , i,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) -return PTR_ERR (gpiod); + goto err_free_data;gpiod_set_consumer_name (gpiod,"GPIO extension data" ); data[i] = gpiod; + gpio_ext->num_data++; } - gpio_ext->data = data; - gpio_ext->num_data = num_data; gpiod =gpiod_get (gpio_ext_dev,"enable" ,GPIOD_OUT_LOW );if (IS_ERR (gpiod)) {dev_err (dev,"Failed to get GPIO from DT property enable-gpio\n" ); -return PTR_ERR (gpiod); + goto err_free_data; }gpiod_set_consumer_name (gpiod,"GPIO extension enable" ); gpio_ext->enable = gpiod;return devm_add_action_or_reset (dev, netxbig_gpio_ext_remove, gpio_ext); + +err_free_data: +for (i =0 ; i < gpio_ext->num_data; i++) +gpiod_put (gpio_ext->data[i]); +err_set_code: + ret =PTR_ERR (gpiod); +err_free_addr: +for (i =0 ; i < gpio_ext->num_addr; i++) +gpiod_put (gpio_ext->addr[i]); +return ret; } static int netxbig_leds_get_of_pdata(struct device *dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 270/614 arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaitanya S Prakash <[email protected]>
[ Upstream commit bfc184cb1ba7226b21ab26f0b220581895c5ac9e ]
arch_add_memory() is used to hotplug memory into a system but as a part of its implementation it calls __create_pgd_mapping(), which uses pgtable_alloc() in order to build intermediate page tables. As this path was initally only used during early boot pgtable_alloc() is designed to BUG_ON() on failure. However, in the event that memory hotplug is attempted when the system's memory is extremely tight and the allocation were to fail, it would lead to panicking the system, which is not desirable. Hence update __create_pgd_mapping and all it's callers to be non void and propagate -ENOMEM on allocation failure to allow system to fail gracefully.
But during early boot if there is an allocation failure, we want the system to panic, hence create a wrapper around __create_pgd_mapping() called early_create_pgd_mapping() which is designed to panic, if ret is non zero value. All the init calls are updated to use this wrapper rather than the modified __create_pgd_mapping() to restore functionality.
--- arch/arm64/mm/mmu.c | 214 ++++++++++++++++++++++++++++---------------- 1 file changed, 136 insertions(+), 78 deletions(-)
arch/arm64/mm/mmu.c +136 -78
@@ -49,6 +49,8 @@#define NO_CONT_MAPPINGS BIT(1)#define NO_EXEC_MAPPINGS BIT(2)/* assumes FEAT_HPDS is not used */ +#define INVALID_PHYS_ADDR (-1ULL) +DEFINE_STATIC_KEY_FALSE (arm64_ptdump_lock_key);u64 kimage_voffset__ro_after_init ;
@@ -194,11 +196,11 @@ static void init_pte(pte_t *ptep, unsigned long addr, unsigned long end, }while (ptep++, addr +=PAGE_SIZE , addr != end); } -static void alloc_init_cont_pte (pmd_t *pmdp,unsigned long addr, -unsigned long end,phys_addr_t phys, -pgprot_t prot, -phys_addr_t (*pgtable_alloc)(enum pgtable_type ), -int flags) +static int alloc_init_cont_pte (pmd_t *pmdp,unsigned long addr, +unsigned long end,phys_addr_t phys, +pgprot_t prot, +phys_addr_t (*pgtable_alloc)(enum pgtable_type ), +int flags) {unsigned long next;pmd_t pmd =READ_ONCE (*pmdp);
@@ -213,6 +215,8 @@ static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr, pmdval |=PMD_TABLE_PXN ;BUG_ON (!pgtable_alloc); pte_phys =pgtable_alloc (TABLE_PTE ); +if (pte_phys ==INVALID_PHYS_ADDR ) +return -ENOMEM ; ptep =pte_set_fixmap (pte_phys);init_clear_pgtable (ptep); ptep +=pte_index (addr);
@@ -244,11 +248,13 @@ static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,* walker. */ pte_clear_fixmap (); + +return 0 ; } -static void init_pmd (pmd_t *pmdp,unsigned long addr,unsigned long end, -phys_addr_t phys,pgprot_t prot, -phys_addr_t (*pgtable_alloc)(enum pgtable_type ),int flags) +static int init_pmd (pmd_t *pmdp,unsigned long addr,unsigned long end, +phys_addr_t phys,pgprot_t prot, +phys_addr_t (*pgtable_alloc)(enum pgtable_type ),int flags) {unsigned long next;
@@ -269,22 +275,29 @@ static void init_pmd(pmd_t *pmdp, unsigned long addr, unsigned long end,BUG_ON (!pgattr_change_is_safe (pmd_val (old_pmd),READ_ONCE (pmd_val (*pmdp)))); }else { -alloc_init_cont_pte (pmdp, addr, next, phys, prot, - pgtable_alloc, flags); +int ret; + + ret =alloc_init_cont_pte (pmdp, addr, next, phys, prot, + pgtable_alloc, flags); +if (ret) +return ret;BUG_ON (pmd_val (old_pmd) !=0 &&pmd_val (old_pmd) !=READ_ONCE (pmd_val (*pmdp))); } phys += next - addr; }while (pmdp++, addr = next, addr != end); + +return 0 ; } -static void alloc_init_cont_pmd (pud_t *pudp,unsigned long addr, -unsigned long end,phys_addr_t phys, -pgprot_t prot, -phys_addr_t (*pgtable_alloc)(enum pgtable_type ), -int flags) +static int alloc_init_cont_pmd (pud_t *pudp,unsigned long addr, +unsigned long end,phys_addr_t phys, +pgprot_t prot, +phys_addr_t (*pgtable_alloc)(enum pgtable_type ), +int flags) { +int ret;unsigned long next;pud_t pud =READ_ONCE (*pudp);pmd_t *pmdp;
@@ -301,6 +314,8 @@ static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr, pudval |=PUD_TABLE_PXN ;BUG_ON (!pgtable_alloc); pmd_phys =pgtable_alloc (TABLE_PMD ); +if (pmd_phys ==INVALID_PHYS_ADDR ) +return -ENOMEM ; pmdp =pmd_set_fixmap (pmd_phys);init_clear_pgtable (pmdp); pmdp +=pmd_index (addr);
@@ -320,20 +335,26 @@ static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr, (flags & NO_CONT_MAPPINGS) == 0) __prot =__pgprot (pgprot_val (prot) |PTE_CONT ); -init_pmd (pmdp, addr, next, phys, __prot, pgtable_alloc, flags); + ret =init_pmd (pmdp, addr, next, phys, __prot, pgtable_alloc, flags); +if (ret) + goto out; pmdp +=pmd_index (next) -pmd_index (addr); phys += next - addr; }while (addr = next, addr != end); +out:pmd_clear_fixmap (); + +return ret; } -static void alloc_init_pud (p4d_t *p4dp,unsigned long addr,unsigned long end, -phys_addr_t phys,pgprot_t prot, -phys_addr_t (*pgtable_alloc)(enum pgtable_type ), -int flags) +static int alloc_init_pud (p4d_t *p4dp,unsigned long addr,unsigned long end, +phys_addr_t phys,pgprot_t prot, +phys_addr_t (*pgtable_alloc)(enum pgtable_type ), +int flags) { +int ret =0 ;unsigned long next;p4d_t p4d =READ_ONCE (*p4dp);pud_t *pudp;
@@ -346,6 +367,8 @@ static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end, p4dval |=P4D_TABLE_PXN ;BUG_ON (!pgtable_alloc); pud_phys =pgtable_alloc (TABLE_PUD ); +if (pud_phys ==INVALID_PHYS_ADDR ) +return -ENOMEM ; pudp =pud_set_fixmap (pud_phys);init_clear_pgtable (pudp); pudp +=pud_index (addr);
@@ -375,8 +398,10 @@ static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,BUG_ON (!pgattr_change_is_safe (pud_val (old_pud),READ_ONCE (pud_val (*pudp)))); }else { -alloc_init_cont_pmd (pudp, addr, next, phys, prot, - pgtable_alloc, flags); + ret =alloc_init_cont_pmd (pudp, addr, next, phys, prot, + pgtable_alloc, flags); +if (ret) + goto out;BUG_ON (pud_val (old_pud) !=0 &&pud_val (old_pud) !=READ_ONCE (pud_val (*pudp)));
@@ -384,14 +409,18 @@ static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end, phys += next - addr; }while (pudp++, addr = next, addr != end); +out:pud_clear_fixmap (); + +return ret; } -static void alloc_init_p4d (pgd_t *pgdp,unsigned long addr,unsigned long end, -phys_addr_t phys,pgprot_t prot, -phys_addr_t (*pgtable_alloc)(enum pgtable_type ), -int flags) +static int alloc_init_p4d (pgd_t *pgdp,unsigned long addr,unsigned long end, +phys_addr_t phys,pgprot_t prot, +phys_addr_t (*pgtable_alloc)(enum pgtable_type ), +int flags) { +int ret;unsigned long next;pgd_t pgd =READ_ONCE (*pgdp);p4d_t *p4dp;
@@ -404,6 +433,8 @@ static void alloc_init_p4d(pgd_t *pgdp, unsigned long addr, unsigned long end, pgdval |=PGD_TABLE_PXN ;BUG_ON (!pgtable_alloc); p4d_phys =pgtable_alloc (TABLE_P4D ); +if (p4d_phys ==INVALID_PHYS_ADDR ) +return -ENOMEM ; p4dp =p4d_set_fixmap (p4d_phys);init_clear_pgtable (p4dp); p4dp +=p4d_index (addr);
@@ -418,8 +449,10 @@ static void alloc_init_p4d(pgd_t *pgdp, unsigned long addr, unsigned long end, next =p4d_addr_end (addr, end); -alloc_init_pud (p4dp, addr, next, phys, prot, - pgtable_alloc, flags); + ret =alloc_init_pud (p4dp, addr, next, phys, prot, + pgtable_alloc, flags); +if (ret) + goto out;BUG_ON (p4d_val (old_p4d) !=0 &&p4d_val (old_p4d) !=READ_ONCE (p4d_val (*p4dp)));
@@ -427,15 +460,19 @@ static void alloc_init_p4d(pgd_t *pgdp, unsigned long addr, unsigned long end, phys += next - addr; }while (p4dp++, addr = next, addr != end); +out:p4d_clear_fixmap (); + +return ret; } -static void __create_pgd_mapping_locked (pgd_t *pgdir,phys_addr_t phys, -unsigned long virt,phys_addr_t size, -pgprot_t prot, -phys_addr_t (*pgtable_alloc)(enum pgtable_type ), -int flags) +static int __create_pgd_mapping_locked (pgd_t *pgdir,phys_addr_t phys, +unsigned long virt,phys_addr_t size, +pgprot_t prot, +phys_addr_t (*pgtable_alloc)(enum pgtable_type ), +int flags) { +int ret;unsigned long addr, end, next;pgd_t *pgdp =pgd_offset_pgd (pgdir, virt);
@@ -444,7 +481,7 @@ static void __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys,* within a page, we cannot map the region as the caller expects. */ if (WARN_ON ((phys ^ virt) & ~PAGE_MASK )) -return ; +return -EINVAL ; phys &=PAGE_MASK ; addr = virt &PAGE_MASK ;
@@ -452,25 +489,45 @@ static void __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys,do { next =pgd_addr_end (addr, end); -alloc_init_p4d (pgdp, addr, next, phys, prot, pgtable_alloc, - flags); + ret =alloc_init_p4d (pgdp, addr, next, phys, prot, pgtable_alloc, + flags); +if (ret) +return ret; phys += next - addr; }while (pgdp++, addr = next, addr != end); + +return 0 ; } -static void __create_pgd_mapping (pgd_t *pgdir,phys_addr_t phys, -unsigned long virt,phys_addr_t size, -pgprot_t prot, -phys_addr_t (*pgtable_alloc)(enum pgtable_type ), -int flags) +static int __create_pgd_mapping (pgd_t *pgdir,phys_addr_t phys, +unsigned long virt,phys_addr_t size, +pgprot_t prot, +phys_addr_t (*pgtable_alloc)(enum pgtable_type ), +int flags) { +int ret; +mutex_lock (&fixmap_lock); -__create_pgd_mapping_locked (pgdir, phys, virt, size, prot, - pgtable_alloc, flags); + ret =__create_pgd_mapping_locked (pgdir, phys, virt, size, prot, + pgtable_alloc, flags);mutex_unlock (&fixmap_lock); + +return ret; } -#define INVALID_PHYS_ADDR (-1ULL) +static void early_create_pgd_mapping (pgd_t *pgdir,phys_addr_t phys, +unsigned long virt,phys_addr_t size, +pgprot_t prot, +phys_addr_t (*pgtable_alloc)(enum pgtable_type ), +int flags) +{ +int ret; + + ret =__create_pgd_mapping (pgdir, phys, virt, size, prot, pgtable_alloc, + flags); +if (ret) +panic ("Failed to create page tables\n" ); +}static phys_addr_t __pgd_pgtable_alloc (struct mm_struct *mm,gfp_t gfp,enum pgtable_type pgtable_type)
@@ -511,21 +568,13 @@ try_pgd_pgtable_alloc_init_mm(enum pgtable_type pgtable_type, gfp_t gfp)static phys_addr_t __maybe_unused pgd_pgtable_alloc_init_mm (enum pgtable_type pgtable_type) { -phys_addr_t pa; - - pa =__pgd_pgtable_alloc (&init_mm,GFP_PGTABLE_KERNEL , pgtable_type); -BUG_ON (pa ==INVALID_PHYS_ADDR ); -return pa; +return __pgd_pgtable_alloc (&init_mm,GFP_PGTABLE_KERNEL , pgtable_type); }static phys_addr_t pgd_pgtable_alloc_special_mm (enum pgtable_type pgtable_type) { -phys_addr_t pa; - - pa =__pgd_pgtable_alloc (NULL ,GFP_PGTABLE_KERNEL , pgtable_type); -BUG_ON (pa ==INVALID_PHYS_ADDR ); -return pa; +return __pgd_pgtable_alloc (NULL ,GFP_PGTABLE_KERNEL , pgtable_type); }static void split_contpte (pte_t *ptep)
@@ -935,8 +984,8 @@ void __init create_mapping_noalloc(phys_addr_t phys, unsigned long virt, &phys, virt);return ; } -__create_pgd_mapping (init_mm.pgd, phys, virt, size, prot,NULL , -NO_CONT_MAPPINGS ); +early_create_pgd_mapping (init_mm.pgd, phys, virt, size, prot,NULL , +NO_CONT_MAPPINGS ); } void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,
@@ -950,8 +999,8 @@ void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,if (page_mappings_only) flags =NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ; -__create_pgd_mapping (mm->pgd, phys, virt, size, prot, - pgd_pgtable_alloc_special_mm, flags); +early_create_pgd_mapping (mm->pgd, phys, virt, size, prot, + pgd_pgtable_alloc_special_mm, flags); } static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
@@ -963,8 +1012,8 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,return ; } -__create_pgd_mapping (init_mm.pgd, phys, virt, size, prot,NULL , -NO_CONT_MAPPINGS ); +early_create_pgd_mapping (init_mm.pgd, phys, virt, size, prot,NULL , +NO_CONT_MAPPINGS );/* flush the TLBs after updating live kernel mappings */ flush_tlb_kernel_range (virt, virt + size);
@@ -973,8 +1022,8 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,static void __init __map_memblock (pgd_t *pgdp,phys_addr_t start,phys_addr_t end,pgprot_t prot,int flags) { -__create_pgd_mapping (pgdp, start,__phys_to_virt (start), end - start, - prot, early_pgtable_alloc, flags); +early_create_pgd_mapping (pgdp, start,__phys_to_virt (start), end - start, + prot, early_pgtable_alloc, flags); }void __init mark_linear_text_alias_ro (void )
@@ -1207,6 +1256,8 @@ static int __init __kpti_install_ng_mappings(void *__unused) remap_fn = (void *)__pa_symbol (idmap_kpti_install_ng_mappings);if (!cpu) { +int ret; + alloc =__get_free_pages (GFP_ATOMIC | __GFP_ZERO, order); kpti_ng_temp_pgd = (pgd_t *)(alloc + (levels -1 ) *PAGE_SIZE ); kpti_ng_temp_alloc = kpti_ng_temp_pgd_pa =__pa (kpti_ng_temp_pgd);
@@ -1227,9 +1278,11 @@ static int __init __kpti_install_ng_mappings(void *__unused)// covers the PTE[] page itself, the remaining entries are free // to be used as a ad-hoc fixmap. // -__create_pgd_mapping_locked (kpti_ng_temp_pgd,__pa (alloc), -KPTI_NG_TEMP_VA ,PAGE_SIZE ,PAGE_KERNEL , - kpti_ng_pgd_alloc,0 ); + ret =__create_pgd_mapping_locked (kpti_ng_temp_pgd,__pa (alloc), +KPTI_NG_TEMP_VA ,PAGE_SIZE ,PAGE_KERNEL , + kpti_ng_pgd_alloc,0 ); +if (ret) +panic ("Failed to create page tables\n" ); }cpu_install_idmap ();
@@ -1282,9 +1335,9 @@ static int __init map_entry_trampoline(void)/* Map only the text into the trampoline page table */ memset (tramp_pg_dir,0 ,PGD_SIZE ); -__create_pgd_mapping (tramp_pg_dir, pa_start,TRAMP_VALIAS , -entry_tramp_text_size (), prot, - pgd_pgtable_alloc_init_mm,NO_BLOCK_MAPPINGS ); +early_create_pgd_mapping (tramp_pg_dir, pa_start,TRAMP_VALIAS , +entry_tramp_text_size (), prot, + pgd_pgtable_alloc_init_mm,NO_BLOCK_MAPPINGS );/* Map both the text and data into the kernel page table */ for (i =0 ; i <DIV_ROUND_UP (entry_tramp_text_size (),PAGE_SIZE ); i++)
@@ -1926,23 +1979,28 @@ int arch_add_memory(int nid, u64 start, u64 size,if (force_pte_mapping ()) flags |=NO_BLOCK_MAPPINGS |NO_CONT_MAPPINGS ; -__create_pgd_mapping (swapper_pg_dir, start,__phys_to_virt (start), - size, params->pgprot, pgd_pgtable_alloc_init_mm, - flags); + ret =__create_pgd_mapping (swapper_pg_dir, start,__phys_to_virt (start), + size, params->pgprot, pgd_pgtable_alloc_init_mm, + flags); +if (ret) + goto err;memblock_clear_nomap (start, size); ret =__add_pages (nid, start >>PAGE_SHIFT , size >>PAGE_SHIFT , params);if (ret) -__remove_pgd_mapping (swapper_pg_dir, -__phys_to_virt (start), size); -else { -/* Address of hotplugged memory can be smaller */ - max_pfn =max (max_pfn,PFN_UP (start + size)); - max_low_pfn = max_pfn; - } + goto err; + +/* Address of hotplugged memory can be smaller */ + max_pfn =max (max_pfn,PFN_UP (start + size)); + max_low_pfn = max_pfn; + +return 0 ; +err: +__remove_pgd_mapping (swapper_pg_dir, +__phys_to_virt (start), size);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 271/614 accel/amdxdna: Clear mailbox interrupt register during channel creation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit 6ff9385c07aa311f01f87307e6256231be7d8675 ]
The mailbox interrupt register is not always cleared when a mailbox channel is created. This can leave stale interrupt states from previous operations.
Fix this by explicitly clearing the interrupt register in the mailbox channel creation function.
--- drivers/accel/amdxdna/amdxdna_mailbox.c | 1 + 1 file changed, 1 insertion(+)
drivers/accel/amdxdna/amdxdna_mailbox.c +1 -0
@@ -513,6 +513,7 @@ xdna_mailbox_create_channel(struct mailbox *mb, } mb_chann->bad_state = false; +mailbox_reg_write (mb_chann, mb_chann->iohub_int_addr,0 );MB_DBG (mb_chann,"Mailbox channel created (irq: %d)" , mb_chann->msix_irq);return mb_chann;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 272/614 accel/amdxdna: Fix deadlock between context destroy and job timeout
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit ca2583412306ceda9304a7c4302fd9efbf43e963 ]
Hardware context destroy function holds dev_lock while waiting for all jobs to complete. The timeout job also needs to acquire dev_lock, this leads to a deadlock.
Fix the issue by temporarily releasing dev_lock before waiting for all jobs to finish, and reacquiring it afterward.
--- drivers/accel/amdxdna/aie2_ctx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/accel/amdxdna/aie2_ctx.c +4 -2
@@ -681,17 +681,19 @@ void aie2_hwctx_fini(struct amdxdna_hwctx *hwctx) ndev->hwctx_num--;XDNA_DBG (xdna,"%s sequence number %lld" , hwctx->name, hwctx->priv->seq); -drm_sched_entity_destroy (&hwctx->priv->entity); -aie2_hwctx_wait_for_idle (hwctx);/* Request fw to destroy hwctx and cancel the rest pending requests */ aie2_release_resource (hwctx); +mutex_unlock (&xdna->dev_lock); +drm_sched_entity_destroy (&hwctx->priv->entity); +/* Wait for all submitted jobs to be completed or canceled */ wait_event (hwctx->priv->job_free_wq,atomic64_read (&hwctx->job_submit_cnt) ==atomic64_read (&hwctx->job_free_cnt)); +mutex_lock (&xdna->dev_lock);drm_sched_fini (&hwctx->priv->sched);aie2_ctx_syncobj_destroy (hwctx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 273/614 bpf: Free special fields when update [lru_,]percpu_hash maps
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <[email protected]>
[ Upstream commit 6af6e49a76c9af7d42eb923703e7648cb2bf401a ]
As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could cause the memory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the map gets freed.
Fix this by calling 'bpf_obj_free_fields()' after 'copy_map_value[,_long]()' in 'pcpu_copy_value()'.
--- kernel/bpf/hashtab.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
kernel/bpf/hashtab.c +8 -2
@@ -947,15 +947,21 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)static void pcpu_copy_value (struct bpf_htab *htab,void __percpu *pptr,void *value,bool onallcpus) { +void *ptr; +if (!onallcpus) {/* copy true value_size bytes */ -copy_map_value (&htab->map,this_cpu_ptr (pptr), value); + ptr =this_cpu_ptr (pptr); +copy_map_value (&htab->map, ptr, value); +bpf_obj_free_fields (htab->map.record, ptr); }else {u32 size =round_up (htab->map.value_size,8 );int off =0 , cpu;for_each_possible_cpu (cpu) { -copy_map_value_long (&htab->map,per_cpu_ptr (pptr, cpu), value + off); + ptr =per_cpu_ptr (pptr, cpu); +copy_map_value_long (&htab->map, ptr, value + off); +bpf_obj_free_fields (htab->map.record, ptr); off += size; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 274/614 PCI: keystone: Exit ks_pcie_probe() for invalid mode
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit 95d9c3f0e4546eaec0977f3b387549a8463cd49f ]
Commit under Fixes introduced support for PCIe EP mode on AM654x platforms. When the mode happens to be either "DW_PCIE_RC_TYPE" or "DW_PCIE_EP_TYPE", the PCIe Controller is configured accordingly. However, when the mode is neither of them, an error message is displayed, but the driver probe succeeds. Since this "invalid" mode is not associated with a functional PCIe Controller, the probe should fail.
Fix the behavior by exiting "ks_pcie_probe()" with the return value of "-EINVAL" in addition to displaying the existing error message when the mode is invalid.
--- drivers/pci/controller/dwc/pci-keystone.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/dwc/pci-keystone.c +2 -0
@@ -1337,6 +1337,8 @@ static int ks_pcie_probe(struct platform_device *pdev)break ;default :dev_err (dev,"INVALID device type %d\n" , mode); + ret = -EINVAL ; + goto err_get_sync; }ks_pcie_enable_error_irq (ks_pcie);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 275/614 soc: renesas: r9a09g056-sys: Populate max_register
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit 4ff787433ba6d564b00334b4bfd6350f5b6f4bb3 ]
Populate max_register to avoid external aborts.
--- drivers/soc/renesas/r9a09g056-sys.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/renesas/r9a09g056-sys.c +1 -0
@@ -72,4 +72,5 @@ static const struct rz_sysc_soc_id_init_data rzv2n_sys_soc_id_init_data __initcoconst struct rz_sysc_init_data rzv2n_sys_init_data = { .soc_id_init_data = &rzv2n_sys_soc_id_init_data, + .max_register =0x170c , };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 276/614 soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit c432180a7d95081353a96fd6d5bd75b0fc8a27c3 ]
Not all system controller registers are accessible from Linux. Accessing such registers generates synchronous external abort. Populate the readable_reg and writeable_reg members of the regmap config to inform the regmap core which registers can be accessed. The list will need to be updated whenever new system controller functionality is exported through regmap.
--- drivers/soc/renesas/r9a08g045-sysc.c | 69 ++++++++++++++++++ drivers/soc/renesas/r9a09g047-sys.c | 79 +++++++++++++++++++++ drivers/soc/renesas/r9a09g056-sys.c | 68 ++++++++++++++++++ drivers/soc/renesas/r9a09g057-sys.c | 101 +++++++++++++++++++++++++++ drivers/soc/renesas/rz-sysc.c | 2 + drivers/soc/renesas/rz-sysc.h | 4 ++ 6 files changed, 323 insertions(+)
drivers/soc/renesas/r9a08g045-sysc.c +69 -0
@@ -6,10 +6,29 @@*/ #include <linux/bits.h> +#include <linux/device.h> #include <linux/init.h> #include "rz-sysc.h" +#define SYS_XSPI_MAP_STAADD_CS0 0x348 +#define SYS_XSPI_MAP_ENDADD_CS0 0x34c +#define SYS_XSPI_MAP_STAADD_CS1 0x350 +#define SYS_XSPI_MAP_ENDADD_CS1 0x354 +#define SYS_GETH0_CFG 0x380 +#define SYS_GETH1_CFG 0x390 +#define SYS_PCIE_CFG 0x3a0 +#define SYS_PCIE_MON 0x3a4 +#define SYS_PCIE_ERR_MON 0x3ac +#define SYS_PCIE_PHY 0x3b4 +#define SYS_I2C0_CFG 0x400 +#define SYS_I2C1_CFG 0x410 +#define SYS_I2C2_CFG 0x420 +#define SYS_I2C3_CFG 0x430 +#define SYS_I3C_CFG 0x440 +#define SYS_USB_PWRRDY 0xd70 +#define SYS_PCIE_RST_RSM_B 0xd74 +static const struct rz_sysc_soc_id_init_data rzg3s_sysc_soc_id_init_data__initconst = { .family ="RZ/G3S" , .id =0x85e0447 ,
@@ -18,7 +37,57 @@ static const struct rz_sysc_soc_id_init_data rzg3s_sysc_soc_id_init_data __initc .specific_id_mask = GENMASK(27, 0), }; +static bool rzg3s_regmap_readable_reg (struct device *dev,unsigned int reg) +{ +switch (reg) { +case SYS_XSPI_MAP_STAADD_CS0 : +case SYS_XSPI_MAP_ENDADD_CS0 : +case SYS_XSPI_MAP_STAADD_CS1 : +case SYS_XSPI_MAP_ENDADD_CS1 : +case SYS_GETH0_CFG : +case SYS_GETH1_CFG : +case SYS_PCIE_CFG : +case SYS_PCIE_MON : +case SYS_PCIE_ERR_MON : +case SYS_PCIE_PHY : +case SYS_I2C0_CFG : +case SYS_I2C1_CFG : +case SYS_I2C2_CFG : +case SYS_I2C3_CFG : +case SYS_I3C_CFG : +case SYS_USB_PWRRDY : +case SYS_PCIE_RST_RSM_B : +return true; +default : +return false; + } +} + +static bool rzg3s_regmap_writeable_reg (struct device *dev,unsigned int reg) +{ +switch (reg) { +case SYS_XSPI_MAP_STAADD_CS0 : +case SYS_XSPI_MAP_ENDADD_CS0 : +case SYS_XSPI_MAP_STAADD_CS1 : +case SYS_XSPI_MAP_ENDADD_CS1 : +case SYS_PCIE_CFG : +case SYS_PCIE_PHY : +case SYS_I2C0_CFG : +case SYS_I2C1_CFG : +case SYS_I2C2_CFG : +case SYS_I2C3_CFG : +case SYS_I3C_CFG : +case SYS_USB_PWRRDY : +case SYS_PCIE_RST_RSM_B : +return true; +default : +return false; + } +} +const struct rz_sysc_init_data rzg3s_sysc_init_data__initconst = { .soc_id_init_data = &rzg3s_sysc_soc_id_init_data, + .readable_reg = rzg3s_regmap_readable_reg, + .writeable_reg = rzg3s_regmap_writeable_reg, .max_register =0xe20 , };
drivers/soc/renesas/r9a09g047-sys.c +79 -0
92 lines not on this page · raw message
drivers/soc/renesas/r9a09g056-sys.c +68 -0
81 lines not on this page · raw message
drivers/soc/renesas/r9a09g057-sys.c +101 -0
114 lines not on this page · raw message
drivers/soc/renesas/rz-sysc.c +2 -0
@@ -140,6 +140,8 @@ static int rz_sysc_probe(struct platform_device *pdev) regmap_cfg->val_bits =32 ; regmap_cfg->fast_io = true; regmap_cfg->max_register = data->max_register; + regmap_cfg->readable_reg = data->readable_reg; + regmap_cfg->writeable_reg = data->writeable_reg; regmap =devm_regmap_init_mmio (dev, sysc->base, regmap_cfg);if (IS_ERR (regmap))
drivers/soc/renesas/rz-sysc.h +4 -0
@@ -34,10 +34,14 @@ struct rz_sysc_soc_id_init_data {/** * struct rz_sysc_init_data - RZ SYSC initialization data * @soc_id_init_data: RZ SYSC SoC ID initialization data +* @writeable_reg: Regmap writeable register check function +* @readable_reg: Regmap readable register check function * @max_register: Maximum SYSC register offset to be used by the regmap config */ struct rz_sysc_init_data {const struct rz_sysc_soc_id_init_data *soc_id_init_data; +bool (*writeable_reg)(struct device *dev,unsigned int reg); +bool (*readable_reg)(struct device *dev,unsigned int reg);u32 max_register; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 277/614 arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <[email protected]>
[ Upstream commit 92e6e0b0e595afdda6296c760551ad3ffe9d5231 ]
The BL24C16 EEPROM chip found on Radxa ROCK 5A is connected to the i2c0 bus, [1] so move the eeprom node from the i2c2 bus to the i2c0 bus.
[1] Link: https://dl.radxa.com/rock5/5a/docs/hw/radxa_rock5a_V1.1_sch.pdf p.19
--- arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts +6 -6
@@ -228,6 +228,12 @@ regulator-state-mem { regulator-off-in-suspend; }; }; + + eeprom: eeprom@50 { + compatible = "belling,bl24c16a", "atmel,24c16"; + reg = <0x50>; + pagesize = <16>; + }; }; &i2c2 {
@@ -249,12 +255,6 @@ regulator-state-mem { regulator-off-in-suspend; }; }; - - eeprom: eeprom@50 { - compatible = "belling,bl24c16a", "atmel,24c16"; - reg = <0x50>; - pagesize = <16>; - }; }; &i2c3 {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 278/614 arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <[email protected]>
[ Upstream commit 3069ff1930aa71e125874c780ffaa6caeda5800a ]
The VCC supply for the BL24C16 EEPROM chip found on Radxa ROCK 5A is vcc_3v3_pmu, which is routed to vcc_3v3_s3 via a zero-ohm resistor. [1] Describe this supply.
[1] https://dl.radxa.com/rock5/5a/docs/hw/radxa_rock5a_V1.1_sch.pdf p.4, p.19
--- arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts +2 -1
@@ -233,6 +233,7 @@ eeprom: eeprom@50 { compatible = "belling,bl24c16a", "atmel,24c16"; reg = <0x50>; pagesize = <16>; + vcc-supply = <&vcc_3v3_pmu>; }; };
@@ -600,7 +601,7 @@ regulator-state-mem { }; }; - vcc_3v3_s3: dcdc-reg8 { + vcc_3v3_pmu: vcc_3v3_s3: dcdc-reg8 { regulator-name = "vcc_3v3_s3"; regulator-always-on; regulator-boot-on;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 279/614 arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <[email protected]>
[ Upstream commit 260316d35cf8f8606c5ed7a349cc92e1e71d8150 ]
The VCC supply for the BL24C16 EEPROM chip found on Radxa ROCK 3C is vcca1v8_pmu. [1] Describe this supply.
[1] https://dl.radxa.com/rock3/docs/hw/3c/v1400/radxa_rock_3c_v1400_schematic.pdf p.13
--- arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts +1 -0
@@ -466,6 +466,7 @@ eeprom: eeprom@50 { compatible = "belling,bl24c16a", "atmel,24c16"; reg = <0x50>; pagesize = <16>; + vcc-supply = <&vcca1v8_pmu>; }; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 280/614 perf vendor metrics s390: Avoid has_event(INSTRUCTIONS)
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit c1932fb85af8e51ac9f6bd9947145b06c716106e ]
The instructions event is now provided in json meaning the has_event test always succeeds. Switch to using non-legacy event names in the affected metrics.
--- tools/perf/pmu-events/arch/s390/cf_z16/transaction.json | 8 ++++---- tools/perf/pmu-events/arch/s390/cf_z17/transaction.json | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-)
tools/perf/pmu-events/arch/s390/cf_z16/transaction.json +4 -4
@@ -7,17 +7,17 @@ { "BriefDescription": "Cycles per Instruction", "MetricName": "cpi", - "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(INSTRUCTIONS) else 0" + "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(CPU_CYCLES) else 0" }, { "BriefDescription": "Problem State Instruction Ratio", "MetricName": "prbstate", - "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0" + "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(PROBLEM_STATE_INSTRUCTIONS) else 0" }, { "BriefDescription": "Level One Miss per 100 Instructions", "MetricName": "l1mp", - "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0" + "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(L1I_DIR_WRITES) else 0" }, { "BriefDescription": "Percentage sourced from Level 2 cache",
@@ -52,7 +52,7 @@ { "BriefDescription": "Estimated Instruction Complexity CPI infinite Level 1", "MetricName": "est_cpi", - "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(INSTRUCTIONS) else 0" + "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(CPU_CYCLES) else 0" }, { "BriefDescription": "Estimated Sourcing Cycles per Level 1 Miss",
tools/perf/pmu-events/arch/s390/cf_z17/transaction.json +4 -4
@@ -7,17 +7,17 @@ { "BriefDescription": "Cycles per Instruction", "MetricName": "cpi", - "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(INSTRUCTIONS) else 0" + "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(CPU_CYCLES) else 0" }, { "BriefDescription": "Problem State Instruction Ratio", "MetricName": "prbstate", - "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0" + "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(PROBLEM_STATE_INSTRUCTIONS) else 0" }, { "BriefDescription": "Level One Miss per 100 Instructions", "MetricName": "l1mp", - "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0" + "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(L1I_DIR_WRITES) else 0" }, { "BriefDescription": "Percentage sourced from Level 2 cache",
@@ -52,7 +52,7 @@ { "BriefDescription": "Estimated Instruction Complexity CPI infinite Level 1", "MetricName": "est_cpi", - "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(INSTRUCTIONS) else 0" + "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(L1C_TLB2_MISSES) else 0" }, { "BriefDescription": "Estimated Sourcing Cycles per Level 1 Miss",
Signature · 1 line
2.51.0
Re: [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS)
Quoted 8 lines · Greg Kroah-Hartman
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit
c1932fb85af8e51ac9f6bd9947145b06c716106e]
Quoted 7 lines
The instructions event is now provided in json meaning the
has_eventtest always succeeds. Switch to using non-legacy event names in the affected metrics.Reported-by Thomas Richter <[email protected]>Fixes 0012e0fa221b ("perf jevents: Add legacy-hardware and legacy-cache json")
Hmm, this ^^^ is also a 19-rc1 commit, not present in .18-stable. Why were these patches added?
Quoted 5 lines
Signed-off-by Ian Rogers <[email protected]>Reviewed-by Thomas Richter <[email protected]>Tested-by Thomas Richter <[email protected]>Signed-off-by Namhyung Kim <[email protected]>Signed-off-by Sasha Levin <[email protected]>
Signature · 2 lines
js suse labs
Greg Kroah-Hartman
maintainerRe: [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS)
Quoted 13 lines · Jiri Slaby
Quoted 12 lines · Greg Kroah-Hartman
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit
c1932fb85af8e51ac9f6bd9947145b06c716106e]The instructions event is now provided in json meaning the
has_eventtest always succeeds. Switch to using non-legacy event names in the affected metrics.
Quoted 6 lines
Quoted 3 lines
Reported-by Thomas Richter <[email protected]>Fixes 0012e0fa221b ("perf jevents: Add legacy-hardware and legacy-cache json")Hmm, this ^^^ is also a 19-rc1 commit, not present in .18-stable. Why were these patches added?
Ugh, let me go drop this and then verify _all_ of the commits in the tree are actually fixing something in the right branch.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 281/614 crypto: iaa - Fix incorrect return value in save_iaa_wq()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 76ce17f6f7f78ab79b9741388bdb4dafa985b4e9 ]
The save_iaa_wq() function unconditionally returns 0, even when an error is encountered. This prevents the error code from being propagated to the caller.
Fix this by returning the 'ret' variable, which holds the actual status of the operations within the function.
--- drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/intel/iaa/iaa_crypto_main.c +1 -1
@@ -805,7 +805,7 @@ static int save_iaa_wq(struct idxd_wq *wq)if (!cpus_per_iaa) cpus_per_iaa =1 ; out: -return 0 ; +return ret; }static void remove_iaa_wq (struct idxd_wq *wq)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 282/614 s390/fpu: Fix false-positive kmsan report in fpu_vstl()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Nikiforov <[email protected]>
[ Upstream commit 14e4e4175b64dd9216b522f6ece8af6997d063b2 ]
A false-positive kmsan report is detected when running ping command.
An inline assembly instruction 'vstl' can write varied amount of bytes depending on value of 'index' argument. If 'index' > 0, 'vstl' writes at least 2 bytes.
clang generates kmsan write helper call depending on inline assembly constraints. Constraints are evaluated compile-time, but value of 'index' argument is known only at runtime.
clang currently generates call to __msan_instrument_asm_store with 1 byte as size. Manually call kmsan function to indicate correct amount of bytes written and fix false-positive report.
This change fixes following kmsan reports:
[ 36.563119] ===================================================== [ 36.563594] BUG: KMSAN: uninit-value in virtqueue_add+0x35c6/0x7c70 [ 36.563852] virtqueue_add+0x35c6/0x7c70 [ 36.564016] virtqueue_add_outbuf+0xa0/0xb0 [ 36.564266] start_xmit+0x288c/0x4a20 [ 36.564460] dev_hard_start_xmit+0x302/0x900 [ 36.564649] sch_direct_xmit+0x340/0xea0 [ 36.564894] __dev_queue_xmit+0x2e94/0x59b0 [ 36.565058] neigh_resolve_output+0x936/0xb40 [ 36.565278] __neigh_update+0x2f66/0x3a60 [ 36.565499] neigh_update+0x52/0x60 [ 36.565683] arp_process+0x1588/0x2de0 [ 36.565916] NF_HOOK+0x1da/0x240 [ 36.566087] arp_rcv+0x3e4/0x6e0 [ 36.566306] __netif_receive_skb_list_core+0x1374/0x15a0 [ 36.566527] netif_receive_skb_list_internal+0x1116/0x17d0 [ 36.566710] napi_complete_done+0x376/0x740 [ 36.566918] virtnet_poll+0x1bae/0x2910 [ 36.567130] __napi_poll+0xf4/0x830 [ 36.567294] net_rx_action+0x97c/0x1ed0 [ 36.567556] handle_softirqs+0x306/0xe10 [ 36.567731] irq_exit_rcu+0x14c/0x2e0 [ 36.567910] do_io_irq+0xd4/0x120 [ 36.568139] io_int_handler+0xc2/0xe8 [ 36.568299] arch_cpu_idle+0xb0/0xc0 [ 36.568540] arch_cpu_idle+0x76/0xc0 [ 36.568726] default_idle_call+0x40/0x70 [ 36.568953] do_idle+0x1d6/0x390 [ 36.569486] cpu_startup_entry+0x9a/0xb0 [ 36.569745] rest_init+0x1ea/0x290 [ 36.570029] start_kernel+0x95e/0xb90 [ 36.570348] startup_continue+0x2e/0x40 [ 36.570703] [ 36.570798] Uninit was created at: [ 36.571002] kmem_cache_alloc_node_noprof+0x9e8/0x10e0 [ 36.571261] kmalloc_reserve+0x12a/0x470 [ 36.571553] __alloc_skb+0x310/0x860 [ 36.571844] __ip_append_data+0x483e/0x6a30 [ 36.572170] ip_append_data+0x11c/0x1e0 [ 36.572477] raw_sendmsg+0x1c8c/0x2180 [ 36.572818] inet_sendmsg+0xe6/0x190 [ 36.573142] __sys_sendto+0x55e/0x8e0 [ 36.573392] __s390x_sys_socketcall+0x19ae/0x2ba0 [ 36.573571] __do_syscall+0x12e/0x240 [ 36.573823] system_call+0x6e/0x90 [ 36.573976] [ 36.574017] Byte 35 of 98 is uninitialized [ 36.574082] Memory access of size 98 starts at 0000000007aa0012 [ 36.574218] [ 36.574325] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.17.0-dirty #16 NONE [ 36.574541] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.574617] Hardware name: IBM 3931 A01 703 (KVM/Linux) [ 36.574755] =====================================================
[ 63.532541] ===================================================== [ 63.533639] BUG: KMSAN: uninit-value in virtqueue_add+0x35c6/0x7c70 [ 63.533989] virtqueue_add+0x35c6/0x7c70 [ 63.534940] virtqueue_add_outbuf+0xa0/0xb0 [ 63.535861] start_xmit+0x288c/0x4a20 [ 63.536708] dev_hard_start_xmit+0x302/0x900 [ 63.537020] sch_direct_xmit+0x340/0xea0 [ 63.537997] __dev_queue_xmit+0x2e94/0x59b0 [ 63.538819] neigh_resolve_output+0x936/0xb40 [ 63.539793] ip_finish_output2+0x1ee2/0x2200 [ 63.540784] __ip_finish_output+0x272/0x7a0 [ 63.541765] ip_finish_output+0x4e/0x5e0 [ 63.542791] ip_output+0x166/0x410 [ 63.543771] ip_push_pending_frames+0x1a2/0x470 [ 63.544753] raw_sendmsg+0x1f06/0x2180 [ 63.545033] inet_sendmsg+0xe6/0x190 [ 63.546006] __sys_sendto+0x55e/0x8e0 [ 63.546859] __s390x_sys_socketcall+0x19ae/0x2ba0 [ 63.547730] __do_syscall+0x12e/0x240 [ 63.548019] system_call+0x6e/0x90 [ 63.548989] [ 63.549779] Uninit was created at: [ 63.550691] kmem_cache_alloc_node_noprof+0x9e8/0x10e0 [ 63.550975] kmalloc_reserve+0x12a/0x470 [ 63.551969] __alloc_skb+0x310/0x860 [ 63.552949] __ip_append_data+0x483e/0x6a30 [ 63.553902] ip_append_data+0x11c/0x1e0 [ 63.554912] raw_sendmsg+0x1c8c/0x2180 [ 63.556719] inet_sendmsg+0xe6/0x190 [ 63.557534] __sys_sendto+0x55e/0x8e0 [ 63.557875] __s390x_sys_socketcall+0x19ae/0x2ba0 [ 63.558869] __do_syscall+0x12e/0x240 [ 63.559832] system_call+0x6e/0x90 [ 63.560780] [ 63.560972] Byte 35 of 98 is uninitialized [ 63.561741] Memory access of size 98 starts at 0000000005704312 [ 63.561950] [ 63.562824] CPU: 3 UID: 0 PID: 192 Comm: ping Tainted: G B N 6.17.0-dirty #16 NONE [ 63.563868] Tainted: [B]=BAD_PAGE, [N]=TEST [ 63.564751] Hardware name: IBM 3931 A01 703 (KVM/Linux) [ 63.564986] =====================================================
--- arch/s390/include/asm/fpu-insn.h | 3 +++ 1 file changed, 3 insertions(+)
arch/s390/include/asm/fpu-insn.h +3 -0
@@ -12,6 +12,7 @@#ifndef __ASSEMBLER__#include <linux/instrumented.h> +#include <linux/kmsan.h> #include <asm/asm-extable.h> asm(".include \"asm/fpu-insn-asm.h\"\n" );
@@ -393,6 +394,7 @@ static __always_inline void fpu_vstl(u8 v1, u32 index, const void *vxr) : [vxr] "=Q" (*(u8 *)vxr) : [index] "d" (index), [v1] "I" (v1) : "memory"); + kmsan_unpoison_memory(vxr, size); }#else /* CONFIG_CC_HAS_ASM_AOR_FORMAT_FLAGS */
@@ -409,6 +411,7 @@ static __always_inline void fpu_vstl(u8 v1, u32 index, const void *vxr) : [vxr] "=R" (*(u8 *)vxr) : [index] "d" (index), [v1] "I" (v1) : "memory", "1"); + kmsan_unpoison_memory(vxr, size); }#endif /* CONFIG_CC_HAS_ASM_AOR_FORMAT_FLAGS */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 283/614 pwm: Simplify printf to emit chip->npwm in $debugfs/pwm
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 3cf8e55894b51c14f8500cae5e68ed48b1b0f3fd ]
Instead of caring to correctly pluralize "PWM device(s)" using
(chip->npwm != 1) ? "s" : ""
or
str_plural(chip->npwm)
just simplify the format to not need a plural-s.
Stable-dep-of: 5f7ff902e7f3 ("pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id")
--- drivers/pwm/core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/pwm/core.c +2 -3
@@ -2696,11 +2696,10 @@ static int pwm_seq_show(struct seq_file *s, void *v) {struct pwm_chip *chip = v; -seq_printf (s,"%s%d: %s/%s, %d PWM device%s\n" , +seq_printf (s,"%s%d: %s/%s, npwm: %d\n" , (char *)s->private, chip->id,pwmchip_parent (chip)->bus ?pwmchip_parent (chip)->bus->name :"no-bus" , -dev_name (pwmchip_parent (chip)), chip->npwm, - (chip->npwm !=1 ) ?"s" :"" ); +dev_name (pwmchip_parent (chip)), chip->npwm);pwm_dbg_show (chip, s);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 284/614 pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 5f7ff902e7f324c10f2b64c5ba2e5e2d0bc4e07e ]
%u is the right conversion specifier to emit an unsigned int value.
--- drivers/pwm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pwm/core.c +1 -1
@@ -2696,7 +2696,7 @@ static int pwm_seq_show(struct seq_file *s, void *v) {struct pwm_chip *chip = v; -seq_printf (s,"%s%d: %s/%s, npwm: %d\n" , +seq_printf (s,"%s%u: %s/%s, npwm: %u\n" , (char *)s->private, chip->id,pwmchip_parent (chip)->bus ?pwmchip_parent (chip)->bus->name :"no-bus" ,dev_name (pwmchip_parent (chip)), chip->npwm);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 285/614 arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Talari <[email protected]>
[ Upstream commit 9c92d36b0b1ea8b2a19dbe0416434f3491dbfaaf ]
For BT use cases, pins are configured with pull-up state in sleep state to avoid noise. If IRQ type is configured as level high and the GPIO line is also in a high state, it causes continuous interrupt assertions leading to an IRQ storm when wakeup irq enables at system suspend/runtime suspend.
Switching to edge-triggered interrupt (IRQ_TYPE_EDGE_FALLING) resolves this by only triggering on state transitions (high-to-low) rather than maintaining sensitivity to the static level state, effectively preventing the continuous interrupt condition and eliminating the wakeup IRQ storm.
--- arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/qrb2210-rb1.dts +1 -1
@@ -649,7 +649,7 @@ key_volp_n: key-volp-n-state { &uart3 { /delete-property/ interrupts; interrupts-extended = <&intc GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>, - <&tlmm 11 IRQ_TYPE_LEVEL_HIGH>; + <&tlmm 11 IRQ_TYPE_EDGE_FALLING>; pinctrl-0 = <&uart3_default>; pinctrl-1 = <&uart3_sleep>; pinctrl-names = "default", "sleep";
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 286/614 drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit d9792823d18ff9895eaf5769a29a54804f24bc25 ]
The commit a106ed98af68 ("drm/msm/dpu: use devres-managed allocation for HW blocks") dropped all dpu_hw_foo_destroy() functions, but the prototype for dpu_hw_dsc_destroy() was omitted. Drop it now to clean up the header.
Patchwork: https://patchwork.freedesktop.org/patch/683697/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 ------ 1 file changed, 6 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h +0 -6
@@ -71,12 +71,6 @@ struct dpu_hw_dsc *dpu_hw_dsc_init_1_2(struct drm_device *dev,const struct dpu_dsc_cfg *cfg, void __iomem *addr); -/** -* dpu_hw_dsc_destroy - destroys dsc driver context -* @dsc: Pointer to dsc driver context returned by dpu_hw_dsc_init -*/ -void dpu_hw_dsc_destroy (struct dpu_hw_dsc *dsc); -static inline struct dpu_hw_dsc *to_dpu_hw_dsc (struct dpu_hw_blk *hw) { return container_of(hw, struct dpu_hw_dsc, base);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 287/614 ps3disk: use memcpy_{from,to}_bvec index
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rene Rebe <[email protected]>
[ Upstream commit 79bd8c9814a273fa7ba43399e1c07adec3fc95db ]
With 6e0a48552b8c (ps3disk: use memcpy_{from,to}_bvec) converting ps3disk to new bvec helpers, incrementing the offset was accidently lost, corrupting consecutive buffers. Restore index for non-corrupted data transfers.
--- drivers/block/ps3disk.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/block/ps3disk.c +4 -0
@@ -85,10 +85,14 @@ static void ps3disk_scatter_gather(struct ps3_storage_device *dev,struct bio_vec bvec;rq_for_each_segment (bvec, req, iter) { +dev_dbg (&dev->sbd.core,"%s:%u: %u sectors from %llu\n" , + __func__, __LINE__,bio_sectors (iter.bio), + iter.bio->bi_iter.bi_sector);if (gather)memcpy_from_bvec (dev->bounce_buf + offset, &bvec);else memcpy_to_bvec (&bvec, dev->bounce_buf + offset); + offset += bvec.bv_len; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 288/614 soc/tegra: fuse: speedo-tegra210: Update speedo IDs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <[email protected]>
[ Upstream commit ce27c9c2129679551c4e5fe71c1c5d42fff399c2 ]
Existing code only sets CPU and GPU speedo IDs 0 and 1. The CPU DVFS code supports 11 IDs and nouveau supports 5. This aligns with what the downstream vendor kernel supports. Align SKUs with the downstream list.
The Tegra210 CVB tables were added in the first referenced fixes commit. Since then, all Tegra210 SoCs have tried to scale to 1.9 GHz, when the supported devkits are only supposed to scale to 1.5 or 1.7 GHZ. Overclocking should not be the default state.
--- drivers/soc/tegra/fuse/speedo-tegra210.c | 62 ++++++++++++++++-------- 1 file changed, 43 insertions(+), 19 deletions(-)
drivers/soc/tegra/fuse/speedo-tegra210.c +43 -19
@@ -65,27 +65,51 @@ static void __init rev_sku_to_speedo_ids(struct tegra_sku_info *sku_info, sku_info->gpu_speedo_id =0 ; *threshold =THRESHOLD_INDEX_0 ; -switch (sku) { -case 0x00 :/* Engineering SKU */ -case 0x01 :/* Engineering SKU */ -case 0x07 : -case 0x17 : -case 0x27 : -if (speedo_rev >=2 ) +if (sku_info->revision >=TEGRA_REVISION_A02 ) { +switch (sku) { +case 0x00 :/* Engineering SKU */ +case 0x01 :/* Engineering SKU */ +case 0x13 : + sku_info->cpu_speedo_id =5 ; + sku_info->gpu_speedo_id =2 ; +break ; + +case 0x07 : +case 0x17 : +case 0x1F : + sku_info->cpu_speedo_id =7 ; + sku_info->gpu_speedo_id =2 ; +break ; + +case 0x27 : + sku_info->cpu_speedo_id =1 ; + sku_info->gpu_speedo_id =2 ; +break ; + +case 0x83 : + sku_info->cpu_speedo_id =3 ; + sku_info->gpu_speedo_id =3 ; +break ; + +case 0x87 : + sku_info->cpu_speedo_id =2 ; sku_info->gpu_speedo_id =1 ; -break ; - -case 0x13 : -if (speedo_rev >=2 ) - sku_info->gpu_speedo_id =1 ; - - sku_info->cpu_speedo_id =1 ; -break ; - -default : +break ; + +case 0x8F : + sku_info->cpu_speedo_id =9 ; + sku_info->gpu_speedo_id =2 ; +break ; + +default : +pr_err ("Tegra210: unknown revision 2 or newer SKU %#04x\n" , sku); +/* Using the default for the error case */ +break ; + } + }else if (sku ==0x00 || sku ==0x01 || sku ==0x07 || sku ==0x13 || sku ==0x17 ) { + sku_info->gpu_speedo_id =1 ; + }else {pr_err ("Tegra210: unknown SKU %#04x\n" , sku); -/* Using the default for the error case */ -break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 289/614 PCI: Prevent resource tree corruption when BAR resize fails
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 91c4c89db41499eea1b29c56655f79c3bae66e93 ]
pbus_reassign_bridge_resources() saves bridge windows into the saved list before attempting to adjust resource assignments to perform a BAR resize operation. If resource adjustments cannot be completed fully, rollback is attempted by restoring the resource from the saved list.
The rollback, however, does not check whether the resources it restores were assigned by the partial resize attempt. If restore changes addresses of the resource, it can result in corrupting the resource tree.
An example of a corrupted resource tree with overlapping addresses:
6200000000000-6203fbfffffff : pciex@620c3c0000000
6200000000000-6203fbff0ffff : PCI Bus 0030:01
6200020000000-62000207fffff : 0030:01:00.0
6200000000000-6203fbff0ffff : PCI Bus 0030:02A resource that are assigned into the resource tree must remain unchanged. Thus, release such a resource before attempting to restore and claim it back.
For simplicity, always do the release and claim back for the resource even in the cases where it is restored to the same address range.
Note: this fix may "break" some cases where devices "worked" because the resource tree corruption allowed address space double counting to fit more resource than what can now be assigned without double counting. The upcoming changes to BAR resizing should address those scenarios (to the extent possible).
--- drivers/pci/setup-bus.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/pci/setup-bus.c +5 -0
@@ -2504,6 +2504,11 @@ int pbus_reassign_bridge_resources(struct pci_bus *bus, struct resource *res) bridge = dev_res->dev; i =pci_resource_num (bridge, res); +if (res->parent) { +release_child_resources (res); +pci_release_resource (bridge, i); + } +restore_dev_resource (dev_res);pci_claim_resource (bridge, i);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 290/614 kbuild: dont enable CC_CAN_LINK if the dummy program generates warnings
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit d81d9d389b9b73acd68f300c8889c7fa1acd4977 ]
It is possible that the kernel toolchain generates warnings when used together with the system toolchain. This happens for example when the older kernel toolchain does not handle new versions of sframe debug information. While these warnings where ignored during the evaluation of CC_CAN_LINK, together with CONFIG_WERROR the actual userprog build will later fail.
Example warning:
.../x86_64-linux/13.2.0/../../../../x86_64-linux/bin/ld:
error in /lib/../lib64/crt1.o(.sframe); no .sframe will be created
collect2: error: ld returned 1 exit status
Make sure that the very simple example program does not generate warnings already to avoid breaking the userprog compilations.
--- scripts/cc-can-link.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/cc-can-link.sh +1 -1
@@ -1,7 +1,7 @@ #!/bin/sh # SPDX-License-Identifier: GPL-2.0 -cat << "END" | $@ -x c - -o /dev/null >/dev/null 2>&1 +cat << "END" | $@ -Werror -Wl,--fatal-warnings -x c - -o /dev/null >/dev/null 2>&1 #include <stdio.h> int main(void) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 291/614 bpf: Prevent nesting overflow in bpf_try_get_buffers
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sahil Chandna <[email protected]>
[ Upstream commit c1da3df7191f1b4df9256bcd30d78f78201e1d17 ]
bpf_try_get_buffers() returns one of multiple per-CPU buffers based on a per-CPU nesting counter. This mechanism expects that buffers are not endlessly acquired before being returned. migrate_disable() ensures that a task remains on the same CPU, but it does not prevent the task from being preempted by another task on that CPU.
Without disabled preemption, a task may be preempted while holding a buffer, allowing another task to run on same CPU and acquire an additional buffer. Several such preemptions can cause the per-CPU nest counter to exceed MAX_BPRINTF_NEST_LEVEL and trigger the warning in bpf_try_get_buffers(). Adding preempt_disable()/preempt_enable() around buffer acquisition and release prevents this task preemption and preserves the intended bounded nesting behavior.
--- kernel/bpf/helpers.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/bpf/helpers.c +3 -0
@@ -777,9 +777,11 @@ int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs) {int nest_level; +preempt_disable (); nest_level =this_cpu_inc_return (bpf_bprintf_nest_level);if (WARN_ON_ONCE (nest_level >MAX_BPRINTF_NEST_LEVEL )) {this_cpu_dec (bpf_bprintf_nest_level); +preempt_enable ();return -EBUSY ; } *bufs =this_cpu_ptr (&bpf_bprintf_bufs[nest_level -1 ]);
@@ -792,6 +794,7 @@ void bpf_put_buffers(void)if (WARN_ON_ONCE (this_cpu_read (bpf_bprintf_nest_level) ==0 ))return ;this_cpu_dec (bpf_bprintf_nest_level); +preempt_enable (); }void bpf_bprintf_cleanup (struct bpf_bprintf_data *data)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 292/614 bpf: Handle return value of ftrace_set_filter_ip in register_fentry
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <[email protected]>
[ Upstream commit fea3f5e83c5cd80a76d97343023a2f2e6bd862bf ]
The error that returned by ftrace_set_filter_ip() in register_fentry() is not handled properly. Just fix it.
--- kernel/bpf/trampoline.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/bpf/trampoline.c +3 -1
@@ -220,7 +220,9 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr) }if (tr->func.ftrace_managed) { -ftrace_set_filter_ip (tr->fops, (unsigned long )ip,0 ,1 ); + ret =ftrace_set_filter_ip (tr->fops, (unsigned long )ip,0 ,1 ); +if (ret) +return ret; ret =register_ftrace_direct (tr->fops, (long )new_addr); }else { ret =bpf_arch_text_poke (ip,BPF_MOD_CALL ,NULL , new_addr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 293/614 selftests/bpf: Fix failure paths in send_signal test
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit c13339039891dbdfa6c1972f0483bd07f610b776 ]
When test_send_signal_kern__open_and_load() fails parent closes the pipe which cases ASSERT_EQ(read(pipe_p2c...)) to fail, but child continues and enters infinite loop, while parent is stuck in wait(NULL). Other error paths have similar issue, so kill the child before waiting on it.
The bug was discovered while compiling all of selftests with -O1 instead of -O2 which caused progs/test_send_signal_kern.c to fail to load.
--- tools/testing/selftests/bpf/prog_tests/send_signal.c | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/bpf/prog_tests/send_signal.c +5 -0
@@ -206,6 +206,11 @@ static void test_send_signal_common(struct perf_event_attr *attr, skel_open_load_failure:close (pipe_c2p[0 ]);close (pipe_p2c[1 ]); +/* +* Child is either about to exit cleanly or stuck in case of errors. +* Nudge it to exit. +*/ +kill (pid,SIGKILL );wait (NULL ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 294/614 bpf: Check skb->transport_header is set in bpf_skb_check_mtu
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <[email protected]>
[ Upstream commit d946f3c98328171fa50ddb908593cf833587f725 ]
The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used:
bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)
The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used:
WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb
For a normal ingress skb (not test_run), skb_reset_transport_header
is performed but there is plan to avoid setting it as described in
commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()").
This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.
--- net/core/filter.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/core/filter.c +6 -3
@@ -6429,9 +6429,12 @@ BPF_CALL_5(bpf_skb_check_mtu, struct sk_buff *, skb,*/ if (skb_is_gso (skb)) { ret =BPF_MTU_CHK_RET_SUCCESS ; -if (flags &BPF_MTU_CHK_SEGS && - !skb_gso_validate_network_len (skb, mtu)) - ret =BPF_MTU_CHK_RET_SEGS_TOOBIG ; +if (flags &BPF_MTU_CHK_SEGS ) { +if (!skb_transport_header_was_set (skb)) +return -EINVAL ; +if (!skb_gso_validate_network_len (skb, mtu)) + ret =BPF_MTU_CHK_RET_SEGS_TOOBIG ; + } } out: *mtu_len = mtu;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 295/614 mshv: Fix deposit memory in MSHV_ROOT_HVCALL
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Das Neves <[email protected]>
[ Upstream commit 4cc1aa469cd6b714adc958547a4866247bfd60a9 ]
When the MSHV_ROOT_HVCALL ioctl is executing a hypercall, and gets HV_STATUS_INSUFFICIENT_MEMORY, it deposits memory and then returns -EAGAIN to userspace. The expectation is that the VMM will retry.
However, some VMM code in the wild doesn't do this and simply fails. Rather than force the VMM to retry, change the ioctl to deposit memory on demand and immediately retry the hypercall as is done with all the other hypercall helper functions.
In addition to making the ioctl easier to use, removing the need for multiple syscalls improves performance.
There is a complication: unlike the other hypercall helper functions, in MSHV_ROOT_HVCALL the input is opaque to the kernel. This is problematic for rep hypercalls, because the next part of the input list can't be copied on each loop after depositing pages (this was the original reason for returning -EAGAIN in this case).
Introduce hv_do_rep_hypercall_ex(), which adds a 'rep_start' parameter. This solves the issue, allowing the deposit loop in MSHV_ROOT_HVCALL to restart a rep hypercall after depositing pages partway through.
--- drivers/hv/mshv_root_main.c | 58 ++++++++++++++++++---------------- include/asm-generic/mshyperv.h | 17 ++++++++-- 2 files changed, 44 insertions(+), 31 deletions(-)
drivers/hv/mshv_root_main.c +30 -28
@@ -159,6 +159,7 @@ static int mshv_ioctl_passthru_hvcall(struct mshv_partition *partition,unsigned int pages_order;void *input_pg =NULL ;void *output_pg =NULL ; +u16 reps_completed;if (copy_from_user (&args, user_args,sizeof (args)))return -EFAULT ;
@@ -210,41 +211,42 @@ static int mshv_ioctl_passthru_hvcall(struct mshv_partition *partition,*/ *(u64 *)input_pg = partition->pt_id; -if (args.reps) - status =hv_do_rep_hypercall (args.code, args.reps,0 , - input_pg, output_pg); -else - status =hv_do_hypercall (args.code, input_pg, output_pg); - -if (hv_result (status) ==HV_STATUS_CALL_PENDING ) { -if (is_async) { -mshv_async_hvcall_handler (partition, &status); - }else {/* Paranoia check. This shouldn't happen! */ - ret = -EBADFD ; - goto free_pages_out; + reps_completed =0 ; +do { +if (args.reps) { + status =hv_do_rep_hypercall_ex (args.code, args.reps, +0 , reps_completed, + input_pg, output_pg); + reps_completed =hv_repcomp (status); + }else { + status =hv_do_hypercall (args.code, input_pg, output_pg); } - } -if (hv_result (status) ==HV_STATUS_INSUFFICIENT_MEMORY ) { - ret =hv_call_deposit_pages (NUMA_NO_NODE , partition->pt_id,1 ); -if (!ret) - ret = -EAGAIN ; - }else if (!hv_result_success (status)) { - ret =hv_result_to_errno (status); - } +if (hv_result (status) ==HV_STATUS_CALL_PENDING ) { +if (is_async) { +mshv_async_hvcall_handler (partition, &status); + }else {/* Paranoia check. This shouldn't happen! */ + ret = -EBADFD ; + goto free_pages_out; + } + } + +if (hv_result_success (status)) +break ; + +if (hv_result (status) !=HV_STATUS_INSUFFICIENT_MEMORY ) + ret =hv_result_to_errno (status); +else + ret =hv_call_deposit_pages (NUMA_NO_NODE , + partition->pt_id,1 ); + }while (!ret); -/* -* Always return the status and output data regardless of result. -* The VMM may need it to determine how to proceed. E.g. the status may -* contain the number of reps completed if a rep hypercall partially -* succeeded. -*/ args.status =hv_result (status); - args.reps = args.reps ?hv_repcomp (status) :0 ; + args.reps = reps_completed;if (copy_to_user (user_args, &args,sizeof (args))) ret = -EFAULT ; -if (output_pg && +if (!ret && output_pg &©_to_user ((void __user *)args.out_ptr, output_pg, args.out_sz)) ret = -EFAULT ;
include/asm-generic/mshyperv.h +14 -3
@@ -124,10 +124,12 @@ static inline unsigned int hv_repcomp(u64 status)/* * Rep hypercalls. Callers of this functions are supposed to ensure that -* rep_count and varhead_size comply with Hyper-V hypercall definition. +* rep_count, varhead_size, and rep_start comply with Hyper-V hypercall +* definition. */ -static inline u64 hv_do_rep_hypercall (u16 code,u16 rep_count,u16 varhead_size, -void *input,void *output) +static inline u64 hv_do_rep_hypercall_ex (u16 code,u16 rep_count, +u16 varhead_size,u16 rep_start, +void *input,void *output) {u64 control = code;u64 status;
@@ -135,6 +137,7 @@ static inline u64 hv_do_rep_hypercall(u16 code, u16 rep_count, u16 varhead_size, control |= (u64 )varhead_size <<HV_HYPERCALL_VARHEAD_OFFSET ; control |= (u64 )rep_count <<HV_HYPERCALL_REP_COMP_OFFSET ; + control |= (u64 )rep_start <<HV_HYPERCALL_REP_START_OFFSET ; do { status = hv_do_hypercall(control, input, output);
@@ -152,6 +155,14 @@ static inline u64 hv_do_rep_hypercall(u16 code, u16 rep_count, u16 varhead_size,return status; } +/* For the typical case where rep_start is 0 */ +static inline u64 hv_do_rep_hypercall (u16 code,u16 rep_count,u16 varhead_size, +void *input,void *output) +{ +return hv_do_rep_hypercall_ex (code, rep_count, varhead_size,0 , + input, output); +} +/* Generate the guest OS identifier as described in the Hyper-V TLFS */ static inline u64 hv_generate_guest_id (u64 kernel_version) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 296/614 mshv: Fix create memory region overlap check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Das Neves <[email protected]>
[ Upstream commit ba9eb9b86d232854e983203dc2fb1ba18e316681 ]
The current check is incorrect; it only checks if the beginning or end of a region is within an existing region. This doesn't account for userspace specifying a region that begins before and ends after an existing region.
Change the logic to a range intersection check against gfns and uaddrs for each region.
Remove mshv_partition_region_by_uaddr() as it is no longer used.
--- drivers/hv/mshv_root_main.c | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-)
drivers/hv/mshv_root_main.c +11 -20
@@ -1174,21 +1174,6 @@ mshv_partition_region_by_gfn(struct mshv_partition *partition, u64 gfn)return NULL ; } -static struct mshv_mem_region * -mshv_partition_region_by_uaddr (struct mshv_partition *partition,u64 uaddr) -{ -struct mshv_mem_region *region; - -hlist_for_each_entry (region, &partition->pt_mem_regions, hnode) { -if (uaddr >= region->start_uaddr && - uaddr < region->start_uaddr + - (region->nr_pages <<HV_HYP_PAGE_SHIFT )) -return region; - } - -return NULL ; -} -/* * NB: caller checks and makes sure mem->size is page aligned * Returns: 0 with regionpp updated on success, or -errno
@@ -1198,15 +1183,21 @@ static int mshv_partition_create_region(struct mshv_partition *partition, struct mshv_mem_region **regionpp, bool is_mmio) { -struct mshv_mem_region *region; +struct mshv_mem_region *region, *rg;u64 nr_pages =HVPFN_DOWN (mem->size);/* Reject overlapping regions */ -if (mshv_partition_region_by_gfn (partition, mem->guest_pfn) || -mshv_partition_region_by_gfn (partition, mem->guest_pfn + nr_pages -1 ) || -mshv_partition_region_by_uaddr (partition, mem->userspace_addr) || -mshv_partition_region_by_uaddr (partition, mem->userspace_addr + mem->size -1 )) +hlist_for_each_entry (rg, &partition->pt_mem_regions, hnode) { +u64 rg_size = rg->nr_pages <<HV_HYP_PAGE_SHIFT ; + +if ((mem->guest_pfn + nr_pages <= rg->start_gfn || + rg->start_gfn + rg->nr_pages <= mem->guest_pfn) && + (mem->userspace_addr + mem->size <= rg->start_uaddr || + rg->start_uaddr + rg_size <= mem->userspace_addr)) +continue ; +return -EEXIST ; + } region =vzalloc (sizeof (*region) +sizeof (struct page *) * nr_pages);if (!region)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 297/614 watchdog: wdat_wdt: Fix ACPI table leak in probe function
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 25c0b472eab8379683d4eef681185c104bed8ffd ]
wdat_wdt_probe() calls acpi_get_table() to obtain the WDAT ACPI table but never calls acpi_put_table() on any paths. This causes a permanent ACPI table memory leak.
Add a single cleanup path which calls acpi_put_table() to ensure the ACPI table is always released.
--- drivers/watchdog/wdat_wdt.c | 64 +++++++++++++++++++++++++------------ 1 file changed, 43 insertions(+), 21 deletions(-)
drivers/watchdog/wdat_wdt.c +43 -21
@@ -326,19 +326,27 @@ static int wdat_wdt_probe(struct platform_device *pdev)return -ENODEV ; wdat =devm_kzalloc (dev,sizeof (*wdat),GFP_KERNEL ); -if (!wdat) -return -ENOMEM ; +if (!wdat) { + ret = -ENOMEM ; + goto out_put_table; + } regs =devm_kcalloc (dev, pdev->num_resources,sizeof (*regs),GFP_KERNEL ); -if (!regs) -return -ENOMEM ; +if (!regs) { + ret = -ENOMEM ; + goto out_put_table; + }/* WDAT specification wants to have >= 1ms period */ -if (tbl->timer_period <1 ) -return -EINVAL ; -if (tbl->min_count > tbl->max_count) -return -EINVAL ; +if (tbl->timer_period <1 ) { + ret = -EINVAL ; + goto out_put_table; + } +if (tbl->min_count > tbl->max_count) { + ret = -EINVAL ; + goto out_put_table; + } wdat->period = tbl->timer_period; wdat->wdd.min_timeout =DIV_ROUND_UP (wdat->period * tbl->min_count,1000 );
@@ -355,15 +363,20 @@ static int wdat_wdt_probe(struct platform_device *pdev) res = &pdev->resource[i];if (resource_type (res) ==IORESOURCE_MEM ) { reg =devm_ioremap_resource (dev, res); -if (IS_ERR (reg)) -return PTR_ERR (reg); +if (IS_ERR (reg)) { + ret =PTR_ERR (reg); + goto out_put_table; + } }else if (resource_type (res) ==IORESOURCE_IO ) { reg =devm_ioport_map (dev, res->start,1 ); -if (!reg) -return -ENOMEM ; +if (!reg) { + ret = -ENOMEM ; + goto out_put_table; + } }else {dev_err (dev,"Unsupported resource\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_table; } regs[i] = reg;
@@ -385,8 +398,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) } instr =devm_kzalloc (dev,sizeof (*instr),GFP_KERNEL ); -if (!instr) -return -ENOMEM ; +if (!instr) { + ret = -ENOMEM ; + goto out_put_table; + }INIT_LIST_HEAD (&instr->node); instr->entry = entries[i];
@@ -417,7 +432,8 @@ static int wdat_wdt_probe(struct platform_device *pdev)if (!instr->reg) {dev_err (dev,"I/O resource not found\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto out_put_table; } instructions = wdat->instructions[action];
@@ -425,8 +441,10 @@ static int wdat_wdt_probe(struct platform_device *pdev) instructions =devm_kzalloc (dev,sizeof (*instructions),GFP_KERNEL ); -if (!instructions) -return -ENOMEM ; +if (!instructions) { + ret = -ENOMEM ; + goto out_put_table; + }INIT_LIST_HEAD (instructions); wdat->instructions[action] = instructions;
@@ -443,7 +461,7 @@ static int wdat_wdt_probe(struct platform_device *pdev) ret =wdat_wdt_enable_reboot (wdat);if (ret) -return ret; + goto out_put_table;platform_set_drvdata (pdev, wdat);
@@ -460,12 +478,16 @@ static int wdat_wdt_probe(struct platform_device *pdev) ret =wdat_wdt_set_timeout (&wdat->wdd, timeout);if (ret) -return ret; + goto out_put_table;watchdog_set_nowayout (&wdat->wdd, nowayout);watchdog_stop_on_reboot (&wdat->wdd);watchdog_stop_on_unregister (&wdat->wdd); -return devm_watchdog_register_device (dev, &wdat->wdd); + ret =devm_watchdog_register_device (dev, &wdat->wdd); + +out_put_table: +acpi_put_table ((struct acpi_table_header *)tbl); +return ret; }static int wdat_wdt_suspend_noirq (struct device *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 298/614 watchdog: starfive: Fix resource leak in probe error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 5bcc5786a0cfa9249ccbe539833040a6285d0de3 ]
If pm_runtime_put_sync() fails after watchdog_register_device() succeeds, the probe function jumps to err_exit without unregistering the watchdog device. This leaves the watchdog registered in the subsystem while the driver fails to load, resulting in a resource leak.
Add a new error label err_unregister_wdt to properly unregister the watchdog device.
--- drivers/watchdog/starfive-wdt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/watchdog/starfive-wdt.c +3 -1
@@ -500,12 +500,14 @@ static int starfive_wdt_probe(struct platform_device *pdev)if (pm_runtime_enabled (&pdev->dev)) { ret =pm_runtime_put_sync (&pdev->dev);if (ret) - goto err_exit; + goto err_unregister_wdt; } }return 0 ; +err_unregister_wdt: +watchdog_unregister_device (&wdt->wdd); err_exit:starfive_wdt_disable_clock (wdt);pm_runtime_disable (&pdev->dev);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 299/614 iio: core: add missing mutex_destroy in iio_dev_release()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit f5d203467a31798191365efeb16cd619d2c8f23a ]
Add missing mutex_destroy() call in iio_dev_release() to properly clean up the mutex initialized in iio_device_alloc(). Ensure proper resource cleanup and follows kernel practices.
Found by code review.
While at it, create a lockdep key before mutex initialisation. This will help with converting it to the better API in the future.
--- drivers/iio/industrialio-core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/iio/industrialio-core.c +7 -2
@@ -1654,6 +1654,9 @@ static void iio_dev_release(struct device *device)iio_device_detach_buffers (indio_dev); +mutex_destroy (&iio_dev_opaque->info_exist_lock); +mutex_destroy (&iio_dev_opaque->mlock); +lockdep_unregister_key (&iio_dev_opaque->mlock_key);ida_free (&iio_ida, iio_dev_opaque->id);
@@ -1698,8 +1701,7 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv) indio_dev->dev.type = &iio_device_type; indio_dev->dev.bus = &iio_bus_type;device_initialize (&indio_dev->dev); -mutex_init (&iio_dev_opaque->mlock); -mutex_init (&iio_dev_opaque->info_exist_lock); +INIT_LIST_HEAD (&iio_dev_opaque->channel_attr_list); iio_dev_opaque->id =ida_alloc (&iio_ida,GFP_KERNEL );
@@ -1722,6 +1724,9 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv)lockdep_register_key (&iio_dev_opaque->mlock_key);lockdep_set_class (&iio_dev_opaque->mlock, &iio_dev_opaque->mlock_key); +mutex_init (&iio_dev_opaque->mlock); +mutex_init (&iio_dev_opaque->info_exist_lock); +return indio_dev; }EXPORT_SYMBOL (iio_device_alloc);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 300/614 iio: core: Clean up device correctly on iio_device_alloc() failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit b0e6871415b25f5e84a79621834e3d0c9d4627a6 ]
Once we called device_initialize() we have to call put_device() on it. Refactor the code to make it in the right order.
--- drivers/iio/industrialio-core.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/iio/industrialio-core.c +5 -5
@@ -1697,11 +1697,6 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv)ACCESS_PRIVATE (indio_dev, priv) = (char *)iio_dev_opaque +ALIGN (sizeof (*iio_dev_opaque),IIO_DMA_MINALIGN ); - indio_dev->dev.parent = parent; - indio_dev->dev.type = &iio_device_type; - indio_dev->dev.bus = &iio_bus_type; -device_initialize (&indio_dev->dev); -INIT_LIST_HEAD (&iio_dev_opaque->channel_attr_list); iio_dev_opaque->id =ida_alloc (&iio_ida,GFP_KERNEL );
@@ -1727,6 +1722,11 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv)mutex_init (&iio_dev_opaque->mlock);mutex_init (&iio_dev_opaque->info_exist_lock); + indio_dev->dev.parent = parent; + indio_dev->dev.type = &iio_device_type; + indio_dev->dev.bus = &iio_bus_type; +device_initialize (&indio_dev->dev); +return indio_dev; }EXPORT_SYMBOL (iio_device_alloc);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 301/614 fuse_ctl_add_conn(): fix nlink breakage in case of early failure
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit c460192aae197df1b4db1dca493c35ad529f1b64 ]
fuse_ctl_remove_conn() used to decrement the link count of root manually; that got subsumed by simple_recursive_removal(), but in case when subdirectory creation has failed the latter won't get called.
Just move the modification of parent's link count into fuse_ctl_add_dentry() to keep the things simple. Allows to get rid of the nlink argument as well...
--- fs/fuse/control.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
fs/fuse/control.c +10 -9
@@ -205,8 +205,7 @@ static const struct file_operations fuse_conn_congestion_threshold_ops = {static struct dentry *fuse_ctl_add_dentry (struct dentry *parent,struct fuse_conn *fc, -const char *name, -int mode,int nlink, +const char *name,int mode,const struct inode_operations *iop,const struct file_operations *fop) {
@@ -232,7 +231,10 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,if (iop) inode->i_op = iop; inode->i_fop = fop; -set_nlink (inode, nlink); +if (S_ISDIR (mode)) { +inc_nlink (d_inode (parent)); +inc_nlink (inode); + } inode->i_private = fc;d_add (dentry, inode);
@@ -252,22 +254,21 @@ int fuse_ctl_add_conn(struct fuse_conn *fc)return 0 ; parent = fuse_control_sb->s_root; -inc_nlink (d_inode (parent));sprintf (name,"%u" , fc->dev); - parent =fuse_ctl_add_dentry (parent, fc, name,S_IFDIR |0500 ,2 , + parent =fuse_ctl_add_dentry (parent, fc, name,S_IFDIR |0500 , &simple_dir_inode_operations, &simple_dir_operations);if (!parent) goto err; -if (!fuse_ctl_add_dentry (parent, fc,"waiting" ,S_IFREG |0400 ,1 , +if (!fuse_ctl_add_dentry (parent, fc,"waiting" ,S_IFREG |0400 ,NULL , &fuse_ctl_waiting_ops) || - !fuse_ctl_add_dentry (parent, fc,"abort" ,S_IFREG |0200 ,1 , + !fuse_ctl_add_dentry (parent, fc,"abort" ,S_IFREG |0200 ,NULL , &fuse_ctl_abort_ops) || !fuse_ctl_add_dentry (parent, fc,"max_background" ,S_IFREG |0600 , -1 ,NULL , &fuse_conn_max_background_ops) || +NULL , &fuse_conn_max_background_ops) || !fuse_ctl_add_dentry (parent, fc,"congestion_threshold" , -S_IFREG |0600 ,1 ,NULL , +S_IFREG |0600 ,NULL , &fuse_conn_congestion_threshold_ops)) goto err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 302/614 tracefs: fix a leak in eventfs_create_events_dir()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 798a401660a151633cb171738a72a8f1efb9b0b4 ]
If we have LOCKDOWN_TRACEFS, the function bails out - *after* having locked the parent directory and without bothering to undo that. Just check it before tracefs_start_creating()...
--- fs/tracefs/event_inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/tracefs/event_inode.c +2 -1
@@ -757,7 +757,7 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentryconst struct eventfs_entry *entries, int size, void *data) { - struct dentry *dentry = tracefs_start_creating(name, parent); + struct dentry *dentry;struct eventfs_root_inode *rei;struct eventfs_inode *ei;struct tracefs_inode *ti;
@@ -768,6 +768,7 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentryif (security_locked_down (LOCKDOWN_TRACEFS ))return NULL ; + dentry =tracefs_start_creating (name, parent);if (IS_ERR (dentry))return ERR_CAST (dentry);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 303/614 NFSD/blocklayout: Fix minlength check in proc_layoutget
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <[email protected]>
[ Upstream commit 3524b021b0ec620a76c89aee78e9d4b4130fb711 ]
The extent returned by the file system may have a smaller offset than the segment offset requested by the client. In this case, the minimum segment length must be checked against the requested range. Otherwise, the client may not be able to continue the read/write operation.
--- fs/nfsd/blocklayout.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/nfsd/blocklayout.c +3 -1
@@ -23,6 +23,7 @@ nfsd4_block_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode, {struct nfsd4_layout_seg *seg = &args->lg_seg;struct super_block *sb = inode->i_sb; +u64 length;u32 block_size =i_blocksize (inode);struct pnfs_block_extent *bex;struct iomap iomap;
@@ -56,7 +57,8 @@ nfsd4_block_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode, goto out_error; } -if (iomap.length < args->lg_minlength) { + length = iomap.offset + iomap.length - seg->offset; +if (length < args->lg_minlength) {dprintk ("pnfsd: extent smaller than minlength\n" ); goto out_layoutunavailable; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 304/614 arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Niebel <[email protected]>
[ Upstream commit 046cb64923e8c05a8fb656baffcd8c3fc67fb688 ]
tpm4grp will be overwritten. Fix node name
--- arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi +1 -1
@@ -617,7 +617,7 @@ pinctrl_tpm4: tpm4grp { fsl,pins = <IMX95_PAD_GPIO_IO05__TPM4_CH0 0x51e>; }; - pinctrl_tpm5: tpm4grp { + pinctrl_tpm5: tpm5grp { fsl,pins = <IMX95_PAD_GPIO_IO06__TPM5_CH0 0x51e>; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 305/614 arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 461be3802562b2d41250b40868310579a32f32c1 ]
66 MHz is the maximum FlexPI clock frequency in normal/overdrive mode when RXCLKSRC = 0 (Default)
--- arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi +1 -1
@@ -115,7 +115,7 @@ &flexspi1 { flash0: flash@0 { compatible = "jedec,spi-nor"; reg = <0>; - spi-max-frequency = <80000000>; + spi-max-frequency = <66000000>; spi-tx-bus-width = <4>; spi-rx-bus-width = <4>; vcc-supply = <®_1v8>;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 306/614 block/blk-throttle: Fix throttle slice time for SSDs
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit f76581f9f1d29e32e120b0242974ba266e79de58 ]
Commit d61fcfa4bb18 ("blk-throttle: choose a small throtl_slice for SSD") introduced device type specific throttle slices if BLK_DEV_THROTTLING_LOW was enabled. Commit bf20ab538c81 ("blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW") removed support for BLK_DEV_THROTTLING_LOW, but left the device type specific throttle slices in place. This effectively changed throttling behavior on systems with SSD which now use a different and non-configurable slice time compared to non-SSD devices. Practical impact is that throughput tests with low configured throttle values (65536 bps) experience less than expected throughput on SSDs, presumably due to rounding errors associated with the small throttle slice time used for those devices. The same tests pass when setting the throttle values to 65536 * 4 = 262144 bps.
The original code sets the throttle slice time to DFL_THROTL_SLICE_HD if CONFIG_BLK_DEV_THROTTLING_LOW is disabled. Restore that code to fix the problem. With that, DFL_THROTL_SLICE_SSD is no longer necessary. Revert to the original code and re-introduce DFL_THROTL_SLICE to replace both DFL_THROTL_SLICE_HD and DFL_THROTL_SLICE_SSD. This effectively reverts commit d61fcfa4bb18 ("blk-throttle: choose a small throtl_slice for SSD").
While at it, also remove MAX_THROTL_SLICE since it is not used anymore.
--- block/blk-throttle.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
block/blk-throttle.c +2 -7
@@ -22,9 +22,7 @@#define THROTL_QUANTUM 32/* Throttling is performed over a slice and after that slice is renewed */ -#define DFL_THROTL_SLICE_HD (HZ / 10) -#define DFL_THROTL_SLICE_SSD (HZ / 50) -#define MAX_THROTL_SLICE (HZ) +#define DFL_THROTL_SLICE (HZ / 10)/* A workqueue to queue throttle related work */ static struct workqueue_struct *kthrotld_workqueue;
@@ -1341,10 +1339,7 @@ static int blk_throtl_init(struct gendisk *disk) goto out; } -if (blk_queue_nonrot (q)) - td->throtl_slice =DFL_THROTL_SLICE_SSD ; -else - td->throtl_slice =DFL_THROTL_SLICE_HD ; + td->throtl_slice =DFL_THROTL_SLICE ; td->track_bio_latency = !queue_is_mq (q);if (!td->track_bio_latency)blk_stat_enable_accounting (q);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 307/614 drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <[email protected]>
[ Upstream commit 3099e0247e3217e1b39c1c61766e06ec3d13835f ]
crashstate_get_vm_logs() did not check the return value of kmalloc_array(). In low-memory situations, kmalloc_array() may return NULL, leading to a NULL pointer dereference when the function later accesses state->vm_logs.
Fix this by checking the return value of kmalloc_array() and setting state->nr_vm_logs to 0 if allocation fails.
Patchwork: https://patchwork.freedesktop.org/patch/687555/
--- drivers/gpu/drm/msm/msm_gpu.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/msm/msm_gpu.c +4 -0
@@ -348,6 +348,10 @@ static void crashstate_get_vm_logs(struct msm_gpu_state *state, struct msm_gem_v state->vm_logs =kmalloc_array ( state->nr_vm_logs,sizeof (vm->log[0 ]),GFP_KERNEL ); +if (!state->vm_logs) { + state->nr_vm_logs =0 ; + } +for (int i =0 ; i < state->nr_vm_logs; i++) {int idx = (i + first) & vm_log_mask;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 308/614 drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <[email protected]>
[ Upstream commit 3065e6a4d3594b42dae6176b3e2c0c3563cf94b8 ]
The crashstate_get_bos() function allocates memory for state->bos using kcalloc(), but the vmbind path does not check for allocation failure before dereferencing it in the following drm_gpuvm_for_each_va() loop. This could lead to a NULL pointer dereference if memory allocation fails.
Fix this by wrapping the drm_gpuvm_for_each_va() loop with a NULL check on state->bos, similar to the safety check in the non-vmbind path.
Patchwork: https://patchwork.freedesktop.org/patch/687556/
--- drivers/gpu/drm/msm/msm_gpu.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/msm_gpu.c +9 -8
@@ -287,16 +287,17 @@ static void crashstate_get_bos(struct msm_gpu_state *state, struct msm_gem_submi state->bos =kcalloc (cnt,sizeof (struct msm_gpu_state_bo ),GFP_KERNEL ); - drm_gpuvm_for_each_va (vma, submit->vm) { -bool dump = rd_full || (vma->flags &MSM_VMA_DUMP ); +if (state->bos) +drm_gpuvm_for_each_va (vma, submit->vm) { +bool dump = rd_full || (vma->flags &MSM_VMA_DUMP ); -/* Skip MAP_NULL/PRR VMAs: */ -if (!vma->gem.obj) -continue ; +/* Skip MAP_NULL/PRR VMAs: */ +if (!vma->gem.obj) +continue ; -msm_gpu_crashstate_get_bo (state, vma->gem.obj, vma->va.addr, - dump, vma->gem.offset, vma->va.range); - } +msm_gpu_crashstate_get_bo (state, vma->gem.obj, vma->va.addr, + dump, vma->gem.offset, vma->va.range); + }drm_exec_fini (&exec); }else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 309/614 drm/msm/a2xx: stop over-complaining about the legacy firmware
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit a3a22373fce576560757f5616eb48dbf85891d9c ]
If the rootfs have a legacy A200 firmware, currently the driver will complain each time the hw is reinited (which can happen a lot). E.g. with GL testsuite the hw is reinited after each test, spamming the console.
Make sure that the message is printed only once: when we detect the firmware that doesn't support protection.
Patchwork: https://patchwork.freedesktop.org/patch/688098/
--- drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a2xx_gpu.c +1 -1
@@ -234,7 +234,7 @@ static int a2xx_hw_init(struct msm_gpu *gpu)* word (0x20xxxx for A200, 0x220xxx for A220, 0x225xxx for A225). * Older firmware files, which lack protection support, have 0 instead. */ -if (ptr[1 ] ==0 ) { +if (ptr[1 ] ==0 && !a2xx_gpu->protection_disabled) {dev_warn (gpu->dev->dev,"Legacy firmware detected, disabling protection support\n" ); a2xx_gpu->protection_disabled = true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 310/614 PCI: stm32: Fix LTSSM EP race with start link
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <[email protected]>
[ Upstream commit fa81d6099007728cae39c6f937d83903bbddab5e ]
If the host has deasserted PERST# and started link training before the link is started on EP side, enabling LTSSM before the endpoint registers are initialized in the perst_irq handler results in probing incorrect values.
Thus, wait for the PERST# level-triggered interrupt to start link training at the end of initialization and cleanup the stm32_pcie_[start stop]_link functions.
--- drivers/pci/controller/dwc/pcie-stm32-ep.c | 39 +++++----------------- 1 file changed, 8 insertions(+), 31 deletions(-)
drivers/pci/controller/dwc/pcie-stm32-ep.c +8 -31
@@ -37,36 +37,9 @@ static void stm32_pcie_ep_init(struct dw_pcie_ep *ep)dw_pcie_ep_reset_bar (pci, bar); } -static int stm32_pcie_enable_link (struct dw_pcie *pci) -{ -struct stm32_pcie *stm32_pcie =to_stm32_pcie (pci); - -regmap_update_bits (stm32_pcie->regmap,SYSCFG_PCIECR , -STM32MP25_PCIECR_LTSSM_EN , -STM32MP25_PCIECR_LTSSM_EN ); - -return dw_pcie_wait_for_link (pci); -} - -static void stm32_pcie_disable_link (struct dw_pcie *pci) -{ -struct stm32_pcie *stm32_pcie =to_stm32_pcie (pci); - -regmap_update_bits (stm32_pcie->regmap,SYSCFG_PCIECR ,STM32MP25_PCIECR_LTSSM_EN ,0 ); -} -static int stm32_pcie_start_link (struct dw_pcie *pci) {struct stm32_pcie *stm32_pcie =to_stm32_pcie (pci); -int ret; - -dev_dbg (pci->dev,"Enable link\n" ); - - ret =stm32_pcie_enable_link (pci); -if (ret) { -dev_err (pci->dev,"PCIe cannot establish link: %d\n" , ret); -return ret; - }enable_irq (stm32_pcie->perst_irq);
@@ -77,11 +50,7 @@ static void stm32_pcie_stop_link(struct dw_pcie *pci) {struct stm32_pcie *stm32_pcie =to_stm32_pcie (pci); -dev_dbg (pci->dev,"Disable link\n" ); -disable_irq (stm32_pcie->perst_irq); - -stm32_pcie_disable_link (pci); } static int stm32_pcie_raise_irq(struct dw_pcie_ep *ep, u8 func_no,
@@ -152,6 +121,9 @@ static void stm32_pcie_perst_assert(struct dw_pcie *pci)dev_dbg (dev,"PERST asserted by host\n" ); +regmap_update_bits (stm32_pcie->regmap,SYSCFG_PCIECR , +STM32MP25_PCIECR_LTSSM_EN ,0 ); +pci_epc_deinit_notify (ep->epc);stm32_pcie_disable_resources (stm32_pcie);
@@ -192,6 +164,11 @@ static void stm32_pcie_perst_deassert(struct dw_pcie *pci)pci_epc_init_notify (ep->epc); +/* Enable link training */ +regmap_update_bits (stm32_pcie->regmap,SYSCFG_PCIECR , +STM32MP25_PCIECR_LTSSM_EN , +STM32MP25_PCIECR_LTSSM_EN ); +return ; err_disable_resources:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 311/614 PCI: stm32: Fix EP page_size alignment
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <[email protected]>
[ Upstream commit ff529a9307a03ec03ed9751da053b57149300053 ]
pci_epc_mem_alloc_addr() allocates a CPU address from the ATU window phys base and a page number. Set the ep->page_size so the resulting CPU address is correctly aligned with the ATU required alignment.
--- drivers/pci/controller/dwc/pcie-stm32-ep.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pci/controller/dwc/pcie-stm32-ep.c +2 -0
@@ -214,6 +214,8 @@ static int stm32_add_pcie_ep(struct stm32_pcie *stm32_pcie, ep->ops = &stm32_pcie_ep_ops; + ep->page_size = stm32_pcie_epc_features.align; + ret =dw_pcie_ep_init (ep);if (ret) {dev_err (dev,"Failed to initialize ep: %d\n" , ret);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 312/614 wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <[email protected]>
[ Upstream commit 9b5b9c042b30befc5b37e4539ace95af70843473 ]
In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the previously successful allocations are not freed on exit.
Fix that by jumping to err_free_rings label on error, which calls rtl8180_free_rx_ring() to free the allocations. Remove the free of rx_ring in rtl8180_init_rx_ring() error path, and set the freed priv->rx_buf entry to null, to avoid double free.
--- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +2 -7
@@ -1023,9 +1023,6 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)dma_addr_t *mapping; entry = priv->rx_ring + priv->rx_ring_sz*i;if (!skb) { -dma_free_coherent (&priv->pdev->dev, - priv->rx_ring_sz *32 , - priv->rx_ring, priv->rx_ring_dma);wiphy_err (dev->wiphy,"Cannot allocate RX skb\n" );return -ENOMEM ; }
@@ -1037,9 +1034,7 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)if (dma_mapping_error (&priv->pdev->dev, *mapping)) {kfree_skb (skb); -dma_free_coherent (&priv->pdev->dev, - priv->rx_ring_sz *32 , - priv->rx_ring, priv->rx_ring_dma); + priv->rx_buf[i] =NULL ;wiphy_err (dev->wiphy,"Cannot map DMA for RX skb\n" );return -ENOMEM ; }
@@ -1130,7 +1125,7 @@ static int rtl8180_start(struct ieee80211_hw *dev) ret =rtl8180_init_rx_ring (dev);if (ret) -return ret; + goto err_free_rings;for (i =0 ; i < (dev->queues +1 ); i++)if ((ret =rtl8180_init_tx_ring (dev, i,16 )))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 313/614 net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <[email protected]>
[ Upstream commit 24afd7827efb7c69adfc41835390470e3eec4740 ]
The "phy-mode" property of devicetree indicates whether the PCB has delay now, which means the mac needs to modify the PHY mode based on whether there is an internal delay in the mac.
This modification is similar for many ethernet drivers. To simplify code, define the helper phy_fix_phy_mode_for_mac_delays(speed, mac_txid, mac_rxid) to fix PHY mode based on whether mac adds internal delay.
Stable-dep-of: db37c6e510de ("net: stmmac: dwmac-sophgo: Add phy interface filter")
--- drivers/net/phy/phy-core.c | 43 ++++++++++++++++++++++++++++++++++++++ include/linux/phy.h | 3 +++ 2 files changed, 46 insertions(+)
drivers/net/phy/phy-core.c +43 -0
@@ -101,6 +101,49 @@ const char *phy_rate_matching_to_str(int rate_matching) }EXPORT_SYMBOL_GPL (phy_rate_matching_to_str); +/** +* phy_fix_phy_mode_for_mac_delays - Convenience function for fixing PHY +* mode based on whether mac adds internal delay +* +* @interface: The current interface mode of the port +* @mac_txid: True if the mac adds internal tx delay +* @mac_rxid: True if the mac adds internal rx delay +* +* Return: fixed PHY mode, or PHY_INTERFACE_MODE_NA if the interface can +* not apply the internal delay +*/ +phy_interface_t phy_fix_phy_mode_for_mac_delays (phy_interface_t interface, +bool mac_txid,bool mac_rxid) +{ +if (!phy_interface_mode_is_rgmii (interface)) +return interface; + +if (mac_txid && mac_rxid) { +if (interface ==PHY_INTERFACE_MODE_RGMII_ID ) +return PHY_INTERFACE_MODE_RGMII ; +return PHY_INTERFACE_MODE_NA ; + } + +if (mac_txid) { +if (interface ==PHY_INTERFACE_MODE_RGMII_ID ) +return PHY_INTERFACE_MODE_RGMII_RXID ; +if (interface ==PHY_INTERFACE_MODE_RGMII_TXID ) +return PHY_INTERFACE_MODE_RGMII ; +return PHY_INTERFACE_MODE_NA ; + } + +if (mac_rxid) { +if (interface ==PHY_INTERFACE_MODE_RGMII_ID ) +return PHY_INTERFACE_MODE_RGMII_TXID ; +if (interface ==PHY_INTERFACE_MODE_RGMII_RXID ) +return PHY_INTERFACE_MODE_RGMII ; +return PHY_INTERFACE_MODE_NA ; + } + +return interface; +} +EXPORT_SYMBOL_GPL (phy_fix_phy_mode_for_mac_delays); +/** * phy_interface_num_ports - Return the number of links that can be carried by * a given MAC-PHY physical link. Returns 0 if this is
include/linux/phy.h +3 -0
@@ -1813,6 +1813,9 @@ static inline bool phy_is_pseudo_fixed_link(struct phy_device *phydev)return phydev->is_pseudo_fixed_link; } +phy_interface_t phy_fix_phy_mode_for_mac_delays (phy_interface_t interface, +bool mac_txid,bool mac_rxid); +int phy_save_page (struct phy_device *phydev);int phy_select_page (struct phy_device *phydev,int page);int phy_restore_page (struct phy_device *phydev,int oldpage,int ret);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 314/614 net: stmmac: dwmac-sophgo: Add phy interface filter
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <[email protected]>
[ Upstream commit db37c6e510deabc9b0ee27c08f1c5aaa19f2e8ef ]
As the SG2042 has an internal rx delay, the delay should be removed when initializing the mac, otherwise the phy will be misconfigurated.
--- .../ethernet/stmicro/stmmac/dwmac-sophgo.c | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c +19 -1
@@ -7,11 +7,16 @@#include <linux/clk.h> #include <linux/module.h> +#include <linux/property.h> #include <linux/mod_devicetable.h> #include <linux/platform_device.h> #include "stmmac_platform.h" +struct sophgo_dwmac_data { +bool has_internal_rx_delay; +}; +static int sophgo_sg2044_dwmac_init (struct platform_device *pdev,struct plat_stmmacenet_data *plat_dat,struct stmmac_resources *stmmac_res)
@@ -32,6 +37,7 @@ static int sophgo_sg2044_dwmac_init(struct platform_device *pdev,static int sophgo_dwmac_probe (struct platform_device *pdev) {struct plat_stmmacenet_data *plat_dat; +const struct sophgo_dwmac_data *data;struct stmmac_resources stmmac_res;struct device *dev = &pdev->dev;int ret;
@@ -50,11 +56,23 @@ static int sophgo_dwmac_probe(struct platform_device *pdev)if (ret)return ret; + data =device_get_match_data (&pdev->dev); +if (data && data->has_internal_rx_delay) { + plat_dat->phy_interface =phy_fix_phy_mode_for_mac_delays (plat_dat->phy_interface, + false, true); +if (plat_dat->phy_interface ==PHY_INTERFACE_MODE_NA ) +return -EINVAL ; + } +return stmmac_dvr_probe (dev, plat_dat, &stmmac_res); } +static const struct sophgo_dwmac_data sg2042_dwmac_data = { + .has_internal_rx_delay = true, +}; +static const struct of_device_id sophgo_dwmac_match[] = { - { .compatible ="sophgo,sg2042-dwmac" }, + { .compatible ="sophgo,sg2042-dwmac" , .data = &sg2042_dwmac_data }, { .compatible ="sophgo,sg2044-dwmac" }, {/* sentinel */ } };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 315/614 bpf: Fix invalid prog->stats access when update_effective_progs fails
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <[email protected]>
[ Upstream commit 7dc211c1159d991db609bdf4b0fb9033c04adcbc ]
Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows:
__cgroup_bpf_detach
update_effective_progs
compute_effective_progs
bpf_prog_array_alloc <-- fault inject
purge_effective_progs
/* change to dummy_bpf_prog */
array->items[index] = &dummy_bpf_prog.prog---softirq start---__do_softirq
...
__cgroup_bpf_run_filter_skb
__bpf_prog_run_save_cb
bpf_prog_run
stats = this_cpu_ptr(prog->stats)
/* invalid memory access */
flags = u64_stats_update_begin_irqsave(&stats->syncp)---softirq end---
static_branch_dec(&cgroup_bpf_enabled_key[atype])
The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access.
To fix it, skip updating stats when stats is NULL.
--- include/linux/filter.h | 12 +++++++----- kernel/bpf/syscall.c | 3 +++ 2 files changed, 10 insertions(+), 5 deletions(-)
include/linux/filter.h +7 -5
@@ -712,11 +712,13 @@ static __always_inline u32 __bpf_prog_run(const struct bpf_prog *prog, ret =dfunc (ctx, prog->insnsi, prog->bpf_func); duration =sched_clock () - start; - stats =this_cpu_ptr (prog->stats); - flags =u64_stats_update_begin_irqsave (&stats->syncp); -u64_stats_inc (&stats->cnt); -u64_stats_add (&stats->nsecs, duration); -u64_stats_update_end_irqrestore (&stats->syncp, flags); +if (likely (prog->stats)) { + stats =this_cpu_ptr (prog->stats); + flags =u64_stats_update_begin_irqsave (&stats->syncp); +u64_stats_inc (&stats->cnt); +u64_stats_add (&stats->nsecs, duration); +u64_stats_update_end_irqrestore (&stats->syncp, flags); + } }else { ret =dfunc (ctx, prog->insnsi, prog->bpf_func); }
kernel/bpf/syscall.c +3 -0
@@ -2462,6 +2462,9 @@ void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog)struct bpf_prog_stats *stats;unsigned int flags; +if (unlikely (!prog->stats)) +return ; + stats =this_cpu_ptr (prog->stats); flags =u64_stats_update_begin_irqsave (&stats->syncp);u64_stats_inc (&stats->misses);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 316/614 powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
[ Upstream commit 17b45ccf09882e0c808ad2cf62acdc90ad968746 ]
When HV=0 & IR/DR=0, the Hash MMU is said to be in Virtual Real Addressing Mode during early boot. During this, we should ensure that memory region allocations for stress_hpt_struct should happen from within RMA region as otherwise the boot might get stuck while doing memset of this region.
History behind why do we have RMA region limitation is better explained in these 2 patches [1] & [2]. This patch ensures that memset to stress_hpt_struct during early boot does not cross ppc64_rma_size boundary.
[1]: https://lore.kernel.org/all/[email protected]/
[2]: https://lore.kernel.org/all/[email protected]/
--- arch/powerpc/mm/book3s64/hash_utils.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
arch/powerpc/mm/book3s64/hash_utils.c +6 -4
@@ -1302,11 +1302,14 @@ static void __init htab_initialize(void)unsigned long table;unsigned long pteg_count;unsigned long prot; -phys_addr_t base =0 , size =0 , end; +phys_addr_t base =0 , size =0 , end, limit =MEMBLOCK_ALLOC_ANYWHERE ;u64 i;DBG (" -> htab_initialize()\n" ); +if (firmware_has_feature (FW_FEATURE_LPAR )) + limit = ppc64_rma_size; +if (mmu_has_feature (MMU_FTR_1T_SEGMENT )) { mmu_kernel_ssize =MMU_SEGSIZE_1T ; mmu_highuser_ssize =MMU_SEGSIZE_1T ;
@@ -1322,7 +1325,7 @@ static void __init htab_initialize(void)// Too early to use nr_cpu_ids, so use NR_CPUS tmp =memblock_phys_alloc_range (sizeof (struct stress_hpt_struct ) *NR_CPUS , __alignof__(struct stress_hpt_struct ), -0 ,MEMBLOCK_ALLOC_ANYWHERE ); +MEMBLOCK_LOW_LIMIT , limit);memset ((void *)tmp,0xff ,sizeof (struct stress_hpt_struct ) *NR_CPUS ); stress_hpt_struct =__va (tmp);
@@ -1356,11 +1359,10 @@ static void __init htab_initialize(void) mmu_hash_ops.hpte_clear_all ();#endif }else { -unsigned long limit =MEMBLOCK_ALLOC_ANYWHERE ; table =memblock_phys_alloc_range (htab_size_bytes, htab_size_bytes, -0 , limit); +MEMBLOCK_LOW_LIMIT , limit);if (!table)panic ("ERROR: Failed to allocate %pa bytes below %pa\n" , &htab_size_bytes, &limit);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 317/614 powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
[ Upstream commit eae40a6da63faa9fb63ff61f8fa2b3b57da78a84 ]
HPTE format was changed since Power9 (ISA 3.0) onwards. While dumping kernel hash page tables, nothing gets printed on powernv P9+. This patch utilizes the helpers added in the patch tagged as fixes, to convert new format to old format and dump the hptes. This fix is only needed for native_find() (powernv), since pseries continues to work fine with the old format.
--- arch/powerpc/mm/ptdump/hashpagetable.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/mm/ptdump/hashpagetable.c +6 -0
@@ -216,6 +216,8 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64 vpn =hpt_vpn (ea, vsid, ssize); hash =hpt_hash (vpn, shift, ssize); want_v =hpte_encode_avpn (vpn, psize, ssize); +if (cpu_has_feature (CPU_FTR_ARCH_300 )) + want_v =hpte_old_to_new_v (want_v);/* to check in the secondary hash table, we invert the hash */ if (!primary)
@@ -229,6 +231,10 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64/* HPTE matches */ *v =be64_to_cpu (hptep->v); *r =be64_to_cpu (hptep->r); +if (cpu_has_feature (CPU_FTR_ARCH_300 )) { + *v =hpte_new_to_old_v (*v, *r); + *r =hpte_new_to_old_r (*r); + }return 0 ; } ++hpte_group;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 318/614 net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit d9db25723677c3741a0cf3643f7f7429fc983921 ]
When the "rx-vlan-filter" feature is enabled on a network device, the 8021q module automatically adds a VLAN 0 hardware filter when the device is brought administratively up.
For stmmac, this causes vlan_add_hw_rx_fltr() to create a new entry for VID 0 in the mac_device_info->vlan_filter array, in the following format:
VLAN_TAG_DATA_ETV | VLAN_TAG_DATA_VEN | vid
Here, VLAN_TAG_DATA_VEN indicates that the hardware filter is enabled for that VID.
However, on the delete path, vlan_del_hw_rx_fltr() searches the vlan_filter array by VID only, without verifying whether a VLAN entry is enabled. As a result, when the 8021q module attempts to remove VLAN 0, the function may mistakenly match a zero-initialized slot rather than the actual VLAN 0 entry, causing incorrect deletions and leaving stale entries in the hardware table.
Fix this by verifying that the VLAN entry's enable bit (VLAN_TAG_DATA_VEN) is set before matching and deleting by VID. This ensures only active VLAN entries are removed and avoids leaving stale entries in the VLAN filter table, particularly for VLAN ID 0.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c +2 -1
@@ -122,7 +122,8 @@ static int vlan_del_hw_rx_fltr(struct net_device *dev,/* Extended Rx VLAN Filter Enable */ for (i =0 ; i < hw->num_vlan; i++) { -if ((hw->vlan_filter[i] &VLAN_TAG_DATA_VID ) == vid) { +if ((hw->vlan_filter[i] &VLAN_TAG_DATA_VEN ) && + ((hw->vlan_filter[i] &VLAN_TAG_DATA_VID ) == vid)) { ret =vlan_write_filter (dev, hw, i,0 );if (!ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 319/614 fs/ntfs3: out1 also needs to put mi
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 4d78d1173a653acdaf7500a32b8dc530ca4ad075 ]
After ntfs_look_free_mft() executes successfully, all subsequent code that fails to execute must put mi.
--- fs/ntfs3/frecord.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/frecord.c +1 -1
@@ -1015,9 +1015,9 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, out2:ni_remove_mi (ni, mi); -mi_put (mi); out1: +mi_put (mi);ntfs_mark_rec_free (sbi, rno, is_mft); out:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 320/614 fs/ntfs3: Prevent memory leaks in add sub record
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit ccc4e86d1c24260c18ae94541198c3711c140da6 ]
If a rb node with the same ino already exists in the rb tree, the newly alloced mft_inode in ni_add_subrecord() will not have its memory cleaned up, which leads to the memory leak issue reported by syzbot.
The best option to avoid this issue is to put the newly alloced mft node when a rb node with the same ino already exists in the rb tree and return the rb node found in the rb tree to the parent layer.
syzbot reported:
BUG: memory leak
unreferenced object 0xffff888110bef280 (size 128):
backtrace (crc 126a088f):
ni_add_subrecord+0x31/0x180 fs/ntfs3/frecord.c:317
ntfs_look_free_mft+0xf0/0x790 fs/ntfs3/fsntfs.c:715
BUG: memory leak
unreferenced object 0xffff888109093400 (size 1024):
backtrace (crc 7197c55e):
mi_init+0x2b/0x50 fs/ntfs3/record.c:105
mi_format_new+0x40/0x220 fs/ntfs3/record.c:422--- fs/ntfs3/frecord.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ntfs3/frecord.c +4 -2
@@ -325,8 +325,10 @@ bool ni_add_subrecord(struct ntfs_inode *ni, CLST rno, struct mft_inode **mi)mi_get_ref (&ni->mi, &m->mrec->parent_ref); -ni_add_mi (ni, m); - *mi = m; + *mi =ni_ins_mi (ni, &ni->mi_tree, m->rno, &m->node); +if (*mi != m) +mi_put (m); +return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 321/614 drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Liu <[email protected]>
[ Upstream commit 20ac36b71c53b8c36c6903b5ca87c75226700a97 ]
if matrixbit is 11,
The range of color matrix is from 0 to (BIT(12) - 1). Values from 0 to (BIT(11) - 1) represent positive numbers, values from BIT(11) to (BIT(12) - 1) represent negative numbers. For example, -1 need converted to 8191.
so convert S31.32 to HW Q2.11 format by drm_color_ctm_s31_32_to_qm_n, and set int_bits to 2.
--- drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +---------------------- 1 file changed, 1 insertion(+), 22 deletions(-)
drivers/gpu/drm/mediatek/mtk_disp_ccorr.c +1 -22
@@ -80,27 +80,6 @@ void mtk_ccorr_stop(struct device *dev)writel_relaxed (0x0 , ccorr->regs +DISP_CCORR_EN ); } -/* Converts a DRM S31.32 value to the HW S1.n format. */ -static u16 mtk_ctm_s31_32_to_s1_n (u64 in,u32 n) -{ -u16 r; - -/* Sign bit. */ - r = in &BIT_ULL (63 ) ?BIT (n +1 ) :0 ; - -if ((in &GENMASK_ULL (62 ,33 )) >0 ) { -/* identity value 0x100000000 -> 0x400(mt8183), */ -/* identity value 0x100000000 -> 0x800(mt8192), */ -/* if bigger this, set it to max 0x7ff. */ - r |=GENMASK (n,0 ); - }else { -/* take the n+1 most important bits. */ - r |= (in >> (32 - n)) &GENMASK (n,0 ); - } - -return r; -} -void mtk_ccorr_ctm_set (struct device *dev,struct drm_crtc_state *state) {struct mtk_disp_ccorr *ccorr =dev_get_drvdata (dev);
@@ -119,7 +98,7 @@ void mtk_ccorr_ctm_set(struct device *dev, struct drm_crtc_state *state) input = ctm->matrix;for (i =0 ; i <ARRAY_SIZE (coeffs); i++) - coeffs[i] =mtk_ctm_s31_32_to_s1_n (input[i], matrix_bits); + coeffs[i] =drm_color_ctm_s31_32_to_qm_n (input[i],2 , matrix_bits);mtk_ddp_write (cmdq_pkt, coeffs[0 ] <<16 | coeffs[1 ], &ccorr->cmdq_reg, ccorr->regs,DISP_CCORR_COEF_0 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 322/614 drm/msm/a6xx: Flush LRZ cache before PT switch
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit 180349b8407f3b268b2ceac0e590b8199e043081 ]
As per the recommendation, A7x and newer GPUs should flush the LRZ cache before switching the pagetable. Update a6xx_set_pagetable() to do this. While we are at it, sync both BV and BR before issuing a CP_RESET_CONTEXT_STATE command, to match the downstream sequence.
Patchwork: https://patchwork.freedesktop.org/patch/688995/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +8 -2
@@ -224,7 +224,7 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,OUT_RING (ring, submit->seqno -1 );OUT_PKT7 (ring,CP_THREAD_CONTROL ,1 ); -OUT_RING (ring,CP_SET_THREAD_BOTH ); +OUT_RING (ring,CP_THREAD_CONTROL_0_SYNC_THREADS |CP_SET_THREAD_BOTH );/* Reset state used to synchronize BR and BV */ OUT_PKT7 (ring,CP_RESET_CONTEXT_STATE ,1 );
@@ -235,7 +235,13 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu, CP_RESET_CONTEXT_STATE_0_RESET_GLOBAL_LOCAL_TS);OUT_PKT7 (ring,CP_THREAD_CONTROL ,1 ); -OUT_RING (ring,CP_SET_THREAD_BR ); +OUT_RING (ring,CP_THREAD_CONTROL_0_SYNC_THREADS |CP_SET_THREAD_BOTH ); + +OUT_PKT7 (ring,CP_EVENT_WRITE ,1 ); +OUT_RING (ring,LRZ_FLUSH ); + +OUT_PKT7 (ring,CP_THREAD_CONTROL ,1 ); +OUT_RING (ring,CP_THREAD_CONTROL_0_SYNC_THREADS |CP_SET_THREAD_BR ); }if (!sysprof) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 323/614 drm/msm/a6xx: Fix the gemnoc workaround
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit ff7a6de043fce21ea5891311746b16121b385c59 ]
Correct the register offset and enable this workaround for all A7x and newer GPUs to match the recommendation. Also, downstream does this w/a after moving the fence to allow mode. So do the same.
Patchwork: https://patchwork.freedesktop.org/patch/688997/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +4 -4
@@ -485,8 +485,9 @@ static void a6xx_gemnoc_workaround(struct a6xx_gmu *gmu)* in the power down sequence not being fully executed. That in turn can * prevent CX_GDSC from collapsing. Assert Qactive to avoid this. */ -if (adreno_is_a621 (adreno_gpu) ||adreno_is_7c3 (adreno_gpu)) -gmu_write (gmu,REG_A6XX_GMU_AO_AHB_FENCE_CTRL ,BIT (0 )); +if (adreno_is_a7xx (adreno_gpu) || (adreno_is_a621 (adreno_gpu) || +adreno_is_7c3 (adreno_gpu))) +gmu_write (gmu,REG_A6XX_GPU_GMU_CX_GMU_CX_FALNEXT_INTF ,BIT (0 )); }/* Let the GMU know that we are about to go into slumber */
@@ -522,10 +523,9 @@ static int a6xx_gmu_notify_slumber(struct a6xx_gmu *gmu) } out: -a6xx_gemnoc_workaround (gmu); -/* Put fence into allow mode */ gmu_write (gmu,REG_A6XX_GMU_AO_AHB_FENCE_CTRL ,0 ); +a6xx_gemnoc_workaround (gmu);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 324/614 drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <[email protected]>
[ Upstream commit ca04ce7a2f22652fdf6489fa7e02e7d2c08698f4 ]
Current logic assumes that the voltage corners in both MxG and MxA are always same. This is not true for recent targets. So, rework the rpmh init sequence to probe and calculate the votes with the respective rails, ie, GX rails should use MxG as secondary rail and Cx rail should use MxA as the secondary rail.
Patchwork: https://patchwork.freedesktop.org/patch/689014/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +15 -11
@@ -1492,13 +1492,14 @@ static unsigned int a6xx_gmu_get_arc_level(struct device *dev, }static int a6xx_gmu_rpmh_arc_votes_init (struct device *dev,u32 *votes, -unsigned long *freqs,int freqs_count,const char *id) +unsigned long *freqs,int freqs_count, +const char *pri_id,const char *sec_id) {int i, j;const u16 *pri, *sec;size_t pri_count, sec_count; - pri =cmd_db_read_aux_data (id, &pri_count); + pri =cmd_db_read_aux_data (pri_id, &pri_count);if (IS_ERR (pri))return PTR_ERR (pri);/*
@@ -1509,13 +1510,7 @@ static int a6xx_gmu_rpmh_arc_votes_init(struct device *dev, u32 *votes,if (!pri_count)return -EINVAL ; -/* -* Some targets have a separate gfx mxc rail. So try to read that first and then fall back -* to regular mx rail if it is missing -*/ - sec =cmd_db_read_aux_data ("gmxc.lvl" , &sec_count); -if (IS_ERR (sec) && sec !=ERR_PTR (-EPROBE_DEFER )) - sec =cmd_db_read_aux_data ("mx.lvl" , &sec_count); + sec =cmd_db_read_aux_data (sec_id, &sec_count);if (IS_ERR (sec))return PTR_ERR (sec);
@@ -1583,15 +1578,24 @@ static int a6xx_gmu_rpmh_votes_init(struct a6xx_gmu *gmu)struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;const struct a6xx_info *info = adreno_gpu->info->a6xx;struct msm_gpu *gpu = &adreno_gpu->base; +const char *sec_id; +const u16 *gmxc;int ret; + gmxc =cmd_db_read_aux_data ("gmxc.lvl" ,NULL ); +if (gmxc ==ERR_PTR (-EPROBE_DEFER )) +return -EPROBE_DEFER ; + +/* If GMxC is present, prefer that as secondary rail for GX votes */ + sec_id =IS_ERR_OR_NULL (gmxc) ?"mx.lvl" :"gmxc.lvl" ; +/* Build the GX votes */ ret =a6xx_gmu_rpmh_arc_votes_init (&gpu->pdev->dev, gmu->gx_arc_votes, - gmu->gpu_freqs, gmu->nr_gpu_freqs,"gfx.lvl" ); + gmu->gpu_freqs, gmu->nr_gpu_freqs,"gfx.lvl" , sec_id);/* Build the CX votes */ ret |=a6xx_gmu_rpmh_arc_votes_init (gmu->dev, gmu->cx_arc_votes, - gmu->gmu_freqs, gmu->nr_gmu_freqs,"cx.lvl" ); + gmu->gmu_freqs, gmu->nr_gmu_freqs,"cx.lvl" ,"mx.lvl" );/* Build the interconnect votes */ if (info->bcms && gmu->nr_gpu_bws >1 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 325/614 spi: sophgo: Fix incorrect use of bus width value macros
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longbin Li <[email protected]>
[ Upstream commit d9813cd23d5a7b254cc1b1c1ea042634d8da62e6 ]
The previous code initialized the 'reg' value with specific bus-width values (BUS_WIDTH_2_BIT and BUS_WIDTH_4_BIT), which introduces ambiguity. Replace them with BUS_WIDTH_MASK to express the intention clearly.
--- drivers/spi/spi-sg2044-nor.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spi-sg2044-nor.c +2 -2
@@ -42,6 +42,7 @@#define SPIFMC_TRAN_CSR_TRAN_MODE_RX BIT(0)#define SPIFMC_TRAN_CSR_TRAN_MODE_TX BIT(1)#define SPIFMC_TRAN_CSR_FAST_MODE BIT(3) +#define SPIFMC_TRAN_CSR_BUS_WIDTH_MASK GENMASK(5, 4)#define SPIFMC_TRAN_CSR_BUS_WIDTH_1_BIT (0x00 << 4)#define SPIFMC_TRAN_CSR_BUS_WIDTH_2_BIT (0x01 << 4)#define SPIFMC_TRAN_CSR_BUS_WIDTH_4_BIT (0x02 << 4)
@@ -122,8 +123,7 @@ static u32 sg2044_spifmc_init_reg(struct sg2044_spifmc *spifmc) reg =readl (spifmc->io_base +SPIFMC_TRAN_CSR ); reg &= ~(SPIFMC_TRAN_CSR_TRAN_MODE_MASK | SPIFMC_TRAN_CSR_FAST_MODE | - SPIFMC_TRAN_CSR_BUS_WIDTH_2_BIT | - SPIFMC_TRAN_CSR_BUS_WIDTH_4_BIT | + SPIFMC_TRAN_CSR_BUS_WIDTH_MASK | SPIFMC_TRAN_CSR_DMA_EN | SPIFMC_TRAN_CSR_ADDR_BYTES_MASK | SPIFMC_TRAN_CSR_WITH_CMD |
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 326/614 ipv6: clear RA flags when adding a static route
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit f72514b3c5698e4b900b25345e09f9ed33123de6 ]
When an IPv6 Router Advertisement (RA) is received for a prefix, the kernel creates the corresponding on-link route with flags RTF_ADDRCONF and RTF_PREFIX_RT configured and RTF_EXPIRES if lifetime is set.
If later a user configures a static IPv6 address on the same prefix the kernel clears the RTF_EXPIRES flag but it doesn't clear the RTF_ADDRCONF and RTF_PREFIX_RT. When the next RA for that prefix is received, the kernel sees the route as RA-learned and wrongly configures back the lifetime. This is problematic because if the route expires, the static address won't have the corresponding on-link route.
This fix clears the RTF_ADDRCONF and RTF_PREFIX_RT flags preventing that the lifetime is configured when the next RA arrives. If the static address is deleted, the route becomes RA-learned again.
--- net/ipv6/ip6_fib.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv6/ip6_fib.c +4 -0
@@ -1138,6 +1138,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,fib6_set_expires (iter, rt->expires);fib6_add_gc_list (iter); } +if (!(rt->fib6_flags & (RTF_ADDRCONF |RTF_PREFIX_RT ))) { + iter->fib6_flags &= ~RTF_ADDRCONF ; + iter->fib6_flags &= ~RTF_PREFIX_RT ; + }if (rt->fib6_pmtu) fib6_metric_set(iter, RTAX_MTU,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 327/614 perf arm_spe: Fix memset subclass in operation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <[email protected]>
[ Upstream commit 33e1fffea492b7158a168914dc0da6aedf78d08e ]
The operation subclass is extracted from bits [7..1] of the payload. Since bit [0] is not parsed, there is no chance to match the memset type (0x25). As a result, the memset payload is never parsed successfully.
Instead of extracting a unified bit field, change to extract the specific bits for each operation subclass.
--- .../arm-spe-decoder/arm-spe-pkt-decoder.c | 25 ++++++------------- .../arm-spe-decoder/arm-spe-pkt-decoder.h | 15 ++++++----- 2 files changed, 14 insertions(+), 26 deletions(-)
tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.c +7 -18
@@ -371,31 +371,20 @@ static int arm_spe_pkt_desc_op_type(const struct arm_spe_pkt *packet,arm_spe_pkt_out_string (&err, &buf, &buf_len," AR" ); } -switch (SPE_OP_PKT_LDST_SUBCLASS_GET (payload)) { -case SPE_OP_PKT_LDST_SUBCLASS_SIMD_FP : +if (SPE_OP_PKT_LDST_SUBCLASS_SIMD_FP (payload))arm_spe_pkt_out_string (&err, &buf, &buf_len," SIMD-FP" ); -break ; -case SPE_OP_PKT_LDST_SUBCLASS_GP_REG : +else if (SPE_OP_PKT_LDST_SUBCLASS_GP_REG (payload))arm_spe_pkt_out_string (&err, &buf, &buf_len," GP-REG" ); -break ; -case SPE_OP_PKT_LDST_SUBCLASS_UNSPEC_REG : +else if (SPE_OP_PKT_LDST_SUBCLASS_UNSPEC_REG (payload))arm_spe_pkt_out_string (&err, &buf, &buf_len," UNSPEC-REG" ); -break ; -case SPE_OP_PKT_LDST_SUBCLASS_NV_SYSREG : +else if (SPE_OP_PKT_LDST_SUBCLASS_NV_SYSREG (payload))arm_spe_pkt_out_string (&err, &buf, &buf_len," NV-SYSREG" ); -break ; -case SPE_OP_PKT_LDST_SUBCLASS_MTE_TAG : +else if (SPE_OP_PKT_LDST_SUBCLASS_MTE_TAG (payload))arm_spe_pkt_out_string (&err, &buf, &buf_len," MTE-TAG" ); -break ; -case SPE_OP_PKT_LDST_SUBCLASS_MEMCPY : +else if (SPE_OP_PKT_LDST_SUBCLASS_MEMCPY (payload))arm_spe_pkt_out_string (&err, &buf, &buf_len," MEMCPY" ); -break ; -case SPE_OP_PKT_LDST_SUBCLASS_MEMSET : +else if (SPE_OP_PKT_LDST_SUBCLASS_MEMSET (payload))arm_spe_pkt_out_string (&err, &buf, &buf_len," MEMSET" ); -break ; -default : -break ; - }if (SPE_OP_PKT_IS_LDST_SVE (payload)) {/* SVE effective vector length */
tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.h +7 -8
@@ -125,14 +125,13 @@ enum arm_spe_events {#define SPE_OP_PKT_IS_OTHER_SVE_OP (v) (((v) & (BIT(7) | BIT(3) | BIT(0))) == 0x8) -#define SPE_OP_PKT_LDST_SUBCLASS_GET (v) ((v) & GENMASK_ULL(7, 1)) -#define SPE_OP_PKT_LDST_SUBCLASS_GP_REG 0x0 -#define SPE_OP_PKT_LDST_SUBCLASS_SIMD_FP 0x4 -#define SPE_OP_PKT_LDST_SUBCLASS_UNSPEC_REG 0x10 -#define SPE_OP_PKT_LDST_SUBCLASS_NV_SYSREG 0x30 -#define SPE_OP_PKT_LDST_SUBCLASS_MTE_TAG 0x14 -#define SPE_OP_PKT_LDST_SUBCLASS_MEMCPY 0x20 -#define SPE_OP_PKT_LDST_SUBCLASS_MEMSET 0x25 +#define SPE_OP_PKT_LDST_SUBCLASS_GP_REG (v) (((v) & GENMASK_ULL(7, 1)) == 0x0) +#define SPE_OP_PKT_LDST_SUBCLASS_SIMD_FP (v) (((v) & GENMASK_ULL(7, 1)) == 0x4) +#define SPE_OP_PKT_LDST_SUBCLASS_UNSPEC_REG (v) (((v) & GENMASK_ULL(7, 1)) == 0x10) +#define SPE_OP_PKT_LDST_SUBCLASS_NV_SYSREG (v) (((v) & GENMASK_ULL(7, 1)) == 0x30) +#define SPE_OP_PKT_LDST_SUBCLASS_MTE_TAG (v) (((v) & GENMASK_ULL(7, 1)) == 0x14) +#define SPE_OP_PKT_LDST_SUBCLASS_MEMCPY (v) (((v) & GENMASK_ULL(7, 1)) == 0x20) +#define SPE_OP_PKT_LDST_SUBCLASS_MEMSET (v) (((v) & GENMASK_ULL(7, 0)) == 0x25)#define SPE_OP_PKT_IS_LDST_ATOMIC (v) (((v) & (GENMASK_ULL(7, 5) | BIT(1))) == 0x2)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 328/614 pwm: bcm2835: Make sure the channel is enabled after pwm_request()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit cda323dbda76600bf9761970d58517648f0de67d ]
The .free callback cleared among others the enable bit PWENx in the control register. When the PWM is requested later again this bit isn't restored but the core assumes the PWM is enabled and thus skips a request to configure the same state as before.
To fix that don't touch the hardware configuration in .free(). For symmetry also drop .request() and configure the mode completely in .apply().
--- drivers/pwm/pwm-bcm2835.c | 28 +++------------------------- 1 file changed, 3 insertions(+), 25 deletions(-)
drivers/pwm/pwm-bcm2835.c +3 -25
@@ -34,29 +34,6 @@ static inline struct bcm2835_pwm *to_bcm2835_pwm(struct pwm_chip *chip)return pwmchip_get_drvdata (chip); } -static int bcm2835_pwm_request (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); - value |= (PWM_MODE <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); - -return 0 ; -} - -static void bcm2835_pwm_free (struct pwm_chip *chip,struct pwm_device *pwm) -{ -struct bcm2835_pwm *pc =to_bcm2835_pwm (chip); -u32 value; - - value =readl (pc->base +PWM_CONTROL ); - value &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); -writel (value, pc->base +PWM_CONTROL ); -} -static int bcm2835_pwm_apply (struct pwm_chip *chip,struct pwm_device *pwm,const struct pwm_state *state) {
@@ -102,6 +79,9 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,/* set polarity */ val =readl (pc->base +PWM_CONTROL ); + val &= ~(PWM_CONTROL_MASK <<PWM_CONTROL_SHIFT (pwm->hwpwm)); + val |=PWM_MODE <<PWM_CONTROL_SHIFT (pwm->hwpwm); +if (state->polarity ==PWM_POLARITY_NORMAL ) val &= ~(PWM_POLARITY <<PWM_CONTROL_SHIFT (pwm->hwpwm));else
@@ -119,8 +99,6 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, }static const struct pwm_ops bcm2835_pwm_ops = { - .request = bcm2835_pwm_request, - .free = bcm2835_pwm_free, .apply = bcm2835_pwm_apply, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 329/614 scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
[ Upstream commit b0ee72db9132bd19b1b80152b35e0cf6a6cbd9f2 ]
This fixes the dme-reset failed when doing recovery. Because device reset is not enough, we could occasionally see the error below:
ufshcd-rockchip 2a2d0000.ufs: uic cmd 0x14 with arg3 0x0 completion timeout ufshcd-rockchip 2a2d0000.ufs: dme-reset: error code -110 ufshcd-rockchip 2a2d0000.ufs: DME_RESET failed
ufshcd-rockchip 2a2d0000.ufs: ufshcd_host_reset_and_restore: Host init failed -110
Fix this by resetting the controller on PRE_CHANGE stage of hce enable notify.
--- drivers/ufs/host/ufs-rockchip.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/ufs/host/ufs-rockchip.c +13 -6
@@ -20,9 +20,17 @@#include "ufshcd-pltfrm.h" #include "ufs-rockchip.h" +static void ufs_rockchip_controller_reset (struct ufs_rockchip_host *host) +{ +reset_control_assert (host->rst); +udelay (1 ); +reset_control_deassert (host->rst); +} +static int ufs_rockchip_hce_enable_notify (struct ufs_hba *hba,enum ufs_notify_change_status status) { +struct ufs_rockchip_host *host =ufshcd_get_variant (hba);int err =0 ;if (status ==POST_CHANGE ) {
@@ -37,6 +45,9 @@ static int ufs_rockchip_hce_enable_notify(struct ufs_hba *hba,return ufshcd_vops_phy_initialization (hba); } +/* PRE_CHANGE */ +ufs_rockchip_controller_reset (host); +return 0 ; }
@@ -156,9 +167,7 @@ static int ufs_rockchip_common_init(struct ufs_hba *hba)return dev_err_probe (dev,PTR_ERR (host->rst),"failed to get reset control\n" ); -reset_control_assert (host->rst); -udelay (1 ); -reset_control_deassert (host->rst); +ufs_rockchip_controller_reset (host); host->ref_out_clk =devm_clk_get_enabled (dev,"ref_out" );if (IS_ERR (host->ref_out_clk))
@@ -282,9 +291,7 @@ static int ufs_rockchip_runtime_resume(struct device *dev)return err; } -reset_control_assert (host->rst); -udelay (1 ); -reset_control_deassert (host->rst); +ufs_rockchip_controller_reset (host);return ufshcd_runtime_resume (dev); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 330/614 scsi: qla2xxx: Fix improper freeing of purex item
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 78b1a242fe612a755f2158fd206ee6bb577d18ca ]
In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item().
The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc().
An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre-allocated pool, calling kfree() on it is a bug that can lead to memory corruption.
Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items.
--- drivers/scsi/qla2xxx/qla_nvme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_nvme.c +1 -1
@@ -1292,7 +1292,7 @@ void qla2xxx_process_purls_iocb(void **pkt, struct rsp_que **rsp) a.reason =FCNVME_RJT_RC_LOGIC ; a.explanation =FCNVME_RJT_EXP_NONE ; xmt_reject = true; -kfree (item); +qla24xx_free_purex_item (item); goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 331/614 net: phy: realtek: create rtl8211f_config_rgmii_delay()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <[email protected]>
[ Upstream commit 8e982441ba601d982dd0739972115d85ae01d99b ]
The control flow in rtl8211f_config_init() has some pitfalls which were probably unintended. Specifically it has an early return:
switch (phydev->interface) {
...
default: /* the rest of the modes imply leaving delay as is. */
return 0;
}which exits the entire config_init() function. This means it also skips doing things such as disabling CLKOUT or disabling PHY-mode EEE.
For the RTL8211FS, which uses PHY_INTERFACE_MODE_SGMII, this might be a problem. However, I don't know that it is, so there is no Fixes: tag. The issue was observed through code inspection.
--- drivers/net/phy/realtek/realtek_main.c | 65 +++++++++++++++----------- 1 file changed, 39 insertions(+), 26 deletions(-)
drivers/net/phy/realtek/realtek_main.c +39 -26
@@ -560,22 +560,11 @@ static int rtl8211c_config_init(struct phy_device *phydev) CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER); } -static int rtl8211f_config_init (struct phy_device *phydev) +static int rtl8211f_config_rgmii_delay (struct phy_device *phydev) { -struct rtl821x_priv *priv = phydev->priv; -struct device *dev = &phydev->mdio.dev;u16 val_txdly, val_rxdly;int ret; - ret =phy_modify_paged_changed (phydev,RTL8211F_PHYCR_PAGE ,RTL8211F_PHYCR1 , -RTL8211F_ALDPS_PLL_OFF |RTL8211F_ALDPS_ENABLE |RTL8211F_ALDPS_XTAL_OFF , - priv->phycr1); -if (ret <0 ) { -dev_err (dev,"aldps mode configuration failed: %pe\n" , -ERR_PTR (ret)); -return ret; - } -switch (phydev->interface) {case PHY_INTERFACE_MODE_RGMII : val_txdly =0 ;
@@ -605,34 +594,58 @@ static int rtl8211f_config_init(struct phy_device *phydev)RTL8211F_TXCR ,RTL8211F_TX_DELAY , val_txdly);if (ret <0 ) { -dev_err (dev,"Failed to update the TX delay register\n" ); +phydev_err (phydev,"Failed to update the TX delay register: %pe\n" , +ERR_PTR (ret));return ret; }else if (ret) { -dev_dbg (dev, -"%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n" , -str_enable_disable (val_txdly)); +phydev_dbg (phydev, +"%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n" , +str_enable_disable (val_txdly)); }else { -dev_dbg (dev, -"2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n" , -str_enabled_disabled (val_txdly)); +phydev_dbg (phydev, +"2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n" , +str_enabled_disabled (val_txdly)); } ret =phy_modify_paged_changed (phydev,RTL8211F_RGMII_PAGE ,RTL8211F_RXCR ,RTL8211F_RX_DELAY , val_rxdly);if (ret <0 ) { -dev_err (dev,"Failed to update the RX delay register\n" ); +phydev_err (phydev,"Failed to update the RX delay register: %pe\n" , +ERR_PTR (ret));return ret; }else if (ret) { -dev_dbg (dev, -"%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n" , -str_enable_disable (val_rxdly)); +phydev_dbg (phydev, +"%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n" , +str_enable_disable (val_rxdly)); }else { -dev_dbg (dev, -"2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n" , -str_enabled_disabled (val_rxdly)); +phydev_dbg (phydev, +"2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n" , +str_enabled_disabled (val_rxdly)); } +return 0 ; +} + +static int rtl8211f_config_init (struct phy_device *phydev) +{ +struct rtl821x_priv *priv = phydev->priv; +struct device *dev = &phydev->mdio.dev; +int ret; + + ret =phy_modify_paged_changed (phydev,RTL8211F_PHYCR_PAGE ,RTL8211F_PHYCR1 , +RTL8211F_ALDPS_PLL_OFF |RTL8211F_ALDPS_ENABLE |RTL8211F_ALDPS_XTAL_OFF , + priv->phycr1); +if (ret <0 ) { +dev_err (dev,"aldps mode configuration failed: %pe\n" , +ERR_PTR (ret)); +return ret; + } + + ret =rtl8211f_config_rgmii_delay (phydev); +if (ret) +return ret; +if (!priv->has_phycr2)return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 332/614 iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Pillai (Google) <[email protected]>
[ Upstream commit cb3db5a39e2a6b6396df1780d39a250f649d2e3a ]
INTEL_IOMMU_FLOPPY_WA workaround was introduced to create direct mappings for first 16MB for floppy devices as the floppy drivers were not using dma apis. We need not do this direct map if floppy driver is not enabled.
INTEL_IOMMU_FLOPPY_WA is generally not a good idea. Iommu will be mapping pages in this address range while kernel would also be allocating from this range(mostly on memory stress). A misbehaving device using this domain will have access to the pages that the kernel might be actively using. We noticed this while running a test that was trying to figure out if any pages used by kernel is in iommu page tables.
This patch reduces the scope of the above issue by disabling the workaround when floppy driver is not enabled. But we would still need to fix the floppy driver to use dma apis so that we need not do direct map without reserving the pages. Or the other option is to reserve this memory range in firmware so that kernel will not use the pages.
--- drivers/iommu/intel/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/Kconfig +1 -1
@@ -66,7 +66,7 @@ config INTEL_IOMMU_DEFAULT_ON config INTEL_IOMMU_FLOPPY_WA def_bool y - depends on X86 + depends on X86 && BLK_DEV_FD help Floppy disk drivers are known to bypass DMA API calls thereby failing to work when IOMMU is enabled. This
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 333/614 iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aashish Sharma <[email protected]>
[ Upstream commit 6b38a108eeb3936b21643191db535a35dd7c890b ]
Invalidation hint (ih) in the function 'qi_desc_iotlb' is initialized to zero and never used. It is embedded in the 0th bit of the 'addr' parameter. Get the correct 'ih' value from there.
--- drivers/iommu/intel/iommu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/intel/iommu.h +1 -1
@@ -1097,7 +1097,7 @@ static inline void qi_desc_iotlb(struct intel_iommu *iommu, u16 did, u64 addr, struct qi_desc *desc) {u8 dw =0 , dr =0 ; -int ih =0 ; +int ih = addr &1 ;if (cap_write_drain (iommu->cap)) dw =1 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 334/614 wifi: mac80211: fix CMAC functions not handling errors
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chien Wong <[email protected]>
[ Upstream commit 353cda30d30e5dc7cacf8de5d2546724708ae3bb ]
The called hash functions could fail thus we should check return values.
--- net/mac80211/aes_cmac.c | 63 +++++++++++++++++++++++++++++------------ net/mac80211/aes_cmac.h | 8 +++--- net/mac80211/wpa.c | 20 +++++++------ 3 files changed, 61 insertions(+), 30 deletions(-)
net/mac80211/aes_cmac.c +45 -18
@@ -22,50 +22,77 @@static const u8 zero[CMAC_TLEN_256 ]; -void ieee80211_aes_cmac (struct crypto_shash *tfm,const u8 *aad, -const u8 *data,size_t data_len,u8 *mic) +int ieee80211_aes_cmac (struct crypto_shash *tfm,const u8 *aad, +const u8 *data,size_t data_len,u8 *mic) { +int err;SHASH_DESC_ON_STACK (desc, tfm);u8 out[AES_BLOCK_SIZE ];const __le16 *fc; desc->tfm = tfm; -crypto_shash_init (desc); -crypto_shash_update (desc, aad,AAD_LEN ); + err =crypto_shash_init (desc); +if (err) +return err; + err =crypto_shash_update (desc, aad,AAD_LEN ); +if (err) +return err; fc = (const __le16 *)aad;if (ieee80211_is_beacon (*fc)) {/* mask Timestamp field to zero */ -crypto_shash_update (desc, zero,8 ); -crypto_shash_update (desc, data +8 , data_len -8 -CMAC_TLEN ); + err =crypto_shash_update (desc, zero,8 ); +if (err) +return err; + err =crypto_shash_update (desc, data +8 , + data_len -8 -CMAC_TLEN ); +if (err) +return err; }else { -crypto_shash_update (desc, data, data_len -CMAC_TLEN ); + err =crypto_shash_update (desc, data, + data_len -CMAC_TLEN ); +if (err) +return err; } -crypto_shash_finup (desc, zero,CMAC_TLEN , out); - + err =crypto_shash_finup (desc, zero,CMAC_TLEN , out); +if (err) +return err;memcpy (mic, out,CMAC_TLEN ); + +return 0 ; } -void ieee80211_aes_cmac_256 (struct crypto_shash *tfm,const u8 *aad, -const u8 *data,size_t data_len,u8 *mic) +int ieee80211_aes_cmac_256 (struct crypto_shash *tfm,const u8 *aad, +const u8 *data,size_t data_len,u8 *mic) { +int err;SHASH_DESC_ON_STACK (desc, tfm);const __le16 *fc; desc->tfm = tfm; -crypto_shash_init (desc); -crypto_shash_update (desc, aad,AAD_LEN ); + err =crypto_shash_init (desc); +if (err) +return err; + err =crypto_shash_update (desc, aad,AAD_LEN ); +if (err) +return err; fc = (const __le16 *)aad;if (ieee80211_is_beacon (*fc)) {/* mask Timestamp field to zero */ -crypto_shash_update (desc, zero,8 ); -crypto_shash_update (desc, data +8 , - data_len -8 -CMAC_TLEN_256 ); + err =crypto_shash_update (desc, zero,8 ); +if (err) +return err; + err =crypto_shash_update (desc, data +8 , + data_len -8 -CMAC_TLEN_256 ); +if (err) +return err; }else { -crypto_shash_update (desc, data, data_len -CMAC_TLEN_256 ); + err =crypto_shash_update (desc, data, data_len -CMAC_TLEN_256 ); +if (err) +return err; } -crypto_shash_finup (desc, zero,CMAC_TLEN_256 , mic); +return crypto_shash_finup (desc, zero,CMAC_TLEN_256 , mic); } struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
net/mac80211/aes_cmac.h +4 -4
@@ -11,10 +11,10 @@struct crypto_shash *ieee80211_aes_cmac_key_setup (const u8 key[],size_t key_len); -void ieee80211_aes_cmac (struct crypto_shash *tfm,const u8 *aad, -const u8 *data,size_t data_len,u8 *mic); -void ieee80211_aes_cmac_256 (struct crypto_shash *tfm,const u8 *aad, -const u8 *data,size_t data_len,u8 *mic); +int ieee80211_aes_cmac (struct crypto_shash *tfm,const u8 *aad, +const u8 *data,size_t data_len,u8 *mic); +int ieee80211_aes_cmac_256 (struct crypto_shash *tfm,const u8 *aad, +const u8 *data,size_t data_len,u8 *mic);void ieee80211_aes_cmac_key_free (struct crypto_shash *tfm);#endif /* AES_CMAC_H */
net/mac80211/wpa.c +12 -8
@@ -869,8 +869,9 @@ ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)/* * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64) */ -ieee80211_aes_cmac (key->u.aes_cmac.tfm, aad, - skb->data +24 , skb->len -24 , mmie->mic); +if (ieee80211_aes_cmac (key->u.aes_cmac.tfm, aad, + skb->data +24 , skb->len -24 , mmie->mic)) +return TX_DROP ;return TX_CONTINUE ; }
@@ -916,8 +917,9 @@ ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)/* MIC = AES-256-CMAC(IGTK, AAD || Management Frame Body || MMIE, 128) */ -ieee80211_aes_cmac_256 (key->u.aes_cmac.tfm, aad, - skb->data +24 , skb->len -24 , mmie->mic); +if (ieee80211_aes_cmac_256 (key->u.aes_cmac.tfm, aad, + skb->data +24 , skb->len -24 , mmie->mic)) +return TX_DROP ;return TX_CONTINUE ; }
@@ -956,8 +958,9 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)if (!(status->flag &RX_FLAG_DECRYPTED )) {/* hardware didn't decrypt/verify MIC */ bip_aad (skb, aad); -ieee80211_aes_cmac (key->u.aes_cmac.tfm, aad, - skb->data +24 , skb->len -24 , mic); +if (ieee80211_aes_cmac (key->u.aes_cmac.tfm, aad, + skb->data +24 , skb->len -24 , mic)) +return RX_DROP_U_DECRYPT_FAIL ;if (crypto_memneq (mic, mmie->mic,sizeof (mmie->mic))) { key->u.aes_cmac.icverrors++;return RX_DROP_U_MIC_FAIL ;
@@ -1006,8 +1009,9 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)if (!(status->flag &RX_FLAG_DECRYPTED )) {/* hardware didn't decrypt/verify MIC */ bip_aad (skb, aad); -ieee80211_aes_cmac_256 (key->u.aes_cmac.tfm, aad, - skb->data +24 , skb->len -24 , mic); +if (ieee80211_aes_cmac_256 (key->u.aes_cmac.tfm, aad, + skb->data +24 , skb->len -24 , mic)) +return RX_DROP_U_DECRYPT_FAIL ;if (crypto_memneq (mic, mmie->mic,sizeof (mmie->mic))) { key->u.aes_cmac.icverrors++;return RX_DROP_U_MIC_FAIL ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 335/614 tools/rtla: Fix unassigned nr_cpus
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Costa Shulyupin <[email protected]>
[ Upstream commit b4275b23010df719ec6508ddbc84951dcd24adce ]
In recently introduced timerlat_free(),
the variable 'nr_cpus' is not assigned.
Assign it with sysconf(_SC_NPROCESSORS_CONF) as done elsewhere. Remove the culprit: -Wno-maybe-uninitialized. The rest of the code is clean.
--- tools/tracing/rtla/Makefile.rtla | 2 +- tools/tracing/rtla/src/timerlat.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
tools/tracing/rtla/Makefile.rtla +1 -1
@@ -18,7 +18,7 @@ export CC AR STRIP PKG_CONFIG LD_SO_CONF_PATH LDCONFIG FOPTS := -flto=auto -ffat-lto-objects -fexceptions -fstack-protector-strong \ -fasynchronous-unwind-tables -fstack-clash-protection WOPTS := -O -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 \ - -Wp,-D_GLIBCXX_ASSERTIONS -Wno-maybe-uninitialized + -Wp,-D_GLIBCXX_ASSERTIONS ifeq ($(CC),clang) FOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(FOPTS))
tools/tracing/rtla/src/timerlat.c +2 -1
@@ -215,7 +215,8 @@ void timerlat_analyze(struct osnoise_tool *tool, bool stopped)void timerlat_free (struct osnoise_tool *tool) {struct timerlat_params *params =to_timerlat_params (tool->params); -int nr_cpus, i; +int nr_cpus =sysconf (_SC_NPROCESSORS_CONF); +int i;timerlat_aa_destroy ();if (dma_latency_fd >=0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 336/614 tools/rtla: Fix --on-threshold always triggering
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit 417bd0d502f90a2e785e7299dae4f248b5ac0292 ]
Commit 8d933d5c89e8 ("rtla/timerlat: Add continue action") moved the code performing on-threshold actions (enabled through --on-threshold option) to inside the RTLA main loop.
The condition in the loop does not check whether the threshold was actually exceeded or if stop tracing was requested by the user through SIGINT or duration. This leads to a bug where on-threshold actions are always performed, even when the threshold was not hit.
(BPF mode is not affected, since it uses a different condition in the while loop.)
Add a condition that checks for !stop_tracing before executing the actions. Also, fix incorrect brackets in hist_main_loop to match the semantics of top_main_loop.
--- tools/tracing/rtla/src/common.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
tools/tracing/rtla/src/common.c +15 -9
@@ -268,6 +268,10 @@ int top_main_loop(struct osnoise_tool *tool) tool->ops->print_stats (tool);if (osnoise_trace_is_off (tool, record)) { +if (stop_tracing) +/* stop tracing requested, do not perform actions */ +return 0 ; +actions_perform (¶ms->threshold_actions);if (!params->threshold_actions.continue_flag)
@@ -315,20 +319,22 @@ int hist_main_loop(struct osnoise_tool *tool) }if (osnoise_trace_is_off (tool, tool->record)) { +if (stop_tracing) +/* stop tracing requested, do not perform actions */ +break ; +actions_perform (¶ms->threshold_actions); -if (!params->threshold_actions.continue_flag) { +if (!params->threshold_actions.continue_flag)/* continue flag not set, break */ break ; -/* continue action reached, re-enable tracing */ -if (tool->record) -trace_instance_start (&tool->record->trace); -if (tool->aa) -trace_instance_start (&tool->aa->trace); -trace_instance_start (&tool->trace); - } -break ; +/* continue action reached, re-enable tracing */ +if (tool->record) +trace_instance_start (&tool->record->trace); +if (tool->aa) +trace_instance_start (&tool->aa->trace); +trace_instance_start (&tool->trace); }/* is there still any user-threads ? */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 337/614 mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit b4b1bd1f330fdd13706382be6c90ce9f58cee3f5 ]
If devm_request_threaded_irq() fails after irq_domain_create_linear() succeeds in mt6397_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful irq_domain_create_linear() to properly release the IRQ domain.
--- drivers/mfd/mt6397-irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/mt6397-irq.c +1 -0
@@ -229,6 +229,7 @@ int mt6397_irq_init(struct mt6397_chip *chip)if (ret) {dev_err (chip->dev,"failed to register irq=%d; err: %d\n" , chip->irq, ret); +irq_domain_remove (chip->irq_domain);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 338/614 mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 384bd58bf7095e4c4c8fcdbcede316ef342c630c ]
If devm_request_threaded_irq() fails after irq_domain_add_linear() succeeds in mt6358_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful irq_domain_add_linear() to properly release the IRQ domain.
--- drivers/mfd/mt6358-irq.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/mt6358-irq.c +1 -0
@@ -285,6 +285,7 @@ int mt6358_irq_init(struct mt6397_chip *chip)if (ret) {dev_err (chip->dev,"Failed to register IRQ=%d, ret=%d\n" , chip->irq, ret); +irq_domain_remove (chip->irq_domain);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 339/614 of/fdt: Consolidate duplicate code into helper functions
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
[ Upstream commit 8278cb72c60399f6dc6300c409879fb4c7291513 ]
Currently, there are many pieces of nearly identical code scattered across different places. Consolidate the duplicate code into helper functions to improve maintainability and reduce the likelihood of errors.
Stable-dep-of: bec5f6092bc1 ("of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr()")
--- drivers/of/fdt.c | 41 +++++++++++++++++++++++++++++++++++++++++ include/linux/of_fdt.h | 9 +++++++++ 2 files changed, 50 insertions(+)
drivers/of/fdt.c +41 -0
@@ -625,6 +625,47 @@ const void *__init of_get_flat_dt_prop(unsigned long node, const char *name,return fdt_getprop (initial_boot_params, node, name, size); } +const __be32 *__init of_flat_dt_get_addr_size_prop (unsigned long node, +const char *name, +int *entries) +{ +const __be32 *prop; +int len, elen = (dt_root_addr_cells + dt_root_size_cells) *sizeof (__be32); + + prop =of_get_flat_dt_prop (node, name, &len); +if (!prop || len % elen) { + *entries =0 ; +return NULL ; + } + + *entries = len / elen; +return prop; +} + +bool __init of_flat_dt_get_addr_size (unsigned long node,const char *name, +u64 *addr,u64 *size) +{ +const __be32 *prop; +int entries; + + prop =of_flat_dt_get_addr_size_prop (node, name, &entries); +if (!prop || entries !=1 ) +return false; + +of_flat_dt_read_addr_size (prop,0 , addr, size); +return true; +} + +void __init of_flat_dt_read_addr_size (const __be32 *prop,int entry_index, +u64 *addr,u64 *size) +{ +int entry_cells = dt_root_addr_cells + dt_root_size_cells; + prop += entry_cells * entry_index; + + *addr =dt_mem_next_cell (dt_root_addr_cells, &prop); + *size =dt_mem_next_cell (dt_root_size_cells, &prop); +} +/** * of_fdt_is_compatible - Return true if given node from the given blob has * compat in its compatible list
include/linux/of_fdt.h +9 -0
@@ -55,6 +55,15 @@ extern int of_get_flat_dt_subnode_by_name(unsigned long node, const char *uname);extern const void *of_get_flat_dt_prop (unsigned long node,const char *name,int *size); + +extern const __be32 *of_flat_dt_get_addr_size_prop (unsigned long node, +const char *name, +int *entries); +extern bool of_flat_dt_get_addr_size (unsigned long node,const char *name, +u64 *addr,u64 *size); +extern void of_flat_dt_read_addr_size (const __be32 *prop,int entry_index, +u64 *addr,u64 *size); +extern int of_flat_dt_is_compatible (unsigned long node,const char *name);extern unsigned long of_get_flat_dt_root (void );extern uint32_t of_get_flat_dt_phandle (unsigned long node);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 340/614 of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
[ Upstream commit bec5f6092bc1328895992ff02b862ba34b45a0b7 ]
The len value is in bytes, while dt_root_addr_cells + dt_root_size_cells is in cells (4 bytes per cell). Comparing them directly is incorrect.
Use a helper function to simplify the code and address this issue.
--- drivers/of/fdt.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/of/fdt.c +2 -8
@@ -853,21 +853,15 @@ static void __init early_init_dt_check_for_initrd(unsigned long node)*/ static void __init early_init_dt_check_for_elfcorehdr (unsigned long node) { -const __be32 *prop; -int len; -if (!IS_ENABLED (CONFIG_CRASH_DUMP ))return ;pr_debug ("Looking for elfcorehdr property... " ); - prop =of_get_flat_dt_prop (node,"linux,elfcorehdr" , &len); -if (!prop || (len < (dt_root_addr_cells + dt_root_size_cells))) +if (!of_flat_dt_get_addr_size (node,"linux,elfcorehdr" , + &elfcorehdr_addr, &elfcorehdr_size))return ; - elfcorehdr_addr =dt_mem_next_cell (dt_root_addr_cells, &prop); - elfcorehdr_size =dt_mem_next_cell (dt_root_size_cells, &prop); -pr_debug ("elfcorehdr_start=0x%llx elfcorehdr_size=0x%llx\n" , elfcorehdr_addr, elfcorehdr_size); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 341/614 of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
[ Upstream commit 463942de13cd30fad5dba709f708483eab7efc2c ]
The len value is in bytes, while dt_root_addr_cells + dt_root_size_cells is in cells (4 bytes per cell). Modulo calculation between them is incorrect, the units must be converted first.
Use helper functions to simplify the code and fix this issue.
--- drivers/of/fdt.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/of/fdt.c +11 -7
@@ -884,8 +884,9 @@ static unsigned long chosen_node_offset = -FDT_ERR_NOTFOUND;void __init early_init_dt_check_for_usable_mem_range (void ) {struct memblock_region rgn[MAX_USABLE_RANGES ] = {0 }; -const __be32 *prop, *endp; +const __be32 *prop;int len, i; +u64 base, size;unsigned long node = chosen_node_offset;if ((long )node <0 )
@@ -893,14 +894,17 @@ void __init early_init_dt_check_for_usable_mem_range(void)pr_debug ("Looking for usable-memory-range property... " ); - prop =of_get_flat_dt_prop (node,"linux,usable-memory-range" , &len); -if (!prop || (len % (dt_root_addr_cells + dt_root_size_cells))) + prop =of_flat_dt_get_addr_size_prop (node,"linux,usable-memory-range" , + &len); +if (!prop)return ; - endp = prop + (len /sizeof (__be32)); -for (i =0 ; i <MAX_USABLE_RANGES && prop < endp; i++) { - rgn[i].base =dt_mem_next_cell (dt_root_addr_cells, &prop); - rgn[i].size =dt_mem_next_cell (dt_root_size_cells, &prop); + len =min (len,MAX_USABLE_RANGES ); + +for (i =0 ; i < len; i++) { +of_flat_dt_read_addr_size (prop, i, &base, &size); + rgn[i].base = base; + rgn[i].size = size;pr_debug ("cap_mem_regions[%d]: base=%pa, size=%pa\n" , i, &rgn[i].base, &rgn[i].size);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 342/614 of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <[email protected]>
[ Upstream commit c85da64ce2c36bba469f6feede9ca768f0361741 ]
When reading the fdt_size value, the argument passed to dt_mem_next_cell() is dt_root_addr_cells, but it should be dt_root_size_cells.
The same issue occurs when reading the scratch_size value.
Use a helper function to simplify the code and fix these issues.
--- drivers/of/fdt.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/of/fdt.c +4 -12
@@ -922,26 +922,18 @@ static void __init early_init_dt_check_kho(void) {unsigned long node = chosen_node_offset;u64 fdt_start, fdt_size, scratch_start, scratch_size; -const __be32 *p; -int l;if (!IS_ENABLED (CONFIG_KEXEC_HANDOVER ) || (long )node <0 )return ; - p =of_get_flat_dt_prop (node,"linux,kho-fdt" , &l); -if (l != (dt_root_addr_cells + dt_root_size_cells) *sizeof (__be32)) +if (!of_flat_dt_get_addr_size (node,"linux,kho-fdt" , + &fdt_start, &fdt_size))return ; - fdt_start =dt_mem_next_cell (dt_root_addr_cells, &p); - fdt_size =dt_mem_next_cell (dt_root_addr_cells, &p); - - p =of_get_flat_dt_prop (node,"linux,kho-scratch" , &l); -if (l != (dt_root_addr_cells + dt_root_size_cells) *sizeof (__be32)) +if (!of_flat_dt_get_addr_size (node,"linux,kho-scratch" , + &scratch_start, &scratch_size))return ; - scratch_start =dt_mem_next_cell (dt_root_addr_cells, &p); - scratch_size =dt_mem_next_cell (dt_root_addr_cells, &p); -kho_populate (fdt_start, fdt_size, scratch_start, scratch_size); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 343/614 leds: rgb: leds-qcom-lpg: Dont enable TRILED when configuring PWM
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fenglin Wu <[email protected]>
[ Upstream commit 072cd5f458d76b9e15d89ebdaea8b5cb1312eeef ]
The PWM signal from the LPG channel can be routed to PMIC GPIOs with proper GPIO configuration, and it is not necessary to enable the TRILED channel in that case. This also applies to the LPG channels that mapped to TRILED channels. Additionally, enabling the TRILED channel unnecessarily would cause a voltage increase in its power supply. Hence remove it.
--- drivers/leds/rgb/leds-qcom-lpg.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/leds/rgb/leds-qcom-lpg.c +1 -3
@@ -2,7 +2,7 @@/* * Copyright (c) 2017-2022 Linaro Ltd * Copyright (c) 2010-2012, The Linux Foundation. All rights reserved. -* Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include <linux/bits.h> #include <linux/bitfield.h>
@@ -1247,8 +1247,6 @@ static int lpg_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,lpg_apply (chan); -triled_set (lpg, chan->triled_mask, chan->enabled ? chan->triled_mask :0 ); - out_unlock:mutex_unlock (&lpg->lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 344/614 phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 662bb179d3381c7c069e44bb177396bcaee31cc8 ]
If an error occurs after the reset_control_deassert(), reset_control_assert() must be called, as already done in the remove function.
Use devm_add_action_or_reset() to add the missing call and simplify the .remove() function accordingly.
While at it, drop struct rcar_gen3_chan::rstc as it is not used aymore.
[claudiu.beznea: removed "struct reset_control *rstc = data;" from
rcar_gen3_reset_assert(), dropped struct rcar_gen3_chan::rstc]
--- drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/phy/renesas/phy-rcar-gen3-usb2.c +14 -6
@@ -134,7 +134,6 @@ struct rcar_gen3_chan {struct extcon_dev *extcon;struct rcar_gen3_phy rphys[NUM_OF_PHYS ];struct regulator *vbus; -struct reset_control *rstc;struct work_struct work;spinlock_t lock;/* protects access to hardware and driver data structure. */ enum usb_dr_mode dr_mode;
@@ -771,21 +770,31 @@ static enum usb_dr_mode rcar_gen3_get_dr_mode(struct device_node *np)return candidate; } +static void rcar_gen3_reset_assert (void *data) +{ +reset_control_assert (data); +} +static int rcar_gen3_phy_usb2_init_bus (struct rcar_gen3_chan *channel) {struct device *dev = channel->dev; +struct reset_control *rstc;int ret;u32 val; - channel->rstc =devm_reset_control_array_get_shared (dev); -if (IS_ERR (channel->rstc)) -return PTR_ERR (channel->rstc); + rstc =devm_reset_control_array_get_shared (dev); +if (IS_ERR (rstc)) +return PTR_ERR (rstc); ret =pm_runtime_resume_and_get (dev);if (ret)return ret; - ret =reset_control_deassert (channel->rstc); + ret =reset_control_deassert (rstc); +if (ret) + goto rpm_put; + + ret =devm_add_action_or_reset (dev, rcar_gen3_reset_assert, rstc);if (ret) goto rpm_put;
@@ -924,7 +933,6 @@ static void rcar_gen3_phy_usb2_remove(struct platform_device *pdev)if (channel->is_otg_channel)device_remove_file (&pdev->dev, &dev_attr_role); -reset_control_assert (channel->rstc);pm_runtime_disable (&pdev->dev); };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 345/614 phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
[ Upstream commit a2a18e5da64f8da306fa97c397b4c739ea776f37 ]
When PCIe link enters L1 PM substates, the PHY will turn off its PLL for power-saving. However, it turns off the PLL too fast which leads the PHY to be broken. According to the PHY document, we need to delay PLL turnoff time.
--- drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +7 -0
@@ -21,6 +21,9 @@#define REF_CLOCK_100MHz (100 * HZ_PER_MHZ)/* RK3528 COMBO PHY REG */ +#define RK3528_PHYREG5 0x14 +#define RK3528_PHYREG5_GATE_TX_PCK_SEL BIT(3) +#define RK3528_PHYREG5_GATE_TX_PCK_DLY_PLL_OFF BIT(3)#define RK3528_PHYREG6 0x18#define RK3528_PHYREG6_PLL_KVCO GENMASK(12, 10)#define RK3528_PHYREG6_PLL_KVCO_VALUE 0x2
@@ -504,6 +507,10 @@ static int rk3528_combphy_cfg(struct rockchip_combphy_priv *priv)case REF_CLOCK_100MHz:rockchip_combphy_param_write (priv->phy_grf, &cfg->pipe_clk_100m, true);if (priv->type ==PHY_TYPE_PCIE ) { +/* Gate_tx_pck_sel length select for L1ss support */ +rockchip_combphy_updatel (priv,RK3528_PHYREG5_GATE_TX_PCK_SEL , +RK3528_PHYREG5_GATE_TX_PCK_DLY_PLL_OFF ,RK3528_PHYREG5 ); +/* PLL KVCO tuning fine */ val =FIELD_PREP (RK3528_PHYREG6_PLL_KVCO ,RK3528_PHYREG6_PLL_KVCO_VALUE ); rockchip_combphy_updatel(priv, RK3528_PHYREG6_PLL_KVCO, val,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 346/614 phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <[email protected]>
[ Upstream commit be866e68966d20bcc4a73708093d577176f99c0c ]
When PCIe link enters L1 PM substates, the PHY will turn off its PLL for power-saving. However, it turns off the PLL too fast which leads the PHY to be broken. According to the PHY document, we need to delay PLL turnoff time.
--- drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +8 -0
@@ -106,6 +106,10 @@#define RK3568_PHYREG18 0x44#define RK3568_PHYREG18_PLL_LOOP 0x32 +#define RK3568_PHYREG30 0x74 +#define RK3568_PHYREG30_GATE_TX_PCK_SEL BIT(7) +#define RK3568_PHYREG30_GATE_TX_PCK_DLY_PLL_OFF BIT(7) +#define RK3568_PHYREG32 0x7C#define RK3568_PHYREG32_SSC_MASK GENMASK(7, 4)#define RK3568_PHYREG32_SSC_DIR_MASK GENMASK(5, 4)
@@ -664,6 +668,10 @@ static int rk3562_combphy_cfg(struct rockchip_combphy_priv *priv)case REF_CLOCK_100MHz:rockchip_combphy_param_write (priv->phy_grf, &cfg->pipe_clk_100m, true);if (priv->type ==PHY_TYPE_PCIE ) { +/* Gate_tx_pck_sel length select for L1ss support */ +rockchip_combphy_updatel (priv,RK3568_PHYREG30_GATE_TX_PCK_SEL , +RK3568_PHYREG30_GATE_TX_PCK_DLY_PLL_OFF , +RK3568_PHYREG30 );/* PLL KVCO tuning fine */ val =FIELD_PREP (RK3568_PHYREG33_PLL_KVCO_MASK ,RK3568_PHYREG33_PLL_KVCO_VALUE );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 347/614 phy: freescale: Initialize priv->lock
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit 95e5905698983df94069e185f9eb3c67c7cf75d5 ]
Initialize priv->lock to fix the following warning.
WARNING: CPU: 0 PID: 12 at kernel/locking/mutex.c:577 __mutex_lock+0x70c/0x8b8 Modules linked in: Hardware name: Freescale i.MX8QM MEK (DT) Call trace: __mutex_lock+0x70c/0x8b8 (P) mutex_lock_nested+0x24/0x30 imx_hsio_power_on+0x4c/0x764 phy_power_on+0x7c/0x12c imx_pcie_host_init+0x1d0/0x4d4 dw_pcie_host_init+0x188/0x4b0 imx_pcie_probe+0x324/0x6f4 platform_probe+0x5c/0x98 really_probe+0xbc/0x29c __driver_probe_device+0x78/0x12c driver_probe_device+0xd8/0x160 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x84/0xe4 __device_attach_async_helper+0xb8/0xdc async_run_entry_fn+0x34/0xe0 process_one_work+0x220/0x694 worker_thread+0x1c0/0x36c kthread+0x14c/0x224
--- drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/phy/freescale/phy-fsl-imx8qm-hsio.c +4 -1
@@ -533,7 +533,7 @@ static struct phy *imx_hsio_xlate(struct device *dev,static int imx_hsio_probe (struct platform_device *pdev) { -int i; +int i, ret;void __iomem *off;struct device *dev = &pdev->dev;struct device_node *np = dev->of_node;
@@ -545,6 +545,9 @@ static int imx_hsio_probe(struct platform_device *pdev)return -ENOMEM ; priv->dev = &pdev->dev; priv->drvdata =of_device_get_match_data (dev); + ret =devm_mutex_init (dev, &priv->lock); +if (ret) +return ret;/* Get HSIO configuration mode */ if (of_property_read_string (np,"fsl,hsio-cfg" , &priv->hsio_cfg))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 348/614 phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 72126e9623e1696ea83c77ef6d0306a6263bdd6b ]
When making use of the clock provider functionality, the output clock does normally match the TMDS character rate, which is what the PHY PLL gets configured to.
However, this is only applicable for default color depth of 8 bpc. For higher depths, the output clock is further divided by the hardware according to the formula:
output_clock_rate = tmds_char_rate * 8 / bpc
Since the existence of the clock divider wasn't taken into account when support for high bpc has been introduced, make the necessary adjustments to report the correct clock rate.
--- drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c +8 -6
@@ -1037,7 +1037,8 @@ static int rk_hdptx_ropll_tmds_cmn_config(struct rk_hdptx_phy *hdptx) ret =rk_hdptx_post_enable_pll (hdptx);if (!ret) - hdptx->hw_rate = hdptx->hdmi_cfg.tmds_char_rate; + hdptx->hw_rate =DIV_ROUND_CLOSEST_ULL (hdptx->hdmi_cfg.tmds_char_rate *8 , + hdptx->hdmi_cfg.bpc);return ret; }
@@ -1895,19 +1896,20 @@ static long rk_hdptx_phy_clk_round_rate(struct clk_hw *hw, unsigned long rate,* hence ensure rk_hdptx_phy_clk_set_rate() won't be invoked with * a different rate argument. */ -return hdptx->hdmi_cfg.tmds_char_rate; +return DIV_ROUND_CLOSEST_ULL (hdptx->hdmi_cfg.tmds_char_rate *8 , hdptx->hdmi_cfg.bpc); }static int rk_hdptx_phy_clk_set_rate (struct clk_hw *hw,unsigned long rate,unsigned long parent_rate) {struct rk_hdptx_phy *hdptx =to_rk_hdptx_phy (hw); +unsigned long long tmds_rate =DIV_ROUND_CLOSEST_ULL (rate * hdptx->hdmi_cfg.bpc,8 );/* Revert any unlikely TMDS char rate change since round_rate() */ -if (hdptx->hdmi_cfg.tmds_char_rate != rate) { -dev_warn (hdptx->dev,"Reverting unexpected rate change from %lu to %llu\n" , - rate, hdptx->hdmi_cfg.tmds_char_rate); - hdptx->hdmi_cfg.tmds_char_rate = rate; +if (hdptx->hdmi_cfg.tmds_char_rate != tmds_rate) { +dev_warn (hdptx->dev,"Reverting unexpected rate change from %llu to %llu\n" , + tmds_rate, hdptx->hdmi_cfg.tmds_char_rate); + hdptx->hdmi_cfg.tmds_char_rate = tmds_rate; }/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 349/614 phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 8daaced9f5eeb4a2c8ca08b0a8286b6a498a8387 ]
Due to its relatively low frequency, a noise stemming from the 24MHz PLL reference clock may traverse the low-pass loop filter of ROPLL, which could potentially generate some HDMI flash artifacts.
Reduce ROPLL loop bandwidth in an attempt to mitigate the problem.
--- drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c +2 -2
@@ -500,9 +500,7 @@ static const struct reg_sequence rk_hdtpx_common_cmn_init_seq[] = {REG_SEQ0 (CMN_REG (0043 ),0x00 ),REG_SEQ0 (CMN_REG (0044 ),0x46 ),REG_SEQ0 (CMN_REG (0045 ),0x24 ), -REG_SEQ0 (CMN_REG (0046 ),0xff ),REG_SEQ0 (CMN_REG (0047 ),0x00 ), -REG_SEQ0 (CMN_REG (0048 ),0x44 ),REG_SEQ0 (CMN_REG (0049 ),0xfa ), REG_SEQ0(CMN_REG(004a), 0x08), REG_SEQ0(CMN_REG(004b), 0x00),
@@ -575,6 +573,8 @@ static const struct reg_sequence rk_hdtpx_tmds_cmn_init_seq[] = {REG_SEQ0 (CMN_REG (0034 ),0x00 ),REG_SEQ0 (CMN_REG (003d ),0x40 ),REG_SEQ0 (CMN_REG (0042 ),0x78 ), +REG_SEQ0 (CMN_REG (0046 ),0xdd ), +REG_SEQ0 (CMN_REG (0048 ),0x11 ),REG_SEQ0 (CMN_REG (004e ),0x34 ), REG_SEQ0(CMN_REG(005c), 0x25), REG_SEQ0(CMN_REG(005e), 0x4f),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 350/614 phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 51023cf6cc5db3423dea6620746d9087e336e024 ]
Fixup PHY deskew FIFO to prevent the phase of D2 lane going ahead of other lanes. It's worth noting this might only happen when dealing with HDMI 2.0 rates.
--- drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c +5 -4
@@ -668,13 +668,9 @@ static const struct reg_sequence rk_hdtpx_common_lane_init_seq[] = {static const struct reg_sequence rk_hdtpx_tmds_lane_init_seq[] = {REG_SEQ0 (LANE_REG (0312 ),0x00 ), -REG_SEQ0 (LANE_REG (031e ),0x00 ),REG_SEQ0 (LANE_REG (0412 ),0x00 ), -REG_SEQ0 (LANE_REG (041e ),0x00 ),REG_SEQ0 (LANE_REG (0512 ),0x00 ), -REG_SEQ0 (LANE_REG (051e ),0x00 ),REG_SEQ0 (LANE_REG (0612 ),0x00 ), -REG_SEQ0 (LANE_REG (061e ),0x08 ),REG_SEQ0 (LANE_REG (0303 ),0x2f ),REG_SEQ0 (LANE_REG (0403 ),0x2f ),REG_SEQ0 (LANE_REG (0503 ),0x2f ),
@@ -687,6 +683,11 @@ static const struct reg_sequence rk_hdtpx_tmds_lane_init_seq[] = {REG_SEQ0 (LANE_REG (0406 ),0x1c ),REG_SEQ0 (LANE_REG (0506 ),0x1c ),REG_SEQ0 (LANE_REG (0606 ),0x1c ), +/* Keep Inter-Pair Skew in the limits */ +REG_SEQ0 (LANE_REG (031e ),0x02 ), +REG_SEQ0 (LANE_REG (041e ),0x02 ), +REG_SEQ0 (LANE_REG (051e ),0x02 ), + REG_SEQ0(LANE_REG(061e), 0x0a), }; static struct tx_drv_ctrl tx_drv_ctrl_rbr[4][4] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 351/614 ASoC: SDCA: Fix missing dash in HIDE DisCo property
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 3508311f2e1c872b645f13c6fd52840418089d41 ]
The property name is "mipi-sdca-RxUMP-ownership-transition-max-delay", with a dash between max and delay. Add the missing dash.
--- sound/soc/sdca/sdca_functions.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sdca/sdca_functions.c +1 -1
@@ -1263,7 +1263,7 @@ find_sdca_entity_hide(struct device *dev, struct fwnode_handle *function_node,unsigned char *report_desc =NULL ; ret =fwnode_property_read_u32 (entity_node, -"mipi-sdca-RxUMP-ownership-transition-maxdelay" , &delay); +"mipi-sdca-RxUMP-ownership-transition-max-delay" , &delay);if (!ret) hide->max_delay = delay;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 352/614 selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <[email protected]>
[ Upstream commit d088da904223e8f5e19c6d156cf372d5baec1a7c ]
subtest_kmem_cache_iter_check_slabinfo() fundamentally compares slab cache names parsed out from /proc/slabinfo against those stored within struct kmem_cache_result. The current problem is that the slab cache name within struct kmem_cache_result is stored within a bounded fixed-length array (sized to SLAB_NAME_MAX(32)), whereas the name parsed out from /proc/slabinfo is not. Meaning, using ASSERT_STREQ() can certainly lead to test failures, particularly when dealing with slab cache names that are longer than SLAB_NAME_MAX(32) bytes. Notably, kmem_cache_create() allows callers to create slab caches with somewhat arbitrarily sized names via its __name identifier argument, so exceeding the SLAB_NAME_MAX(32) limit that is in place now can certainly happen.
Make subtest_kmem_cache_iter_check_slabinfo() more reliable by only checking up to sizeof(struct kmem_cache_result.name) - 1 using ASSERT_STRNEQ().
--- tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c +2 -1
@@ -57,7 +57,8 @@ static void subtest_kmem_cache_iter_check_slabinfo(struct kmem_cache_iter *skel)if (!ASSERT_OK (ret,"kmem_cache_lookup" ))break ; -ASSERT_STREQ (r.name, name,"kmem_cache_name" ); +ASSERT_STRNEQ (r.name, name,sizeof (r.name) -1 , +"kmem_cache_name" );ASSERT_EQ (r.obj_size, objsize,"kmem_cache_objsize" ); seen++;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 353/614 net: phy: adin1100: Fix software power-down ready condition
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Dahl <[email protected]>
[ Upstream commit bccaf1fe08f2c9f96f6bc38391d41e67f6bf38e3 ]
Value CRSM_SFT_PD written to Software Power-Down Control Register (CRSM_SFT_PD_CNTRL) is 0x01 and therefor different to value CRSM_SFT_PD_RDY (0x02) read from System Status Register (CRSM_STAT) for confirmation powerdown has been reached.
The condition could have only worked when disabling powerdown (both 0x00), but never when enabling it (0x01 != 0x02).
Result is a timeout, like so:
$ ifdown eth0
macb f802c000.ethernet eth0: Link is Down
ADIN1100 f802c000.ethernet-ffffffff:01: adin_set_powerdown_mode failed: -110
ADIN1100 f802c000.ethernet-ffffffff:01: adin_set_powerdown_mode failed: -110--- drivers/net/phy/adin1100.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/adin1100.c +1 -1
@@ -201,7 +201,7 @@ static int adin_set_powerdown_mode(struct phy_device *phydev, bool en)return ret;return phy_read_mmd_poll_timeout (phydev,MDIO_MMD_VEND1 ,ADIN_CRSM_STAT , ret, - (ret &ADIN_CRSM_SFT_PD_RDY ) == val, + !!(ret &ADIN_CRSM_SFT_PD_RDY ) == en,1000 ,30000 , true); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 354/614 cpuset: Treat cpusets in attaching as populated
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit b1bcaed1e39a9e0dfbe324a15d2ca4253deda316 ]
Currently, the check for whether a partition is populated does not account for tasks in the cpuset of attaching. This is a corner case that can leave a task stuck in a partition with no effective CPUs.
The race condition occurs as follows:
cpu0 cpu1
//cpuset A with cpu N
migrate task p to Acpuset_can_attach
// with effective cpus
// check ok
// cpuset_mutex is not held // clear cpuset.cpus.exclusive
// making effective cpus empty update_exclusive_cpumask // tasks_nocpu_error check ok // empty effective cpus, partition valid
cpuset_attach
...
// task p stays in A, with non-effective cpus.
To fix this issue, this patch introduces cs_is_populated, which considers tasks in the attaching cpuset. This new helper is used in validate_change and partition_is_populated.
--- kernel/cgroup/cpuset.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-)
kernel/cgroup/cpuset.c +27 -8
@@ -352,6 +352,15 @@ static inline bool is_in_v2_mode(void) (cpuset_cgrp_subsys.root->flags &CGRP_ROOT_CPUSET_V2_MODE ); } +static inline bool cpuset_is_populated (struct cpuset *cs) +{ +lockdep_assert_held (&cpuset_mutex); + +/* Cpusets in the process of attaching should be considered as populated */ +return cgroup_is_populated (cs->css.cgroup) || + cs->attach_in_progress; +} +/** * partition_is_populated - check if partition has tasks * @cs: partition root to be checked
@@ -364,21 +373,31 @@ static inline bool is_in_v2_mode(void)static inline bool partition_is_populated (struct cpuset *cs,struct cpuset *excluded_child) { -struct cgroup_subsys_state *css; -struct cpuset *child; +struct cpuset *cp; +struct cgroup_subsys_state *pos_css; -if (cs->css.cgroup->nr_populated_csets) +/* +* We cannot call cs_is_populated(cs) directly, as +* nr_populated_domain_children may include populated +* csets from descendants that are partitions. +*/ +if (cs->css.cgroup->nr_populated_csets || + cs->attach_in_progress)return true;if (!excluded_child && !cs->nr_subparts)return cgroup_is_populated (cs->css.cgroup);rcu_read_lock (); -cpuset_for_each_child (child, css, cs) { -if (child == excluded_child) +cpuset_for_each_descendant_pre (cp, pos_css, cs) { +if (cp == cs || cp == excluded_child)continue ; -if (is_partition_valid (child)) + +if (is_partition_valid (cp)) { + pos_css =css_rightmost_descendant (pos_css);continue ; -if (cgroup_is_populated (child->css.cgroup)) { + } + +if (cpuset_is_populated (cp)) {rcu_read_unlock ();return true; }
@@ -663,7 +682,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)* be changed to have empty cpus_allowed or mems_allowed. */ ret = -ENOSPC ; -if ((cgroup_is_populated (cur->css.cgroup) || cur->attach_in_progress)) { +if (cpuset_is_populated (cur)) {if (!cpumask_empty (cur->cpus_allowed) &&cpumask_empty (trial->cpus_allowed)) goto out;
Signature · 1 line
2.51.0
答复: [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated
-----邮件原件-----
发件人: Greg Kroah-Hartman <[email protected]>
发送时间: 2025年12月16日 19:12
收件人: [email protected]
抄送: Greg Kroah-Hartman <[email protected]>; [email protected]; chenridong <[email protected]>; Waiman Long <[email protected]>; Tejun Heo <[email protected]>; Sasha Levin <[email protected]> 主题: [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <[email protected]>
[ Upstream commit b1bcaed1e39a9e0dfbe324a15d2ca4253deda316 ]
Currently, the check for whether a partition is populated does not account for tasks in the cpuset of attaching. This is a corner case that can leave a task stuck in a partition with no effective CPUs.
The race condition occurs as follows:
cpu0 cpu1
//cpuset A with cpu N
migrate task p to Acpuset_can_attach
// with effective cpus
// check ok
// cpuset_mutex is not held // clear cpuset.cpus.exclusive
// making effective cpus empty update_exclusive_cpumask // tasks_nocpu_error check ok // empty effective cpus, partition valid cpuset_attach ...
// task p stays in A, with non-effective cpus.
To fix this issue, this patch introduces cs_is_populated, which considers tasks in the attaching cpuset. This new helper is used in validate_change and partition_is_populated.
--- kernel/cgroup/cpuset.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-)
kernel/cgroup/cpuset.c +17 -3
@@ -352,6 +352,15 @@ static inline bool is_in_v2_mode(void) (cpuset_cgrp_subsys.root->flags &CGRP_ROOT_CPUSET_V2_MODE ); } +static inline bool cpuset_is_populated (struct cpuset *cs) { +lockdep_assert_held (&cpuset_mutex); + +/* Cpusets in the process of attaching should be considered as populated */ +return cgroup_is_populated (cs->css.cgroup) || + cs->attach_in_progress; +} +/** * partition_is_populated - check if partition has tasks * @cs: partition root to be checked
@@ -364,21 +373,31 @@ static inline bool is_in_v2_mode(void) static inline bool partition_is_populated(struct cpuset *cs, struct cpuset *excluded_child) { -struct cgroup_subsys_state *css; -struct cpuset *child; +struct cpuset *cp; +struct cgroup_subsys_state *pos_css; -if (cs->css.cgroup->nr_populated_csets) +/* +* We cannot call cs_is_populated(cs) directly, as +* nr_populated_domain_children may include populated +* csets from descendants that are partitions. +*/ +if (cs->css.cgroup->nr_populated_csets || + cs->attach_in_progress)return true;if (!excluded_child && !cs->nr_subparts)return cgroup_is_populated (cs->css.cgroup);
I checked this patch, And I found here should be ' cpuset_is_populated(cs)'.
rcu_read_lock();
- cpuset_for_each_child(child, css, cs) {
- if (child == excluded_child)
+ cpuset_for_each_descendant_pre(cp, pos_css, cs) {
+ if (cp == cs || cp == excluded_child)
continue;
- if (is_partition_valid(child))
+
+ if (is_partition_valid(cp)) {
+ pos_css = css_rightmost_descendant(pos_css);
continue;
- if (cgroup_is_populated(child->css.cgroup)) {
+ }
+
+ if (cpuset_is_populated(cp)) {
rcu_read_unlock();
return true;
}
@@ -663,7 +682,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
* be changed to have empty cpus_allowed or mems_allowed.
*/
ret = -ENOSPC;
- if ((cgroup_is_populated(cur->css.cgroup) || cur->attach_in_progress)) {
+ if (cpuset_is_populated(cur)) {
if (!cpumask_empty(cur->cpus_allowed) &&
cpumask_empty(trial->cpus_allowed))
goto out;
--
2.51.0
Greg Kroah-Hartman
maintainerPATCH 355/614 clk: spacemit: Set clk_hw_onecell_data::num before using flex array
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Mirabile <[email protected]>
[ Upstream commit 23b2d2fb136959fd0a8e309c70be83d9b8841c7e ]
When booting with KASAN enabled the following splat is encountered during probe of the k1 clock driver:
UBSAN: array-index-out-of-bounds in drivers/clk/spacemit/ccu-k1.c:1044:16 index 0 is out of range for type 'clk_hw *[*]' CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc5+ #1 PREEMPT(lazy) Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2022.10spacemit 10/01/2022 Call Trace: [<ffffffff8002b628>] dump_backtrace+0x28/0x38 [<ffffffff800027d2>] show_stack+0x3a/0x50 [<ffffffff800220c2>] dump_stack_lvl+0x5a/0x80 [<ffffffff80022100>] dump_stack+0x18/0x20 [<ffffffff800164b8>] ubsan_epilogue+0x10/0x48 [<ffffffff8099034e>] __ubsan_handle_out_of_bounds+0xa6/0xa8 [<ffffffff80acbfa6>] k1_ccu_probe+0x37e/0x420 [<ffffffff80b79e6e>] platform_probe+0x56/0x98 [<ffffffff80b76a7e>] really_probe+0x9e/0x350 [<ffffffff80b76db0>] __driver_probe_device+0x80/0x138 [<ffffffff80b76f52>] driver_probe_device+0x3a/0xd0 [<ffffffff80b771c4>] __driver_attach+0xac/0x1b8 [<ffffffff80b742fc>] bus_for_each_dev+0x6c/0xc8 [<ffffffff80b76296>] driver_attach+0x26/0x38 [<ffffffff80b759ae>] bus_add_driver+0x13e/0x268 [<ffffffff80b7836a>] driver_register+0x52/0x100 [<ffffffff80b79a78>] __platform_driver_register+0x28/0x38 [<ffffffff814585da>] k1_ccu_driver_init+0x22/0x38 [<ffffffff80023a8a>] do_one_initcall+0x62/0x2a0 [<ffffffff81401c60>] do_initcalls+0x170/0x1a8 [<ffffffff81401e7a>] kernel_init_freeable+0x16a/0x1e0 [<ffffffff811f7534>] kernel_init+0x2c/0x180 [<ffffffff80025f56>] ret_from_fork_kernel+0x16/0x1d8 [<ffffffff81205336>] ret_from_fork_kernel_asm+0x16/0x18 ---[ end trace ]---
This is bogus and is simply a result of KASAN consulting the .num member of the struct for bounds information (as it should due to __counted_by) and finding 0 set by kzalloc() because it has not been initialized before the loop that fills in the array. The easy fix is to just move the line that sets num to before the loop that fills the array so that KASAN has the information it needs to accurately conclude that the access is valid.
--- drivers/clk/spacemit/ccu-k1.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/spacemit/ccu-k1.c +2 -2
@@ -1018,6 +1018,8 @@ static int spacemit_ccu_register(struct device *dev,if (!clk_data)return -ENOMEM ; + clk_data->num = data->num; +for (i =0 ; i < data->num; i++) {struct clk_hw *hw = data->hws[i];struct ccu_common *common;
@@ -1044,8 +1046,6 @@ static int spacemit_ccu_register(struct device *dev, clk_data->hws[i] = hw; } - clk_data->num = data->num; - ret =devm_of_clk_add_hw_provider (dev, of_clk_hw_onecell_get, clk_data);if (ret)dev_err (dev,"failed to add clock hardware provider (%d)\n" , ret);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 356/614 wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <[email protected]>
[ Upstream commit b647d2574e4583c2e3b0ab35568f60c88e910840 ]
The rtl8187_rx_cb() calculates the rx descriptor header address by subtracting its size from the skb tail pointer. However, it does not validate if the received packet (skb->len from urb->actual_length) is large enough to contain this header.
If a truncated packet is received, this will lead to a buffer underflow, reading memory before the start of the skb data area, and causing a kernel panic.
Add length checks for both rtl8187 and rtl8187b descriptor headers before attempting to access them, dropping the packet cleanly if the check fails.
--- .../wireless/realtek/rtl818x/rtl8187/dev.c | 27 +++++++++++++------ 1 file changed, 19 insertions(+), 8 deletions(-)
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +19 -8
@@ -338,14 +338,16 @@ static void rtl8187_rx_cb(struct urb *urb)spin_unlock_irqrestore (&priv->rx_queue.lock, f);skb_put (skb, urb->actual_length); -if (unlikely (urb->status)) { -dev_kfree_skb_irq (skb); -return ; - } +if (unlikely (urb->status)) + goto free_skb;if (!priv->is_rtl8187b) { -struct rtl8187_rx_hdr *hdr = - (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); +struct rtl8187_rx_hdr *hdr; + +if (skb->len <sizeof (struct rtl8187_rx_hdr )) + goto free_skb; + + hdr = (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); flags =le32_to_cpu (hdr->flags);/* As with the RTL8187B below, the AGC is used to calculate * signal strength. In this case, the scaling
@@ -355,8 +357,12 @@ static void rtl8187_rx_cb(struct urb *urb) rx_status.antenna = (hdr->signal >>7 ) &1 ; rx_status.mactime =le64_to_cpu (hdr->mac_time); }else { -struct rtl8187b_rx_hdr *hdr = - (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr)); +struct rtl8187b_rx_hdr *hdr; + +if (skb->len <sizeof (struct rtl8187b_rx_hdr )) + goto free_skb; + + hdr = (typeof (hdr))(skb_tail_pointer (skb) -sizeof (*hdr));/* The Realtek datasheet for the RTL8187B shows that the RX * header contains the following quantities: signal quality, * RSSI, AGC, the received power in dB, and the measured SNR.
@@ -409,6 +415,11 @@ static void rtl8187_rx_cb(struct urb *urb)skb_unlink (skb, &priv->rx_queue);dev_kfree_skb_irq (skb); } +return ; + +free_skb: +dev_kfree_skb_irq (skb); +return ; }static int rtl8187_init_urbs (struct ieee80211_hw *dev)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 357/614 RAS: Report all ARM processor CPER information to userspace
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Tian <[email protected]>
[ Upstream commit 05954511b73e748d0370549ad9dd9cd95297d97a ]
The ARM processor CPER record was added in UEFI v2.6 and remained unchanged up to v2.10.
Yet, the original arm_event trace code added by
e9279e83ad1f ("trace, ras: add ARM processor error trace event")
is incomplete, as it only traces some fields of UAPI 2.6 table N.16, not exporting any information from tables N.17 to N.29 of the record.
This is not enough for the user to be able to figure out what has exactly happened or to take appropriate action.
According to the UEFI v2.9 specification chapter N2.4.4, the ARM processor error section includes:
- several (ERR_INFO_NUM) ARM processor error information structures (Tables N.17 to N.20);
- several (CONTEXT_INFO_NUM) ARM processor context information structures (Tables N.21 to N.29);
- several vendor specific error information structures. The size is given by Section Length minus the size of the other fields.
In addition, it also exports two fields that are parsed by the GHES driver when firmware reports it, e.g.:
- error severity
- CPU logical index
Report all of these information to userspace via a the ARM tracepoint so that userspace can properly record the error and take decisions related to CPU core isolation according to error severity and other info.
The updated ARM trace event now contains the following fields:
====================================== =============================
UEFI field on table N.16 ARM Processor trace fields
====================================== =============================
Validation handled when filling data for
affinity MPIDR and running
state.
ERR_INFO_NUM pei_len
CONTEXT_INFO_NUM ctx_len
Section Length indirectly reported by
pei_len, ctx_len and oem_len
Error affinity level affinity
MPIDR_EL1 mpidr
MIDR_EL1 midr
Running State running_state
PSCI State psci_state
Processor Error Information Structure pei_err - count at pei_len
Processor Context ctx_err- count at ctx_len
Vendor Specific Error Info oem - count at oem_len
====================================== =============================It should be noted that decoding of tables N.17 to N.29, if needed, will be handled in userspace. That gives more flexibility, as there won't be any need to flood the kernel with micro-architecture specific error decoding.
Also, decoding the other fields require a complex logic, and should be done for each of the several values inside the record field. So, let userspace daemons like rasdaemon decode them, parsing such tables and having vendor-specific micro-architecture-specific decoders.
[mchehab: modified description, solved merge conflicts and fixed coding style]
--- drivers/acpi/apei/ghes.c | 11 ++++----- drivers/ras/ras.c | 40 ++++++++++++++++++++++++++++++-- include/linux/ras.h | 16 ++++++++++--- include/ras/ras_event.h | 49 ++++++++++++++++++++++++++++++++++++---- 4 files changed, 99 insertions(+), 17 deletions(-)
drivers/acpi/apei/ghes.c +4 -7
@@ -552,7 +552,7 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, }static bool ghes_handle_arm_hw_error (struct acpi_hest_generic_data *gdata, -int sev,bool sync) +int sev,bool sync) {struct cper_sec_proc_arm *err =acpi_hest_get_payload (gdata);int flags = sync ?MF_ACTION_REQUIRED :0 ;
@@ -560,9 +560,8 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,int sec_sev, i;char *p; -log_arm_hw_error (err); - sec_sev =ghes_severity (gdata->error_severity); +log_arm_hw_error (err, sec_sev);if (sev !=GHES_SEV_RECOVERABLE || sec_sev !=GHES_SEV_RECOVERABLE )return false;
@@ -895,11 +894,9 @@ static void ghes_do_proc(struct ghes *ghes,arch_apei_report_mem_error (sev, mem_err); queued =ghes_handle_memory_failure (gdata, sev, sync); - } -else if (guid_equal (sec_type, &CPER_SEC_PCIE )) { + }else if (guid_equal (sec_type, &CPER_SEC_PCIE )) {ghes_handle_aer (gdata); - } -else if (guid_equal (sec_type, &CPER_SEC_PROC_ARM )) { + }else if (guid_equal (sec_type, &CPER_SEC_PROC_ARM )) { queued =ghes_handle_arm_hw_error (gdata, sev, sync); }else if (guid_equal (sec_type, &CPER_SEC_CXL_PROT_ERR )) {struct cxl_cper_sec_prot_err *prot_err =acpi_hest_get_payload (gdata);
drivers/ras/ras.c +38 -2
@@ -53,9 +53,45 @@ void log_non_standard_event(const guid_t *sec_type, const guid_t *fru_id, }EXPORT_SYMBOL_GPL (log_non_standard_event); -void log_arm_hw_error (struct cper_sec_proc_arm *err) +void log_arm_hw_error (struct cper_sec_proc_arm *err,const u8 sev) { -trace_arm_event (err); +struct cper_arm_err_info *err_info; +struct cper_arm_ctx_info *ctx_info; +u8 *ven_err_data; +u32 ctx_len =0 ; +int n, sz, cpu; +s32 vsei_len; +u32 pei_len; +u8 *pei_err, *ctx_err; + + pei_len =sizeof (struct cper_arm_err_info ) * err->err_info_num; + pei_err = (u8 *)(err +1 ); + + err_info = (struct cper_arm_err_info *)(err +1 ); + ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); + ctx_err = (u8 *)ctx_info; + +for (n =0 ; n < err->context_info_num; n++) { + sz =sizeof (struct cper_arm_ctx_info ) + ctx_info->size; + ctx_info = (struct cper_arm_ctx_info *)((long )ctx_info + sz); + ctx_len += sz; + } + + vsei_len = err->section_length - (sizeof (struct cper_sec_proc_arm ) + pei_len + ctx_len); +if (vsei_len <0 ) { +pr_warn (FW_BUG "section length: %d\n" , err->section_length); +pr_warn (FW_BUG "section length is too small\n" ); +pr_warn (FW_BUG "firmware-generated error record is incorrect\n" ); + vsei_len =0 ; + } + ven_err_data = (u8 *)ctx_info; + + cpu =GET_LOGICAL_INDEX (err->mpidr); +if (cpu <0 ) + cpu =-1 ; + +trace_arm_event (err, pei_err, pei_len, ctx_err, ctx_len, + ven_err_data, (u32 )vsei_len, sev, cpu); }static int __init ras_init (void )
include/linux/ras.h +13 -3
@@ -24,8 +24,7 @@ int __init parse_cec_param(char *str);void log_non_standard_event (const guid_t *sec_type,const guid_t *fru_id,const char *fru_text,const u8 sev,const u8 *err,const u32 len); -void log_arm_hw_error (struct cper_sec_proc_arm *err); - +void log_arm_hw_error (struct cper_sec_proc_arm *err,const u8 sev);#else static inline void log_non_standard_event(const guid_t *sec_type,
@@ -33,7 +32,7 @@ log_non_standard_event(const guid_t *sec_type, const u8 sev, const u8 *err, const u32 len) { return; }static inline void -log_arm_hw_error (struct cper_sec_proc_arm *err) {return ; } +log_arm_hw_error (struct cper_sec_proc_arm *err,const u8 sev) {return ; }#endif struct atl_err {
@@ -53,4 +52,15 @@ static inline unsigned long amd_convert_umc_mca_addr_to_sys_addr(struct atl_err *err) { return -EINVAL; }#endif /* CONFIG_AMD_ATL */ +#if defined(CONFIG_ARM ) || defined(CONFIG_ARM64 ) +#include <asm/smp_plat.h> +/* +* Include ARM-specific SMP header which provides a function mapping mpidr to +* CPU logical index. +*/ +#define GET_LOGICAL_INDEX (mpidr) get_logical_index(mpidr & MPIDR_HWID_BITMASK) +#else +#define GET_LOGICAL_INDEX (mpidr) -EINVAL +#endif /* CONFIG_ARM || CONFIG_ARM64 */ +#endif /* __RAS_H__ */
include/ras/ras_event.h +44 -5
73 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 358/614 rtla/tests: Extend action tests to 5s
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit d649e9f04cb0224817dac8190461ef1674e32b37 ]
In non-BPF mode, it takes up to 1 second for RTLA to notice that tracing has been stopped. That means that action tests cannot have a 1 second duration, as the SIGALRM will be racing with the threshold overflow.
Previously, non-BPF mode actions were buggy and always executed the action, even when stopping on duration or SIGINT, preventing this issue from manifesting. Now that this has been fixed, the tests have become flaky, and this has to be adjusted.
--- tools/tracing/rtla/tests/osnoise.t | 4 ++-- tools/tracing/rtla/tests/timerlat.t | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
tools/tracing/rtla/tests/osnoise.t +2 -2
@@ -39,9 +39,9 @@ check "hist stop at failed action" \ check "top stop at failed action" \ "timerlat top -T 2 --on-threshold shell,command='echo -n abc; false' --on-threshold shell,command='echo -n defgh'" 2 "^abc" "defgh" check "hist with continue" \ - "osnoise hist -S 2 -d 1s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" + "osnoise hist -S 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" check "top with continue" \ - "osnoise top -q -S 2 -d 1s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" + "osnoise top -q -S 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" check "hist with trace output at end" \ "osnoise hist -d 1s --on-end trace" 0 "^ Saving trace to osnoise_trace.txt$" check "top with trace output at end" \
tools/tracing/rtla/tests/timerlat.t +2 -2
@@ -60,9 +60,9 @@ check "hist stop at failed action" \ check "top stop at failed action" \ "timerlat top -T 2 --on-threshold shell,command='echo -n 1; false' --on-threshold shell,command='echo -n 2'" 2 "^1ALL" check "hist with continue" \ - "timerlat hist -T 2 -d 1s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" + "timerlat hist -T 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" check "top with continue" \ - "timerlat top -q -T 2 -d 1s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" + "timerlat top -q -T 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" check "hist with trace output at end" \ "timerlat hist -d 1s --on-end trace" 0 "^ Saving trace to timerlat_trace.txt$" check "top with trace output at end" \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 359/614 rtla/tests: Fix osnoise test calling timerlat
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit 34c170ae5c3036ef879567a37409a2859e327342 ]
osnoise test "top stop at failed action" is calling timerlat instead of osnoise by mistake.
Fix it so that it calls the correct RTLA subcommand.
--- tools/tracing/rtla/tests/osnoise.t | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/tracing/rtla/tests/osnoise.t +1 -1
@@ -37,7 +37,7 @@ check "multiple actions" \ check "hist stop at failed action" \ "osnoise hist -S 2 --on-threshold shell,command='echo -n 1; false' --on-threshold shell,command='echo -n 2'" 2 "^1# RTLA osnoise histogram$" check "top stop at failed action" \ - "timerlat top -T 2 --on-threshold shell,command='echo -n abc; false' --on-threshold shell,command='echo -n defgh'" 2 "^abc" "defgh" + "osnoise top -S 2 --on-threshold shell,command='echo -n abc; false' --on-threshold shell,command='echo -n defgh'" 2 "^abc" "defgh" check "hist with continue" \ "osnoise hist -S 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$" check "top with continue" \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 360/614 rtla: Fix -a overriding -t argument
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Pravdin <[email protected]>
[ Upstream commit ddb6e42494e5c48c17e64f29b7674b9add486a19 ]
When running rtla as
rtla <timerlat|osnoise> <top|hist> -t custom_file.txt -a 100
-a options override trace output filename specified by -t option. Running the command above will create <timerlat|osnoise>_trace.txt file instead of custom_file.txt. Fix this by making sure that -a option does not override trace output filename even if it's passed after trace output filename is specified.
--- tools/tracing/rtla/src/osnoise_hist.c | 3 ++- tools/tracing/rtla/src/osnoise_top.c | 3 ++- tools/tracing/rtla/src/timerlat_hist.c | 3 ++- tools/tracing/rtla/src/timerlat_top.c | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-)
tools/tracing/rtla/src/osnoise_hist.c +2 -1
@@ -557,7 +557,8 @@ static struct common_params params->threshold =1 ;/* set trace */ - trace_output ="osnoise_trace.txt" ; +if (!trace_output) + trace_output ="osnoise_trace.txt" ;break ;case 'b' :
tools/tracing/rtla/src/osnoise_top.c +2 -1
@@ -397,7 +397,8 @@ struct common_params *osnoise_top_parse_args(int argc, char **argv) params->threshold =1 ;/* set trace */ - trace_output ="osnoise_trace.txt" ; +if (!trace_output) + trace_output ="osnoise_trace.txt" ;break ;case 'c' :
tools/tracing/rtla/src/timerlat_hist.c +2 -1
@@ -878,7 +878,8 @@ static struct common_params params->print_stack = auto_thresh;/* set trace */ - trace_output ="timerlat_trace.txt" ; +if (!trace_output) + trace_output ="timerlat_trace.txt" ;break ;case 'c' :
tools/tracing/rtla/src/timerlat_top.c +2 -1
@@ -628,7 +628,8 @@ static struct common_params params->print_stack = auto_thresh;/* set trace */ - trace_output ="timerlat_trace.txt" ; +if (!trace_output) + trace_output ="timerlat_trace.txt" ;break ;case '5' :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 361/614 ima: Handle error code returned by ima_filter_rule_match()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Yipeng <[email protected]>
[ Upstream commit 738c9738e690f5cea24a3ad6fd2d9a323cf614f6 ]
In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if (!rc)' check and sets 'result = true'. The LSM rule is considered a match, causing extra files to be measured by IMA.
This issue can be reproduced in the following scenario:
After unloading the SELinux policy module via 'semodule -d', if an IMA measurement is triggered before ima_lsm_rules is updated,
in ima_match_rules(), the first call to ima_filter_rule_match() returns -ESTALE. This causes the code to enter the 'if (rc == -ESTALE && !rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In ima_lsm_copy_rule(), since the SELinux module has been removed, the rule becomes NULL, and the second call to ima_filter_rule_match() returns -ENOENT. This bypasses the 'if (!rc)' check and results in a false match.
Call trace: selinux_audit_rule_match+0x310/0x3b8 security_audit_rule_match+0x60/0xa0 ima_match_rules+0x2e4/0x4a0 ima_match_policy+0x9c/0x1e8 ima_get_action+0x48/0x60 process_measurement+0xf8/0xa98 ima_bprm_check+0x98/0xd8 security_bprm_check+0x5c/0x78 search_binary_handler+0x6c/0x318 exec_binprm+0x58/0x1b8 bprm_execve+0xb8/0x130 do_execveat_common.isra.0+0x1a8/0x258 __arm64_sys_execve+0x48/0x68 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x200 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0
Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error codes like -ENOENT do not bypass the check and accidentally result in a successful match.
--- security/integrity/ima/ima_policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/ima/ima_policy.c +1 -1
@@ -674,7 +674,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, goto retry; } } -if (!rc) { +if (rc <=0 ) { result = false; goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 362/614 usb: chaoskey: fix locking for O_NONBLOCK
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit a2fa8a12e6bc9d89c0505b8dd7ae38ec173d25de ]
A failure to take a lock with O_NONBLOCK needs to result in -EAGAIN. Change it.
--- drivers/usb/misc/chaoskey.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/usb/misc/chaoskey.c +13 -3
@@ -444,9 +444,19 @@ static ssize_t chaoskey_read(struct file *file, goto bail;mutex_unlock (&dev->rng_lock); - result =mutex_lock_interruptible (&dev->lock); -if (result) - goto bail; +if (file->f_flags &O_NONBLOCK ) { + result =mutex_trylock (&dev->lock); +if (result ==0 ) { + result = -EAGAIN ; + goto bail; + }else { + result =0 ; + } + }else { + result =mutex_lock_interruptible (&dev->lock); +if (result) + goto bail; + }if (dev->valid == dev->used) { result =_chaoskey_fill (dev);if (result <0 ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 363/614 usb: dwc2: fix hang during shutdown if set as peripheral
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit b6ebcfdcac40a27953f052e4269ce75a18825ffc ]
dwc2 on most platforms needs phy controller, clock and power supply. All of them must be enabled/activated to properly operate. If dwc2 is configured as peripheral mode, then all the above three hardware resources are disabled at the end of the probe:
/* Gadget code manages lowlevel hw on its own */ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) dwc2_lowlevel_hw_disable(hsotg);
But dwc2_driver_shutdown() tries to disable the interrupts on HW IP level. This would result in hang during shutdown if dwc2 is configured as peripheral mode.
Fix this hang by only disable and sync irq when lowlevel hw is enabled.
--- drivers/usb/dwc2/platform.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/dwc2/platform.c +4 -4
@@ -369,11 +369,11 @@ static void dwc2_driver_shutdown(struct platform_device *dev) {struct dwc2_hsotg *hsotg =platform_get_drvdata (dev); -dwc2_disable_global_interrupts (hsotg); -synchronize_irq (hsotg->irq); - -if (hsotg->ll_hw_enabled) +if (hsotg->ll_hw_enabled) { +dwc2_disable_global_interrupts (hsotg); +synchronize_irq (hsotg->irq);dwc2_lowlevel_hw_disable (hsotg); + } }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 364/614 usb: dwc2: fix hang during suspend if set as peripheral
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit 2b94b054ac4974ad2f89f7f7461840c851933adb ]
dwc2 on most platforms needs phy controller, clock and power supply. All of them must be enabled/activated to properly operate. If dwc2 is configured as peripheral mode, then all the above three hardware resources are disabled at the end of the probe:
/* Gadget code manages lowlevel hw on its own */ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) dwc2_lowlevel_hw_disable(hsotg);
But the dwc2_suspend() tries to read the dwc2's reg to check whether is_device_mode or not, this would result in hang during suspend if dwc2 is configured as peripheral mode.
Fix this hang by bypassing suspend/resume if lowlevel hw isn't enabled.
--- drivers/usb/dwc2/platform.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/dwc2/platform.c +8 -1
@@ -649,9 +649,13 @@ static int dwc2_driver_probe(struct platform_device *dev)static int __maybe_unused dwc2_suspend (struct device *dev) {struct dwc2_hsotg *dwc2 =dev_get_drvdata (dev); -bool is_device_mode =dwc2_is_device_mode (dwc2); +bool is_device_mode;int ret =0 ; +if (!dwc2->ll_hw_enabled) +return 0 ; + + is_device_mode =dwc2_is_device_mode (dwc2);if (is_device_mode)dwc2_hsotg_suspend (dwc2);
@@ -728,6 +732,9 @@ static int __maybe_unused dwc2_resume(struct device *dev)struct dwc2_hsotg *dwc2 =dev_get_drvdata (dev);int ret =0 ; +if (!dwc2->ll_hw_enabled) +return 0 ; +if (dwc2->phy_off_for_suspend && dwc2->ll_hw_enabled) { ret =__dwc2_lowlevel_hw_enable (dwc2);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 365/614 usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gopi Krishna Menon <[email protected]>
[ Upstream commit a5160af78be7fcf3ade6caab0a14e349560c96d7 ]
The previous commit removed the PAGE_SIZE limit on transfer length of raw_io buffer in order to avoid any problems with emulating USB devices whose full configuration descriptor exceeds PAGE_SIZE in length. However this also removes the upperbound on user supplied length, allowing very large values to be passed to the allocator.
syzbot on fuzzing the transfer length with very large value (1.81GB) results in kmalloc() to fall back to the page allocator, which triggers a kernel warning as the page allocator cannot handle allocations more than MAX_PAGE_ORDER/KMALLOC_MAX_SIZE.
Since there is no limit imposed on the size of buffer for both control and non control transfers, cap the raw_io transfer length to KMALLOC_MAX_SIZE and return -EINVAL for larger transfer length to prevent any warnings from the page allocator.
--- drivers/usb/gadget/legacy/raw_gadget.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/legacy/raw_gadget.c +3 -0
@@ -40,6 +40,7 @@ MODULE_LICENSE("GPL");static DEFINE_IDA (driver_id_numbers);#define DRIVER_DRIVER_NAME_LENGTH_MAX 32 +#define USB_RAW_IO_LENGTH_MAX KMALLOC_MAX_SIZE#define RAW_EVENT_QUEUE_SIZE 16
@@ -667,6 +668,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,return ERR_PTR (-EINVAL );if (!usb_raw_io_flags_valid (io->flags))return ERR_PTR (-EINVAL ); +if (io->length >USB_RAW_IO_LENGTH_MAX ) +return ERR_PTR (-EINVAL );if (get_from_user) data =memdup_user (ptr +sizeof (*io), io->length);else {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 366/614 regulator: pca9450: Fix error code in probe()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 670500b41e543c5cb09eb9f7f0e4e26c5b5fdf7e ]
Return "PTR_ERR(pca9450->sd_vsel_gpio)" instead of "ret". The "ret" variable is success at this point.
--- drivers/regulator/pca9450-regulator.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/regulator/pca9450-regulator.c +3 -4
@@ -1251,10 +1251,9 @@ static int pca9450_i2c_probe(struct i2c_client *i2c)* to this signal (if SION bit is set in IOMUX). */ pca9450->sd_vsel_gpio =gpiod_get_optional (&ldo5->dev,"sd-vsel" ,GPIOD_IN ); -if (IS_ERR (pca9450->sd_vsel_gpio)) { -dev_err (&i2c->dev,"Failed to get SD_VSEL GPIO\n" ); -return ret; - } +if (IS_ERR (pca9450->sd_vsel_gpio)) +return dev_err_probe (&i2c->dev,PTR_ERR (pca9450->sd_vsel_gpio), +"Failed to get SD_VSEL GPIO\n" ); pca9450->sd_vsel_fixed_low =of_property_read_bool (ldo5->dev.of_node,"nxp,sd-vsel-fixed-low" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 367/614 selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <[email protected]>
[ Upstream commit 27746aaf1b20172f0859546c4a3e82eca459f680 ]
Gracefully skip the test_perf_branches_hw subtest on platforms that do not support LBR or require specialized perf event attributes to enable branch sampling.
For example, AMD's Milan (Zen 3) supports BRS rather than traditional LBR. This requires specific configurations (attr.type = PERF_TYPE_RAW, attr.config = RETIRED_TAKEN_BRANCH_INSTRUCTIONS) that differ from the generic setup used within this test. Notably, it also probably doesn't hold much value to special case perf event configurations for selected micro architectures.
--- tools/testing/selftests/bpf/prog_tests/perf_branches.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/bpf/prog_tests/perf_branches.c +3 -3
@@ -116,11 +116,11 @@ static void test_perf_branches_hw(void) pfd =syscall (__NR_perf_event_open, &attr,-1 ,0 ,-1 ,PERF_FLAG_FD_CLOEXEC );/* -* Some setups don't support branch records (virtual machines, !x86), -* so skip test in this case. +* Some setups don't support LBR (virtual machines, !x86, AMD Milan Zen +* 3 which only supports BRS), so skip test in this case. */ if (pfd <0 ) { -if (errno ==ENOENT || errno ==EOPNOTSUPP ) { +if (errno ==ENOENT || errno ==EOPNOTSUPP || errno ==EINVAL ) {printf ("%s:SKIP:no PERF_SAMPLE_BRANCH_STACK\n" , __func__);test__skip ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 368/614 selftests/bpf: Improve reliability of test_perf_branches_no_hw()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <[email protected]>
[ Upstream commit ae24fc8a16b0481ea8c5acbc66453c49ec0431c4 ]
Currently, test_perf_branches_no_hw() relies on the busy loop within test_perf_branches_common() being slow enough to allow at least one perf event sample tick to occur before starting to tear down the backing perf event BPF program. With a relatively small fixed iteration count of 1,000,000, this is not guaranteed on modern fast CPUs, resulting in the test run to subsequently fail with the following:
bpf_testmod.ko is already unloaded.
Loading bpf_testmod.ko...
Successfully loaded bpf_testmod.ko. test_perf_branches_common:PASS:test_perf_branches_load 0 nsec test_perf_branches_common:PASS:attach_perf_event 0 nsec test_perf_branches_common:PASS:set_affinity 0 nsec check_good_sample:PASS:output not valid 0 nsec check_good_sample:PASS:read_branches_size 0 nsec check_good_sample:PASS:read_branches_stack 0 nsec check_good_sample:PASS:read_branches_stack 0 nsec check_good_sample:PASS:read_branches_global 0 nsec check_good_sample:PASS:read_branches_global 0 nsec check_good_sample:PASS:read_branches_size 0 nsec test_perf_branches_no_hw:PASS:perf_event_open 0 nsec test_perf_branches_common:PASS:test_perf_branches_load 0 nsec test_perf_branches_common:PASS:attach_perf_event 0 nsec test_perf_branches_common:PASS:set_affinity 0 nsec check_bad_sample:FAIL:output not valid no valid sample from prog
Summary: 0/1 PASSED, 0 SKIPPED, 1 FAILED
Successfully unloaded bpf_testmod.ko.
On a modern CPU (i.e. one with a 3.5 GHz clock rate), executing 1 million increments of a volatile integer can take significantly less than 1 millisecond. If the spin loop and detachment of the perf event BPF program elapses before the first 1 ms sampling interval elapses, the perf event will never end up firing. Fix this by bumping the loop iteration counter a little within test_perf_branches_common(), along with ensuring adding another loop termination condition which is directly influenced by the backing perf event BPF program executing. Notably, a concious decision was made to not adjust the sample_freq value as that is just not a reliable way to go about fixing the problem. It effectively still leaves the race window open.
--- .../selftests/bpf/prog_tests/perf_branches.c | 16 ++++++++++++++-- .../selftests/bpf/progs/test_perf_branches.c | 3 +++ 2 files changed, 17 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/prog_tests/perf_branches.c +14 -2
@@ -15,6 +15,10 @@ static void check_good_sample(struct test_perf_branches *skel)int pbe_size =sizeof (struct perf_branch_entry );int duration =0 ; +if (CHECK (!skel->bss->run_cnt,"invalid run_cnt" , +"checked sample validity before prog run" )) +return ; +if (CHECK (!skel->bss->valid,"output not valid" ,"no valid sample from prog" ))return ;
@@ -45,6 +49,10 @@ static void check_bad_sample(struct test_perf_branches *skel)int written_stack = skel->bss->written_stack_out;int duration =0 ; +if (CHECK (!skel->bss->run_cnt,"invalid run_cnt" , +"checked sample validity before prog run" )) +return ; +if (CHECK (!skel->bss->valid,"output not valid" ,"no valid sample from prog" ))return ;
@@ -83,8 +91,12 @@ static void test_perf_branches_common(int perf_fd, err =pthread_setaffinity_np (pthread_self (),sizeof (cpu_set), &cpu_set);if (CHECK (err,"set_affinity" ,"cpu #0, err %d\n" , err)) goto out_destroy; -/* spin the loop for a while (random high number) */ -for (i =0 ; i <1000000 ; ++i) + +/* Spin the loop for a while by using a high iteration count, and by +* checking whether the specific run count marker has been explicitly +* incremented at least once by the backing perf_event BPF program. +*/ +for (i =0 ; i <100000000 && !*(volatile int *)&skel->bss->run_cnt; ++i) ++j;test_perf_branches__detach (skel);
tools/testing/selftests/bpf/progs/test_perf_branches.c +3 -0
@@ -8,6 +8,7 @@#include <bpf/bpf_tracing.h> int valid =0 ; +int run_cnt =0 ;int required_size_out =0 ;int written_stack_out =0 ;int written_global_out =0 ;
@@ -24,6 +25,8 @@ int perf_branches(void *ctx)__u64 entries[4 *3 ] = {0 };int required_size, written_stack, written_global; + ++run_cnt; +/* write to stack */ written_stack =bpf_read_branch_records (ctx, entries,sizeof (entries),0 );/* ignore spurious events */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 369/614 selftests/bpf: Update test_tag to use sha256
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xing Guo <[email protected]>
[ Upstream commit b7f7d76d6e354a5acc711da37cb2829ccf40558f ]
commit 603b44162325 ("bpf: Update the bpf_prog_calc_tag to use SHA256") changed digest of prog_tag to SHA256 but forgot to update tests correspondingly. Fix it.
--- tools/testing/selftests/bpf/test_tag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_tag.c +1 -1
@@ -116,7 +116,7 @@ static void tag_from_alg(int insns, uint8_t *tag, uint32_t len)static const struct sockaddr_alg alg = { .salg_family =AF_ALG , .salg_type ="hash" , - .salg_name ="sha1" , + .salg_name ="sha256" , };int fd_base, fd_alg, ret;ssize_t size;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 370/614 bpf: properly verify tail call behavior
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Teichmann <[email protected]>
[ Upstream commit e3245f8990431950d20631c72236d4e8cb2dcde8 ]
A successful ebpf tail call does not return to the caller, but to the caller-of-the-caller, often just finishing the ebpf program altogether.
Any restrictions that the verifier needs to take into account - notably the fact that the tail call might have modified packet pointers - are to be checked on the caller-of-the-caller. Checking it on the caller made the verifier refuse perfectly fine programs that would use the packet pointers after a tail call, which is no problem as this code is only executed if the tail call was unsuccessful, i.e. nothing happened.
This patch simulates the behavior of a tail call in the verifier. A conditional jump to the code after the tail call is added for the case of an unsucessful tail call, and a return to the caller is simulated for a successful tail call.
For the successful case we assume that the tail call returns an int, as tail calls are currently only allowed in functions that return and int. We always assume that the tail call modified the packet pointers, as we do not know what the tail call did.
For the unsuccessful case we know nothing happened, so we do not need to add new constraints.
This approach also allows to check other problems that may occur with tail calls, namely we are now able to check that precision is properly propagated into subprograms using tail calls, as well as checking the live slots in such a subprogram.
--- kernel/bpf/verifier.c | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-)
kernel/bpf/verifier.c +28 -3
@@ -4408,6 +4408,11 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, bt_reg_mask(bt));return -EFAULT ; } +if (insn->src_reg ==BPF_REG_0 && insn->imm == BPF_FUNC_tail_call + && subseq_idx - idx !=1 ) { +if (bt_subprog_enter (bt)) +return -EFAULT ; + } }else if (opcode ==BPF_EXIT ) {bool r0_precise;
@@ -10995,6 +11000,10 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)bool in_callback_fn;int err; + err =bpf_update_live_stack (env); +if (err) +return err; + callee = state->frame[state->curframe]; r0 = &callee->regs[BPF_REG_0 ];if (r0->type ==PTR_TO_STACK ) {
@@ -11912,6 +11921,25 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn env->prog->call_get_func_ip = true; } +if (func_id == BPF_FUNC_tail_call) { +if (env->cur_state->curframe) { +struct bpf_verifier_state *branch; + +mark_reg_scratched (env,BPF_REG_0 ); + branch =push_stack (env, env->insn_idx +1 , env->insn_idx, false); +if (IS_ERR (branch)) +return PTR_ERR (branch); +clear_all_pkt_pointers (env); +mark_reg_unknown (env, regs,BPF_REG_0 ); + err =prepare_func_exit (env, &env->insn_idx); +if (err) +return err; + env->insn_idx--; + }else { + changes_data = false; + } + } +if (changes_data)clear_all_pkt_pointers (env);return 0 ;
@@ -19810,9 +19838,6 @@ static int process_bpf_exit_full(struct bpf_verifier_env *env,return PROCESS_BPF_EXIT ;if (env->cur_state->curframe) { - err =bpf_update_live_stack (env); -if (err) -return err;/* exit from nested function */ err =prepare_func_exit (env, &env->insn_idx);if (err)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 371/614 crypto: starfive - Correctly handle return of sg_nents_for_len
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit e9eb52037a529fbb307c290e9951a62dd728b03d ]
The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers.
Add error checking for sg_nents_for_len and return immediately on failure to prevent potential buffer overflows.
--- drivers/crypto/starfive/jh7110-hash.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/crypto/starfive/jh7110-hash.c +5 -1
@@ -325,6 +325,7 @@ static int starfive_hash_digest(struct ahash_request *req)struct starfive_cryp_ctx *ctx =crypto_ahash_ctx (tfm);struct starfive_cryp_request_ctx *rctx =ahash_request_ctx (req);struct starfive_cryp_dev *cryp = ctx->cryp; +int sg_len;memset (rctx,0 ,sizeof (struct starfive_cryp_request_ctx ));
@@ -333,7 +334,10 @@ static int starfive_hash_digest(struct ahash_request *req) rctx->in_sg = req->src; rctx->blksize =crypto_tfm_alg_blocksize (crypto_ahash_tfm (tfm)); rctx->digsize =crypto_ahash_digestsize (tfm); - rctx->in_sg_len =sg_nents_for_len (rctx->in_sg, rctx->total); + sg_len =sg_nents_for_len (rctx->in_sg, rctx->total); +if (sg_len <0 ) +return sg_len; + rctx->in_sg_len = sg_len; ctx->rctx = rctx;return crypto_transfer_hash_request_to_engine (cryp->engine, req);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 372/614 crypto: ccree - Correctly handle return of sg_nents_for_len
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 8700ce07c5c6bf27afa7b59a8d9cf58d783a7d5c ]
Fix error handling in cc_map_hash_request_update where sg_nents_for_len return value was assigned to u32, converting negative errors to large positive values before passing to sg_copy_to_buffer.
Check sg_nents_for_len return value and propagate errors before assigning to areq_ctx->in_nents.
--- drivers/crypto/ccree/cc_buffer_mgr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/crypto/ccree/cc_buffer_mgr.c +5 -1
@@ -1235,6 +1235,7 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,int rc =0 ;u32 dummy =0 ;u32 mapped_nents =0 ; +int sg_nents;dev_dbg (dev," update params : curr_buff=%p curr_buff_cnt=0x%X nbytes=0x%X src=%p curr_index=%u\n" , curr_buff, *curr_buff_cnt, nbytes, src, areq_ctx->buff_index);
@@ -1248,7 +1249,10 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,if (total_in_len < block_size) {dev_dbg (dev," less than one block: curr_buff=%p *curr_buff_cnt=0x%X copy_to=%p\n" , curr_buff, *curr_buff_cnt, &curr_buff[*curr_buff_cnt]); - areq_ctx->in_nents =sg_nents_for_len (src, nbytes); + sg_nents =sg_nents_for_len (src, nbytes); +if (sg_nents <0 ) +return sg_nents; + areq_ctx->in_nents = sg_nents;sg_copy_to_buffer (src, areq_ctx->in_nents, &curr_buff[*curr_buff_cnt], nbytes); *curr_buff_cnt += nbytes;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 373/614 PM / devfreq: hisi: Fix potential UAF in OPP handling
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengjie Zhang <[email protected]>
[ Upstream commit 26dd44a40096468396b6438985d8e44e0743f64c ]
Ensure all required data is acquired before calling dev_pm_opp_put(opp) to maintain correct resource acquisition and release order.
--- drivers/devfreq/hisi_uncore_freq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/devfreq/hisi_uncore_freq.c +2 -1
@@ -265,10 +265,11 @@ static int hisi_uncore_target(struct device *dev, unsigned long *freq,dev_err (dev,"Failed to get opp for freq %lu hz\n" , *freq);return PTR_ERR (opp); } -dev_pm_opp_put (opp); data = (u32)(dev_pm_opp_get_freq (opp) /HZ_PER_MHZ ); +dev_pm_opp_put (opp); +return hisi_uncore_cmd_send (uncore,HUCF_PCC_CMD_SET_FREQ , &data); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 374/614 RISC-V: KVM: Fix guest page fault within HLV* instructions
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangyu Yu <[email protected]>
[ Upstream commit 974555d6e417974e63444266e495a06d06c23af5 ]
When executing HLV* instructions at the HS mode, a guest page fault may occur when a g-stage page table migration between triggering the virtual instruction exception and executing the HLV* instruction.
This may be a corner case, and one simpler way to handle this is to re-execute the instruction where the virtual instruction exception occurred, and the guest page fault will be automatically handled.
--- arch/riscv/kvm/vcpu_insn.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
arch/riscv/kvm/vcpu_insn.c +22 -0
@@ -298,6 +298,22 @@ static int system_opcode_insn(struct kvm_vcpu *vcpu, struct kvm_run *run,return (rc <=0 ) ? rc :1 ; } +static bool is_load_guest_page_fault (unsigned long scause) +{ +/** +* If a g-stage page fault occurs, the direct approach +* is to let the g-stage page fault handler handle it +* naturally, however, calling the g-stage page fault +* handler here seems rather strange. +* Considering this is a corner case, we can directly +* return to the guest and re-execute the same PC, this +* will trigger a g-stage page fault again and then the +* regular g-stage page fault handler will populate +* g-stage page table. +*/ +return (scause ==EXC_LOAD_GUEST_PAGE_FAULT ); +} +/** * kvm_riscv_vcpu_virtual_insn -- Handle virtual instruction trap *
@@ -323,6 +339,8 @@ int kvm_riscv_vcpu_virtual_insn(struct kvm_vcpu *vcpu, struct kvm_run *run, ct->sepc, &utrap);if (utrap.scause) { +if (is_load_guest_page_fault (utrap.scause)) +return 1 ; utrap.sepc = ct->sepc;kvm_riscv_vcpu_trap_redirect (vcpu, &utrap);return 1 ;
@@ -378,6 +396,8 @@ int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run, insn =kvm_riscv_vcpu_unpriv_read (vcpu, true, ct->sepc, &utrap);if (utrap.scause) { +if (is_load_guest_page_fault (utrap.scause)) +return 1 ;/* Redirect trap if we failed to read instruction */ utrap.sepc = ct->sepc;kvm_riscv_vcpu_trap_redirect (vcpu, &utrap);
@@ -504,6 +524,8 @@ int kvm_riscv_vcpu_mmio_store(struct kvm_vcpu *vcpu, struct kvm_run *run, insn =kvm_riscv_vcpu_unpriv_read (vcpu, true, ct->sepc, &utrap);if (utrap.scause) { +if (is_load_guest_page_fault (utrap.scause)) +return 1 ;/* Redirect trap if we failed to read instruction */ utrap.sepc = ct->sepc;kvm_riscv_vcpu_trap_redirect (vcpu, &utrap);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 375/614 erofs: correct FSDAX detection
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit ebe4f3f6eb0c10f87c58e52a8912694c14fdeda6 ]
The detection of the primary device is skipped incorrectly if the multiple or flattened feature is enabled.
It also fixes the FSDAX misdetection for non-block extra blobs.
--- fs/erofs/super.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
fs/erofs/super.c +11 -11
@@ -174,15 +174,15 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,if (!erofs_is_fileio_mode (sbi)) { dif->dax_dev =fs_dax_get_by_bdev (file_bdev (file), &dif->dax_part_off,NULL ,NULL ); -if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { -erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , - dif->path); -clear_opt (&sbi->opt,DAX_ALWAYS ); - } }else if (!S_ISREG (file_inode (file)->i_mode)) {fput (file);return -EINVAL ; } +if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { +erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , + dif->path); +clear_opt (&sbi->opt,DAX_ALWAYS ); + } dif->file = file; }
@@ -215,13 +215,13 @@ static int erofs_scan_devices(struct super_block *sb, ondisk_extradevs, sbi->devs->extra_devices);return -EINVAL ; } -if (!ondisk_extradevs) { -if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { -erofs_info (sb,"DAX unsupported by block device. Turning off DAX." ); -clear_opt (&sbi->opt,DAX_ALWAYS ); - } -return 0 ; + +if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { +erofs_info (sb,"DAX unsupported by block device. Turning off DAX." ); +clear_opt (&sbi->opt,DAX_ALWAYS ); } +if (!ondisk_extradevs) +return 0 ;if (!sbi->devs->extra_devices && !erofs_is_fscache_mode (sb)) sbi->devs->flatdev = true;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 376/614 erofs: limit the level of fs stacking for file-backed mounts
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit d53cd891f0e4311889349fff3a784dc552f814b9 ]
Otherwise, it could cause potential kernel stack overflow (e.g., EROFS mounting itself).
--- fs/erofs/super.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/erofs/super.c +16 -0
@@ -639,6 +639,22 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc) sbi->blkszbits =PAGE_SHIFT ;if (!sb->s_bdev) { +/* +* (File-backed mounts) EROFS claims it's safe to nest other +* fs contexts (including its own) due to self-controlled RO +* accesses/contexts and no side-effect changes that need to +* context save & restore so it can reuse the current thread +* context. However, it still needs to bump `s_stack_depth` to +* avoid kernel stack overflow from nested filesystems. +*/ +if (erofs_is_fileio_mode (sbi)) { + sb->s_stack_depth = +file_inode (sbi->dif0.file)->i_sb->s_stack_depth +1 ; +if (sb->s_stack_depth >FILESYSTEM_MAX_STACK_DEPTH ) { +erofs_err (sb,"maximum fs stacking depth exceeded" ); +return -ENOTBLK ; + } + } sb->s_blocksize =PAGE_SIZE ; sb->s_blocksize_bits =PAGE_SHIFT ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 377/614 RDMA/bnxt_re: Fix the inline size for GenP7 devices
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
[ Upstream commit 6afe40ff484a1155b71158b911c65299496e35c3 ]
Inline size supported by the device is based on the number of SGEs supported by the adapter. Change the inline size calculation based on that.
--- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/bnxt_re/qplib_sp.c +1 -1
@@ -162,7 +162,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw) attr->max_srq_wqes =le32_to_cpu (sb->max_srq_wr) -1 ; attr->max_srq_sges = sb->max_srq_sge; attr->max_pkey =1 ; - attr->max_inline_data =le32_to_cpu (sb->max_inline_data); + attr->max_inline_data = attr->max_qp_sges *sizeof (struct sq_sge );if (!bnxt_qplib_is_chip_gen_p7 (rcfw->res->cctx)) attr->l2_db_size = (sb->l2_db_space_size +1 ) * (0x01 <<RCFW_DBR_BASE_PAGE_SHIFT );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 378/614 RDMA/bnxt_re: Pass correct flag for dma mr creation
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <[email protected]>
[ Upstream commit a26c4c7cdb50247b8486f1caa1ea8ab5e5c37edf ]
DMA MR doesn't use the unified MR model. So the lkey passed on to the reg_mr command to FW should contain the correct lkey. Driver is incorrectly over writing the lkey with pdid and firmware commands fails due to this.
Avoid passing the wrong key for cases where the unified MR registration is not used.
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +++++--- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 6 +++--- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 +- 3 files changed, 9 insertions(+), 7 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +5 -3
@@ -601,7 +601,8 @@ static int bnxt_re_create_fence_mr(struct bnxt_re_pd *pd) mr->qplib_mr.va = (u64 )(unsigned long )fence->va; mr->qplib_mr.total_size =BNXT_RE_FENCE_BYTES ; rc =bnxt_qplib_reg_mr (&rdev->qplib_res, &mr->qplib_mr,NULL , -BNXT_RE_FENCE_PBL_SIZE ,PAGE_SIZE ); +BNXT_RE_FENCE_PBL_SIZE ,PAGE_SIZE , +_is_alloc_mr_unified (rdev->dev_attr->dev_cap_flags));if (rc) {ibdev_err (&rdev->ibdev,"Failed to register fence-MR\n" ); goto fail;
@@ -4027,7 +4028,7 @@ struct ib_mr *bnxt_re_get_dma_mr(struct ib_pd *ib_pd, int mr_access_flags) mr->qplib_mr.hwq.level =PBL_LVL_MAX ; mr->qplib_mr.total_size =-1 ;/* Infinte length */ rc =bnxt_qplib_reg_mr (&rdev->qplib_res, &mr->qplib_mr,NULL ,0 , -PAGE_SIZE ); +PAGE_SIZE , false);if (rc) goto fail_mr;
@@ -4257,7 +4258,8 @@ static struct ib_mr *__bnxt_re_user_reg_mr(struct ib_pd *ib_pd, u64 length, u64 umem_pgs =ib_umem_num_dma_blocks (umem, page_size); rc =bnxt_qplib_reg_mr (&rdev->qplib_res, &mr->qplib_mr, umem, - umem_pgs, page_size); + umem_pgs, page_size, +_is_alloc_mr_unified (rdev->dev_attr->dev_cap_flags));if (rc) {ibdev_err (&rdev->ibdev,"Failed to register user MR - rc = %d\n" , rc); rc = -EIO ;
drivers/infiniband/hw/bnxt_re/qplib_sp.c +3 -3
@@ -578,7 +578,7 @@ int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw, }int bnxt_qplib_reg_mr (struct bnxt_qplib_res *res,struct bnxt_qplib_mrw *mr, -struct ib_umem *umem,int num_pbls,u32 buf_pg_size) +struct ib_umem *umem,int num_pbls,u32 buf_pg_size,bool unified_mr) {struct bnxt_qplib_rcfw *rcfw = res->rcfw;struct bnxt_qplib_hwq_attr hwq_attr = {};
@@ -640,7 +640,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr, req.access = (mr->access_flags &BNXT_QPLIB_MR_ACCESS_MASK ); req.va =cpu_to_le64 (mr->va); req.key =cpu_to_le32 (mr->lkey); -if (_is_alloc_mr_unified (res->dattr->dev_cap_flags)) +if (unified_mr) req.key =cpu_to_le32 (mr->pd->id); req.flags =cpu_to_le16 (mr->flags); req.mr_size =cpu_to_le64 (mr->total_size);
@@ -651,7 +651,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,if (rc) goto fail; -if (_is_alloc_mr_unified (res->dattr->dev_cap_flags)) { +if (unified_mr) { mr->lkey =le32_to_cpu (resp.xid); mr->rkey = mr->lkey; }
drivers/infiniband/hw/bnxt_re/qplib_sp.h +1 -1
@@ -341,7 +341,7 @@ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res,int bnxt_qplib_dereg_mrw (struct bnxt_qplib_res *res,struct bnxt_qplib_mrw *mrw,bool block);int bnxt_qplib_reg_mr (struct bnxt_qplib_res *res,struct bnxt_qplib_mrw *mr, -struct ib_umem *umem,int num_pbls,u32 buf_pg_size); +struct ib_umem *umem,int num_pbls,u32 buf_pg_size,bool unified_mr);int bnxt_qplib_free_mrw (struct bnxt_qplib_res *res,struct bnxt_qplib_mrw *mr);int bnxt_qplib_alloc_fast_reg_mr (struct bnxt_qplib_res *res,struct bnxt_qplib_mrw *mr,int max);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 379/614 crypto: ahash - Fix crypto_ahash_import with partial block data
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit b0356b75f42fde15d4be268c5891f2cee6eb65bf ]
Restore the partial block buffer in crypto_ahash_import by copying it. Check whether the partial block buffer exceeds the maximum size and return -EOVERFLOW if it does.
Zero the partial block buffer in crypto_ahash_import_core.
--- crypto/ahash.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
crypto/ahash.c +11 -1
@@ -661,6 +661,12 @@ int crypto_ahash_import_core(struct ahash_request *req, const void *in) in);if (crypto_ahash_get_flags (tfm) &CRYPTO_TFM_NEED_KEY )return -ENOKEY ; +if (crypto_ahash_block_only (tfm)) { +unsigned int reqsize =crypto_ahash_reqsize (tfm); +u8 *buf =ahash_request_ctx (req); + + buf[reqsize -1 ] =0 ; + }return crypto_ahash_alg (tfm)->import_core (req, in); }EXPORT_SYMBOL_GPL (crypto_ahash_import_core);
@@ -674,10 +680,14 @@ int crypto_ahash_import(struct ahash_request *req, const void *in)if (crypto_ahash_get_flags (tfm) &CRYPTO_TFM_NEED_KEY )return -ENOKEY ;if (crypto_ahash_block_only (tfm)) { +unsigned int plen =crypto_ahash_blocksize (tfm) +1 ;unsigned int reqsize =crypto_ahash_reqsize (tfm); +unsigned int ss =crypto_ahash_statesize (tfm);u8 *buf =ahash_request_ctx (req); - buf[reqsize -1 ] =0 ; +memcpy (buf + reqsize - plen, in + ss - plen, plen); +if (buf[reqsize -1 ] >= plen) +return -EOVERFLOW ; }return crypto_ahash_alg (tfm)->import (req, in); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 380/614 crypto: ahash - Zero positive err value in ahash_update_finish
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit ebbdf6466b30e3b37f3b360826efd21f0633fb9e ]
The partial block length returned by a block-only driver should not be passed up to the caller since ahash itself deals with the partial block data.
Set err to zero in ahash_update_finish if it was positive.
--- crypto/ahash.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
crypto/ahash.c +5 -1
@@ -423,7 +423,11 @@ static int ahash_update_finish(struct ahash_request *req, int err) req->nbytes += nonzero - blen; - blen = err <0 ?0 : err + nonzero; + blen =0 ; +if (err >=0 ) { + blen = err + nonzero; + err =0 ; + }if (ahash_request_isvirt (req))memcpy (buf, req->svirt + req->nbytes - blen, blen);else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 381/614 ASoC: tas2781: Correct the wrong chip ID for reset variable check
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baojun Xu <[email protected]>
[ Upstream commit 34b78ddd78428e66a7f08f71763258723eae2306 ]
The new variable of reset was added for TAS58XX on TAS5825 first. And TAS5802/5815... was added later, so this reset variable check should be changed to lowest chip of TAS58XX.
--- sound/soc/codecs/tas2781-comlib-i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2781-comlib-i2c.c +1 -1
@@ -320,7 +320,7 @@ void tasdevice_reset(struct tasdevice_priv *tas_dev)for (i =0 ; i < tas_dev->ndev; i++) { ret =tasdevice_dev_write (tas_dev, i,TASDEVICE_REG_SWRESET , - tas_dev->chip_id >=TAS5825 ? + tas_dev->chip_id >=TAS5802 ?TAS5825_REG_SWRESET_RESET :TASDEVICE_REG_SWRESET_RESET );if (ret <0 )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 382/614 ASoC: tas2781: correct the wrong period
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
[ Upstream commit 950167a99dfd27eeaf177092908c598a31c79a7e ]
A wrong preiod at the end of the sentence was reported by one of my customers. Their thorough code review is greatly appreciated.
--- sound/soc/codecs/tas2781-i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2781-i2c.c +1 -1
@@ -1391,7 +1391,7 @@ static int tasdevice_create_cali_ctrls(struct tasdevice_priv *priv)/* * Alloc kcontrol via devm_kzalloc(), which don't manually -* free the kcontrol。 +* free the kcontrol. */ cali_ctrls =devm_kcalloc (priv->dev, nctrls,sizeof (cali_ctrls[0 ]),GFP_KERNEL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 383/614 wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 79277f8ad15ec5f255ed0e1427c7a8a3e94e7f52 ]
If a link does not have an assigned channel yet, mt7996_vif_link returns NULL. We still need to store the updated queue settings in that case, and apply them later.
Move the location of the queue params to within struct mt7996_vif_link.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 +++--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 5 ++++- drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 7 ++++++- 3 files changed, 13 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +3 -3
@@ -665,8 +665,8 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif, unsigned int link_id, u16 queue, const struct ieee80211_tx_queue_params *params) { - struct mt7996_dev *dev = mt7996_hw_dev(hw); -struct mt7996_vif_link *mlink =mt7996_vif_link (dev, vif, link_id); + struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv; +struct mt7996_vif_link_info *link_info = &mvif->link_info[link_id]; static const u8 mq_to_aci[] = { [IEEE80211_AC_VO] = 3, [IEEE80211_AC_VI] = 2,
@@ -675,7 +675,7 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif, };/* firmware uses access class index */ - mlink->queue_params[mq_to_aci[queue]] = *params; + link_info->queue_params[mq_to_aci[queue]] = *params;/* no need to update right away, we'll get BSS_CHANGED_QOS */ return 0 ;
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +4 -1
@@ -3414,6 +3414,9 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif,#define WMM_PARAM_SET (WMM_AIFS_SET | WMM_CW_MIN_SET | \ WMM_CW_MAX_SET | WMM_TXOP_SET)struct mt7996_vif_link *link =mt7996_vif_conf_link (dev, vif, link_conf); +struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv; +unsigned int link_id = link_conf->link_id; +struct mt7996_vif_link_info *link_info = &mvif->link_info[link_id];struct {u8 bss_idx;u8 __rsv[3 ];
@@ -3431,7 +3434,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif,skb_put_data (skb, &hdr,sizeof (hdr));for (ac =0 ; ac <IEEE80211_NUM_ACS ; ac++) { -struct ieee80211_tx_queue_params *q = &link->queue_params[ac]; +struct ieee80211_tx_queue_params *q = &link_info->queue_params[ac];struct edca *e;struct tlv *tlv;
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +6 -1
@@ -253,16 +253,21 @@ struct mt7996_vif_link {struct mt7996_sta_link msta_link;struct mt7996_phy *phy; -struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS ];struct cfg80211_bitrate_mask bitrate_mask;u8 mld_idx; }; +struct mt7996_vif_link_info { +struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS ]; +}; +struct mt7996_vif {struct mt7996_vif_link deflink;/* must be first */ struct mt76_vif_data mt76; +struct mt7996_vif_link_info link_info[IEEE80211_MLD_MAX_NUM_LINKS ]; +u8 mld_group_idx;u8 mld_remap_idx; };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 384/614 wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 084922069ceac4d594c06b76a80352139fd15f4d ]
Remove unnecessary link_id checks in mt7996_tx routine since if the link identifier provided by mac80211 is unspecified the value will be overwritten at the beginning on the function.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +5 -7
@@ -1339,12 +1339,10 @@ static void mt7996_tx(struct ieee80211_hw *hw, }if (mvif) { -struct mt76_vif_link *mlink = &mvif->deflink.mt76; +struct mt76_vif_link *mlink; -if (link_id <IEEE80211_LINK_UNSPECIFIED ) - mlink =rcu_dereference (mvif->mt76.link[link_id]); - -if (mlink->wcid) + mlink =rcu_dereference (mvif->mt76.link[link_id]); +if (mlink && mlink->wcid) wcid = mlink->wcid; if (mvif->mt76.roc_phy &&
@@ -1352,7 +1350,7 @@ static void mt7996_tx(struct ieee80211_hw *hw, mphy = mvif->mt76.roc_phy;if (mphy->roc_link) wcid = mphy->roc_link->wcid; - }else { + }else if (mlink) { mphy =mt76_vif_link_phy (mlink); } }
@@ -1362,7 +1360,7 @@ static void mt7996_tx(struct ieee80211_hw *hw, goto unlock; } -if (msta && link_id <IEEE80211_LINK_UNSPECIFIED ) { +if (msta) {struct mt7996_sta_link *msta_link; msta_link =rcu_dereference (msta->link[link_id]);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 385/614 wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 385aab8fccd7a8746b9f1a17f3c1e38498a14bc7 ]
MT7996 driver can use both wed and wed_hif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary wed device in wed callbacks resulting in the following crash if the hw runs wed_hif2 (e.g. 6GHz link).
[ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a [ 297.464928] Mem abort info: [ 297.467722] ESR = 0x0000000096000005 [ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits [ 297.476766] SET = 0, FnV = 0 [ 297.479809] EA = 0, S1PTW = 0 [ 297.482940] FSC = 0x05: level 1 translation fault [ 297.487809] Data abort info: [ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000 [ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000 [ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP [ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0 [ 297.723908] Tainted: [O]=OOT_MODULE [ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT) [ 297.732857] Workqueue: nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table] [ 297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76] [ 297.752688] lr : mtk_wed_flow_remove+0x58/0x80 [ 297.757126] sp : ffffffc080fe3ae0 [ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7 [ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00 [ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018 [ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000 [ 297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 [ 297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da [ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200 [ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002 [ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000 [ 297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8 [ 297.831686] Call trace: [ 297.834123] mt76_wed_offload_disable+0x64/0xa0 [mt76] [ 297.839254] mtk_wed_flow_remove+0x58/0x80 [ 297.843342] mtk_flow_offload_cmd+0x434/0x574 [ 297.847689] mtk_wed_setup_tc_block_cb+0x30/0x40 [ 297.852295] nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table] [ 297.858466] nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table] [ 297.864463] process_one_work+0x174/0x300 [ 297.868465] worker_thread+0x278/0x430 [ 297.872204] kthread+0xd8/0xdc [ 297.875251] ret_from_fork+0x10/0x20 [ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421) [ 297.884901] ---[ end trace 0000000000000000 ]---
Fix the issue detecting the proper wed reference to use running wed callabacks.
--- drivers/net/wireless/mediatek/mt76/mt76.h | 9 +++++++++ drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 + drivers/net/wireless/mediatek/mt76/wed.c | 10 +++++----- include/linux/soc/mediatek/mtk_wed.h | 1 + 4 files changed, 16 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt76.h +9 -0
@@ -1252,6 +1252,15 @@ static inline int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q,#define mt76_dereference (p, dev) \ rcu_dereference_protected(p, lockdep_is_held(&(dev)->mutex)) +static inline struct mt76_dev *mt76_wed_to_dev (struct mtk_wed_device *wed) +{ +#ifdef CONFIG_NET_MEDIATEK_SOC_WED +if (wed->wlan.hif2) + return container_of(wed, struct mt76_dev, mmio.wed_hif2); +#endif /* CONFIG_NET_MEDIATEK_SOC_WED */ + return container_of(wed, struct mt76_dev, mmio.wed); +} +static inline struct mt76_wcid *__mt76_wcid_ptr (struct mt76_dev *dev,u16 idx) {
drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +1 -0
@@ -595,6 +595,7 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr, wed->wlan.nbuf =MT7996_HW_TOKEN_SIZE ; wed->wlan.token_start =MT7996_TOKEN_SIZE - wed->wlan.nbuf; + wed->wlan.hif2 = hif2; wed->wlan.amsdu_max_subframes =8 ; wed->wlan.amsdu_max_len =1536 ;
drivers/net/wireless/mediatek/mt76/wed.c +5 -5
@@ -8,7 +8,7 @@void mt76_wed_release_rx_buf (struct mtk_wed_device *wed) { - struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed); +struct mt76_dev *dev =mt76_wed_to_dev (wed);int i;for (i =0 ; i < dev->rx_token_size; i++) {
@@ -31,8 +31,8 @@ EXPORT_SYMBOL_GPL(mt76_wed_release_rx_buf);#ifdef CONFIG_NET_MEDIATEK_SOC_WED u32 mt76_wed_init_rx_buf (struct mtk_wed_device *wed,int size) { - struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc; +struct mt76_dev *dev =mt76_wed_to_dev (wed);struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN ];struct mt76_txwi_cache *t =NULL ;int i;
@@ -80,7 +80,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_init_rx_buf);int mt76_wed_offload_enable (struct mtk_wed_device *wed) { - struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed); +struct mt76_dev *dev =mt76_wed_to_dev (wed);spin_lock_bh (&dev->token_lock); dev->token_size = wed->wlan.token_start;
@@ -164,7 +164,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_dma_setup);void mt76_wed_offload_disable (struct mtk_wed_device *wed) { - struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed); +struct mt76_dev *dev =mt76_wed_to_dev (wed);spin_lock_bh (&dev->token_lock); dev->token_size = dev->drv->token_size;
@@ -174,7 +174,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_offload_disable);void mt76_wed_reset_complete (struct mtk_wed_device *wed) { - struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed); +struct mt76_dev *dev =mt76_wed_to_dev (wed);complete (&dev->mmio.wed_reset_complete); }
include/linux/soc/mediatek/mtk_wed.h +1 -0
@@ -154,6 +154,7 @@ struct mtk_wed_device {bool wcid_512;bool hw_rro;bool msi; +bool hif2;u16 token_start;unsigned int nbuf;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 386/614 wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 2157e49892c5eae210b8fa6ee8672bd9d0ffa4b5 ]
Get rid of useless null-pointer check in mt7996_msdu_page_get_from_cache since we have already verfied the list is not empty.
--- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mac.c +1 -2
@@ -1681,8 +1681,7 @@ mt7996_msdu_page_get_from_cache(struct mt7996_dev *dev)if (!list_empty (&dev->wed_rro.page_cache)) { p =list_first_entry (&dev->wed_rro.page_cache, struct mt7996_msdu_page, list); -if (p) -list_del (&p->list); +list_del (&p->list); }spin_unlock (&dev->wed_rro.lock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 387/614 Revert "wifi: mt76: mt792x: improve monitor interface handling"
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit cdb2941a516cf06929293604e2e0f4c1d6f3541e ]
This reverts commit 55e95ce469d0c61041bae48b2ebb7fcbf6d1ba7f.
mt792x drivers don't seem to support multi-radio devices yet. At least they don't mess with struct wiphy_radio at the moment.
Packet capturing on monitor interface doesn't work after the blamed patch:
tcpdump -i wls6mon -n -vvv
Revert the NO_VIRTUAL_MONITOR feature for now to resolve the issue.
Found by Linux Verification Center (linuxtesting.org).
--- drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt792x_core.c +0 -1
@@ -688,7 +688,6 @@ int mt792x_init_wiphy(struct ieee80211_hw *hw)ieee80211_hw_set (hw,SUPPORTS_DYNAMIC_PS );ieee80211_hw_set (hw,SUPPORTS_VHT_EXT_NSS_BW );ieee80211_hw_set (hw,CONNECTION_MONITOR ); -ieee80211_hw_set (hw,NO_VIRTUAL_MONITOR );ieee80211_hw_set (hw,SUPPORTS_MULTI_BSSID );ieee80211_hw_set (hw,SUPPORTS_ONLY_HE_MULTI_BSSID );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 388/614 wifi: mt76: mt7996: fix max nss value when getting rx chainmask
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: StanleyYP Wang <[email protected]>
[ Upstream commit 361b59b6be7c33c43b619d5cada394efc0f3b398 ]
Since wiphy->available_antennas_tx now accumulates the chainmask of all the radios of a wiphy, use phy->orig_antenna_mask to get the original max nss for comparison.
--- drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +1 -1
@@ -786,7 +786,7 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,static inline u16 mt7996_rx_chainmask (struct mt7996_phy *phy) { -int max_nss =hweight8 (phy->mt76->hw->wiphy->available_antennas_tx); +int max_nss =hweight16 (phy->orig_antenna_mask);int cur_nss =hweight8 (phy->mt76->antenna_mask);u16 tx_chainmask = phy->mt76->chainmask;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 389/614 wifi: mt76: mt7996: fix implicit beamforming support for mt7992
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <[email protected]>
[ Upstream commit 5d86765828b47444908a8689f2625872e8dac48f ]
Fix the ibf_timeout field for mt7996, mt7992 and mt7990 chipsets. For the mt7992, this value shall be set as 0xff, while the others shall be set as 0x18.
--- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +2 -2
@@ -1822,8 +1822,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb, bf->ibf_nrow = tx_ant;if (link_sta->eht_cap.has_eht || link_sta->he_cap.has_he) - bf->ibf_timeout =is_mt7996 (&dev->mt76) ?MT7996_IBF_TIMEOUT : -MT7992_IBF_TIMEOUT ; + bf->ibf_timeout =is_mt7992 (&dev->mt76) ?MT7992_IBF_TIMEOUT : +MT7996_IBF_TIMEOUT ;else if (!ebf && link_sta->bandwidth <=IEEE80211_STA_RX_BW_40 && !bf->ncol) bf->ibf_timeout =MT7996_IBF_TIMEOUT_LEGACY ;else
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 390/614 wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit bb705a606734e1ce0ff17a4f368a896757ba686d ]
Fix several fields in mt7996_mcu_bss_basic_tlv() that were not obtained from the correct link. Without this patch, the MLD station interface does not function properly.
--- .../net/wireless/mediatek/mt76/mt7996/mcu.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +11 -10
@@ -1034,7 +1034,6 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,struct mt76_connac_bss_basic_tlv *bss;u32 type =CONNECTION_INFRA_AP ;u16 sta_wlan_idx = wlan_idx; -struct ieee80211_sta *sta;struct tlv *tlv;int idx;
@@ -1045,14 +1044,18 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,break ;case NL80211_IFTYPE_STATION :if (enable) { +struct ieee80211_sta *sta; +rcu_read_lock (); - sta =ieee80211_find_sta (vif, vif->bss_conf.bssid); -/* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */ + sta =ieee80211_find_sta (vif, link_conf->bssid);if (sta) { -struct mt76_wcid *wcid; +struct mt7996_sta *msta = (void *)sta->drv_priv; +struct mt7996_sta_link *msta_link; +int link_id = link_conf->link_id; - wcid = (struct mt76_wcid *)sta->drv_priv; - sta_wlan_idx = wcid->idx; + msta_link =rcu_dereference (msta->link[link_id]); +if (msta_link) + sta_wlan_idx = msta_link->wcid.idx; }rcu_read_unlock (); }
@@ -1069,8 +1072,6 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb, tlv =mt7996_mcu_add_uni_tlv (skb,UNI_BSS_INFO_BASIC ,sizeof (*bss)); bss = (struct mt76_connac_bss_basic_tlv *)tlv; - bss->bcn_interval =cpu_to_le16 (link_conf->beacon_int); - bss->dtim_period = link_conf->dtim_period; bss->bmc_tx_wlan_idx =cpu_to_le16 (wlan_idx); bss->sta_idx =cpu_to_le16 (sta_wlan_idx); bss->conn_type =cpu_to_le32 (type);
@@ -1090,10 +1091,10 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,memcpy (bss->bssid, link_conf->bssid,ETH_ALEN ); bss->bcn_interval =cpu_to_le16 (link_conf->beacon_int); - bss->dtim_period = vif->bss_conf.dtim_period; + bss->dtim_period = link_conf->dtim_period; bss->phymode =mt76_connac_get_phy_mode (phy, vif, chandef->chan->band,NULL ); - bss->phymode_ext =mt76_connac_get_phy_mode_ext (phy, &vif->bss_conf, + bss->phymode_ext =mt76_connac_get_phy_mode_ext (phy, link_conf, chandef->chan->band);return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 391/614 wifi: mt76: mt7996: fix teardown command for an MLD peer
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit e077071e7ac48d5453072f615d51629891c5b90d ]
For an MLD peer, we only need to call the teardown command when removing the last link, and there's no need to call mt7996_mcu_add_sta() for the earlier links.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +4 -4
@@ -1206,13 +1206,13 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,mt7996_mac_twt_teardown_flow (dev, link, msta_link, i); -if (sta->mlo && links ==BIT (link_id))/* last link */ -mt7996_mcu_teardown_mld_sta (dev, link, - msta_link); -else +if (!sta->mlo)mt7996_mcu_add_sta (dev, link_conf, link_sta, link, msta_link,CONN_STATE_DISCONNECT , false); +else if (sta->mlo && links ==BIT (link_id))/* last link */ +mt7996_mcu_teardown_mld_sta (dev, link, + msta_link); msta_link->wcid.sta_disabled =1 ; msta_link->wcid.sta =0 ; links = links & ~BIT (link_id);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 392/614 wifi: mt76: mt7996: set link_valid field when initializing wcid
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit 7eaea3a8ba1e9bb58f87e3030f6ce18537e57e1f ]
This ensures the upper layer uses the correct link ID during packet processing.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +2 -0
@@ -343,6 +343,7 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,INIT_LIST_HEAD (&msta_link->rc_list); msta_link->wcid.idx = idx; msta_link->wcid.link_id = link_conf->link_id; + msta_link->wcid.link_valid =ieee80211_vif_is_mld (vif); msta_link->wcid.tx_info |=MT_WCID_TX_INFO_SET ;mt76_wcid_init (&msta_link->wcid, band_idx);
@@ -984,6 +985,7 @@ mt7996_mac_sta_init_link(struct mt7996_dev *dev, msta_link->wcid.sta =1 ; msta_link->wcid.idx = idx; msta_link->wcid.link_id = link_id; + msta_link->wcid.link_valid = !!sta->valid_links; msta_link->wcid.def_wcid = &msta->deflink.wcid;ewma_avg_signal_init (&msta_link->avg_ack_signal);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 393/614 wifi: mt76: mt7996: fix MLD group index assignment
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit 4fb3b4e7d1ca5453c6167816230370afc15f26bf ]
Fix extender mode and MBSS issues caused by incorrect assignment of the MLD group and remap indices.
--- .../net/wireless/mediatek/mt76/mt7996/main.c | 58 +++++++++++++------ 1 file changed, 40 insertions(+), 18 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +40 -18
@@ -90,9 +90,11 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend) { } -static inline int get_free_idx (u32 mask,u8 start,u8 end) +static inline int get_free_idx (u64 mask,u8 start,u8 end) { -return ffs (~mask &GENMASK (end, start)); +if (~mask &GENMASK_ULL (end, start)) +return __ffs64 (~mask &GENMASK_ULL (end, start)) +1 ; +return 0 ; }static int get_omac_idx (enum nl80211_iftype type,u64 mask)
@@ -308,12 +310,6 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,if (idx <0 )return -ENOSPC ; -if (!dev->mld_idx_mask) {/* first link in the group */ - mvif->mld_group_idx =get_own_mld_idx (dev->mld_idx_mask, true); - mvif->mld_remap_idx =get_free_idx (dev->mld_remap_idx_mask, -0 ,15 ); - } - mld_idx =get_own_mld_idx (dev->mld_idx_mask, false);if (mld_idx <0 )return -ENOSPC ;
@@ -331,10 +327,6 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,return ret; dev->mt76.vif_mask |=BIT_ULL (mlink->idx); -if (!dev->mld_idx_mask) { - dev->mld_idx_mask |=BIT_ULL (mvif->mld_group_idx); - dev->mld_remap_idx_mask |=BIT_ULL (mvif->mld_remap_idx); - } dev->mld_idx_mask |=BIT_ULL (link->mld_idx); phy->omac_mask |=BIT_ULL (mlink->omac_idx);
@@ -424,11 +416,6 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif, dev->mt76.vif_mask &= ~BIT_ULL (mlink->idx); dev->mld_idx_mask &= ~BIT_ULL (link->mld_idx); phy->omac_mask &= ~BIT_ULL (mlink->omac_idx); -if (!(dev->mld_idx_mask & ~BIT_ULL (mvif->mld_group_idx))) { -/* last link */ - dev->mld_idx_mask &= ~BIT_ULL (mvif->mld_group_idx); - dev->mld_remap_idx_mask &= ~BIT_ULL (mvif->mld_remap_idx); - }spin_lock_bh (&dev->mt76.sta_poll_lock);if (!list_empty (&msta_link->wcid.poll_list))
@@ -2217,7 +2204,42 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u16 old_links, u16 new_links, struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS]) { - return 0; + struct mt7996_dev *dev = mt7996_hw_dev(hw); +struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv; +int ret =0 ; + +mutex_lock (&dev->mt76.mutex); + +if (!old_links) { +int idx; + + idx =get_own_mld_idx (dev->mld_idx_mask, true); +if (idx <0 ) { + ret = -ENOSPC ; + goto out; + } + mvif->mld_group_idx = idx; + dev->mld_idx_mask |=BIT_ULL (mvif->mld_group_idx); + + idx =get_free_idx (dev->mld_remap_idx_mask,0 ,15 ) -1 ; +if (idx <0 ) { + ret = -ENOSPC ; + goto out; + } + mvif->mld_remap_idx = idx; + dev->mld_remap_idx_mask |=BIT_ULL (mvif->mld_remap_idx); + } + +if (new_links) + goto out; + + dev->mld_idx_mask &= ~BIT_ULL (mvif->mld_group_idx); + dev->mld_remap_idx_mask &= ~BIT_ULL (mvif->mld_remap_idx); + +out: +mutex_unlock (&dev->mt76.mutex); + +return ret; } static void
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 394/614 wifi: mt76: mt7996: fix MLO set key and group key issues
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit e11be918d91e7d33ac4bad41dbe666a9abf1cfaa ]
This patch fixes the following key issues:
- Pass correct link BSS to mt7996_mcu_add_key(), and use HW beacon protection mode for mt7990 chipset
- Do not do group key deletion for GTK and IGTK due to FW design, the delete key command will delete all group keys of a link BSS
- For deleting BIGTK, FW adds a new flow, but the "sec->add" field should be filled with "SET_KEY". Note that if BIGTK is not deleted, it will cause beacon decryption issue when switching from an AP interface to a station interface
--- .../net/wireless/mediatek/mt76/mt7996/mac.c | 7 +++- .../net/wireless/mediatek/mt76/mt7996/main.c | 5 +-- .../net/wireless/mediatek/mt76/mt7996/mcu.c | 35 +++++++++++++------ .../wireless/mediatek/mt76/mt7996/mt7996.h | 2 +- 4 files changed, 34 insertions(+), 15 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/mac.c +6 -1
@@ -794,6 +794,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,u8 tid = skb->priority &IEEE80211_QOS_CTL_TID_MASK ;__le16 fc = hdr->frame_control, sc = hdr->seq_ctrl;u16 seqno =le16_to_cpu (sc); +bool hw_bigtk = false;u8 fc_type, fc_stype;u32 val;
@@ -819,7 +820,11 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi, info->flags & IEEE80211_TX_CTL_USE_MINRATE) val |=MT_TXD1_FIXED_RATE ; -if (key && multicast &&ieee80211_is_robust_mgmt_frame (skb)) { +if (is_mt7990 (&dev->mt76) &&ieee80211_is_beacon (fc) && + (wcid->hw_key_idx2 ==6 || wcid->hw_key_idx2 ==7 )) + hw_bigtk = true; + +if ((key && multicast &&ieee80211_is_robust_mgmt_frame (skb)) || hw_bigtk) { val |=MT_TXD1_BIP ; txwi[3 ] &= ~cpu_to_le32 (MT_TXD3_PROTECT_FRAME ); }
drivers/net/wireless/mediatek/mt76/mt7996/main.c +3 -2
@@ -249,12 +249,13 @@ mt7996_set_hw_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,else if (idx == *wcid_keyidx) *wcid_keyidx =-1 ; -if (cmd !=SET_KEY && sta) +/* only do remove key for BIGTK */ +if (cmd !=SET_KEY && !is_bigtk)return 0 ;mt76_wcid_key_setup (&dev->mt76, &msta_link->wcid, key); - err =mt7996_mcu_add_key (&dev->mt76, vif, key, + err =mt7996_mcu_add_key (&dev->mt76, link, key,MCU_WMWA_UNI_CMD (STA_REC_UPDATE ), &msta_link->wcid, cmd);
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +24 -11
@@ -2527,7 +2527,7 @@ int mt7996_mcu_teardown_mld_sta(struct mt7996_dev *dev, }static int -mt7996_mcu_sta_key_tlv (struct mt76_wcid *wcid, +mt7996_mcu_sta_key_tlv (struct mt76_dev *dev,struct mt76_wcid *wcid,struct sk_buff *skb,struct ieee80211_key_conf *key,enum set_key_cmd cmd)
@@ -2539,7 +2539,10 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid, tlv =mt76_connac_mcu_add_tlv (skb,STA_REC_KEY_V2 ,sizeof (*sec)); sec = (struct sta_rec_sec_uni *)tlv; - sec->add =0 ; +/* due to connac3 FW design, we only do remove key for BIGTK; even for +* removal, the field should be filled with SET_KEY +*/ + sec->add =SET_KEY ; sec->n_cipher =1 ; sec_key = &sec->key[0 ]; sec_key->wlan_idx =cpu_to_le16 (wcid->idx);
@@ -2579,29 +2582,33 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,case WLAN_CIPHER_SUITE_BIP_GMAC_256 : sec_key->cipher_id =MCU_CIPHER_BCN_PROT_GMAC_256 ;break ; +case WLAN_CIPHER_SUITE_BIP_CMAC_256 : +if (!is_mt7990 (dev)) +return -EOPNOTSUPP ; + sec_key->cipher_id =MCU_CIPHER_BCN_PROT_CMAC_256 ; +break ;default :return -EOPNOTSUPP ; } - sec_key->bcn_mode =BP_SW_MODE ; + sec_key->bcn_mode =is_mt7990 (dev) ?BP_HW_MODE :BP_SW_MODE ;return 0 ; } -int mt7996_mcu_add_key (struct mt76_dev *dev,struct ieee80211_vif *vif, +int mt7996_mcu_add_key (struct mt76_dev *dev,struct mt7996_vif_link *link,struct ieee80211_key_conf *key,int mcu_cmd,struct mt76_wcid *wcid,enum set_key_cmd cmd) { -struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;struct sk_buff *skb;int ret; - skb =__mt76_connac_mcu_alloc_sta_req (dev, mvif, wcid, -MT7996_STA_UPDATE_MAX_SIZE ); + skb =__mt76_connac_mcu_alloc_sta_req (dev, (struct mt76_vif_link *)link, + wcid,MT7996_STA_UPDATE_MAX_SIZE );if (IS_ERR (skb))return PTR_ERR (skb); - ret =mt7996_mcu_sta_key_tlv (wcid, skb, key, cmd); + ret =mt7996_mcu_sta_key_tlv (dev, wcid, skb, key, cmd);if (ret) {dev_kfree_skb (skb);return ret;
@@ -2721,12 +2728,18 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,static void mt7996_mcu_beacon_cont (struct mt7996_dev *dev,struct ieee80211_bss_conf *link_conf, +struct mt7996_vif_link *link,struct sk_buff *rskb,struct sk_buff *skb,struct bss_bcn_content_tlv *bcn,struct ieee80211_mutable_offsets *offs) { -struct mt76_wcid *wcid = &dev->mt76.global_wcid; -u8 *buf; +u8 *buf, keyidx = link->msta_link.wcid.hw_key_idx2; +struct mt76_wcid *wcid; + +if (is_mt7990 (&dev->mt76) && (keyidx ==6 || keyidx ==7 )) + wcid = &link->msta_link.wcid; +else + wcid = &dev->mt76.global_wcid; bcn->pkt_len =cpu_to_le16 (MT_TXD_SIZE + skb->len); bcn->tim_ie_pos =cpu_to_le16 (offs->tim_offset);
@@ -2801,7 +2814,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif, info =IEEE80211_SKB_CB (skb); info->hw_queue |=FIELD_PREP (MT_TX_HW_QUEUE_PHY , mlink->band_idx); -mt7996_mcu_beacon_cont (dev, link_conf, rskb, skb, bcn, &offs); +mt7996_mcu_beacon_cont (dev, link_conf, link, rskb, skb, bcn, &offs);if (link_conf->bssid_indicator)mt7996_mcu_beacon_mbss (rskb, skb, bcn, &offs);mt7996_mcu_beacon_cntdwn (rskb, skb, &offs, link_conf->csa_active);
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h +1 -1
@@ -848,7 +848,7 @@ void mt7996_update_channel(struct mt76_phy *mphy);int mt7996_init_debugfs (struct mt7996_dev *dev);void mt7996_debugfs_rx_fw_monitor (struct mt7996_dev *dev,const void *data,int len);bool mt7996_debugfs_rx_log (struct mt7996_dev *dev,const void *data,int len); -int mt7996_mcu_add_key (struct mt76_dev *dev,struct ieee80211_vif *vif, +int mt7996_mcu_add_key (struct mt76_dev *dev,struct mt7996_vif_link *link,struct ieee80211_key_conf *key,int mcu_cmd,struct mt76_wcid *wcid,enum set_key_cmd cmd); int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 395/614 wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit f1e9f369ae42ee433836b24467e645192d046a51 ]
Pass the correct mt7996_phy to mt7996_run().
--- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/mac.c +1 -1
@@ -2341,7 +2341,7 @@ mt7996_mac_restart(struct mt7996_dev *dev)if (!test_bit (MT76_STATE_RUNNING , &phy->mt76->state))continue ; - ret =mt7996_run (&dev->phy); + ret =mt7996_run (phy);if (ret) goto out; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 396/614 wifi: mt76: mt7996: fix EMI rings for RRO
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <[email protected]>
[ Upstream commit a4031fec9d0d230224a7edcefa3368c06c317148 ]
The RRO EMI rings only need to be allocated when WED is not active. This patch fixes command timeout issue for the setting of WED off and RRO on.
--- .../net/wireless/mediatek/mt76/mt7996/dma.c | 15 +++++++++------ .../net/wireless/mediatek/mt76/mt7996/init.c | 19 ++++++++++++++++--- 2 files changed, 25 insertions(+), 9 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/dma.c +9 -6
@@ -512,12 +512,15 @@ int mt7996_dma_rro_init(struct mt7996_dev *dev)if (ret)return ret; -/* We need to set cpu idx pointer before resetting the EMI -* queues. -*/ - mdev->q_rx[MT_RXQ_RRO_RXDMAD_C ].emi_cpu_idx = - &dev->wed_rro.emi_rings_cpu.ptr->ring[0 ].idx; -mt76_queue_reset (dev, &mdev->q_rx[MT_RXQ_RRO_RXDMAD_C ], true); +if (!mtk_wed_device_active (&mdev->mmio.wed)) { +/* We need to set cpu idx pointer before resetting the +* EMI queues. +*/ + mdev->q_rx[MT_RXQ_RRO_RXDMAD_C ].emi_cpu_idx = + &dev->wed_rro.emi_rings_cpu.ptr->ring[0 ].idx; +mt76_queue_reset (dev, &mdev->q_rx[MT_RXQ_RRO_RXDMAD_C ], + true); + } goto start_hw_rro; }
drivers/net/wireless/mediatek/mt76/mt7996/init.c +16 -3
@@ -959,9 +959,10 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev) MT7996_RRO_MSDU_PG_SIZE_PER_CR); } -if (dev->mt76.hwrro_mode ==MT76_HWRRO_V3_1 ) { +if (!mtk_wed_device_active (&dev->mt76.mmio.wed) && + dev->mt76.hwrro_mode ==MT76_HWRRO_V3_1 ) { ptr =dmam_alloc_coherent (dev->mt76.dma_dev, -sizeof (dev->wed_rro.emi_rings_cpu.ptr), +sizeof (*dev->wed_rro.emi_rings_cpu.ptr), &dev->wed_rro.emi_rings_cpu.phy_addr,GFP_KERNEL );if (!ptr)
@@ -970,7 +971,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev) dev->wed_rro.emi_rings_cpu.ptr = ptr; ptr =dmam_alloc_coherent (dev->mt76.dma_dev, -sizeof (dev->wed_rro.emi_rings_dma.ptr), +sizeof (*dev->wed_rro.emi_rings_dma.ptr), &dev->wed_rro.emi_rings_dma.phy_addr,GFP_KERNEL );if (!ptr)
@@ -1036,6 +1037,18 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev) dev->wed_rro.msdu_pg[i].phy_addr); } +if (dev->wed_rro.emi_rings_cpu.ptr) +dmam_free_coherent (dev->mt76.dma_dev, +sizeof (*dev->wed_rro.emi_rings_cpu.ptr), + dev->wed_rro.emi_rings_cpu.ptr, + dev->wed_rro.emi_rings_cpu.phy_addr); + +if (dev->wed_rro.emi_rings_dma.ptr) +dmam_free_coherent (dev->mt76.dma_dev, +sizeof (*dev->wed_rro.emi_rings_dma.ptr), + dev->wed_rro.emi_rings_dma.ptr, + dev->wed_rro.emi_rings_dma.phy_addr); +if (!dev->wed_rro.session.ptr)return ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 397/614 wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 5a4bcba26e9fbea87507a81ad891e70bb525014f ]
Grab mt76 mutex in mt7996_mac_sta_event routine in order to rely on mt76_dereference() utility macro.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +10 -5
@@ -1150,12 +1150,15 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,unsigned long links = sta->valid_links;struct ieee80211_link_sta *link_sta;unsigned int link_id; +int err =0 ; + +mutex_lock (&dev->mt76.mutex);for_each_sta_active_link (vif, sta, link_sta, link_id) {struct ieee80211_bss_conf *link_conf;struct mt7996_sta_link *msta_link;struct mt7996_vif_link *link; -int i, err; +int i; link_conf =link_conf_dereference_protected (vif, link_id);if (!link_conf)
@@ -1175,12 +1178,12 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif, link, msta_link, CONN_STATE_CONNECT, true);if (err) -return err; + goto unlock; err =mt7996_mcu_add_rate_ctrl (dev, msta_link->sta, vif, link_id, false);if (err) -return err; + goto unlock; msta_link->wcid.tx_info |=MT_WCID_TX_INFO_SET ;break ;
@@ -1189,7 +1192,7 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif, link, msta_link, CONN_STATE_PORT_SECURE, false);if (err) -return err; + goto unlock;break ;case MT76_STA_EVENT_DISASSOC :for (i =0 ; i <ARRAY_SIZE (msta_link->twt.flow); i++)
@@ -1209,8 +1212,10 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,break ; } } +unlock: +mutex_unlock (&dev->mt76.mutex); -return 0 ; +return err; } static void
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 398/614 wifi: mt76: Move mt76_abort_scan out of mt76_reset_device()
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 6aaaaeacf18b2dc2b0f78f241800e0ea680938c7 ]
Move mt76_abort_scan routine out of mt76_reset_device() in order to avoid a possible deadlock since mt76_reset_device routine is running with mt76 mutex help and mt76_abort_scan_complete() can grab mt76 mutex in some cases.
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 -- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 ++ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 ++ 3 files changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mac80211.c +0 -2
@@ -847,8 +847,6 @@ void mt76_reset_device(struct mt76_dev *dev) }rcu_read_unlock (); -mt76_abort_scan (dev); -INIT_LIST_HEAD (&dev->wcid_list);INIT_LIST_HEAD (&dev->sta_poll_list); dev->vif_mask =0 ;
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +2 -0
@@ -1451,6 +1451,8 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)if (ext_phy)cancel_delayed_work_sync (&ext_phy->mac_work); +mt76_abort_scan (&dev->mt76); +mutex_lock (&dev->mt76.mutex);for (i =0 ; i <10 ; i++) {if (!mt7915_mac_restart (dev))
drivers/net/wireless/mediatek/mt76/mt7996/mac.c +2 -0
@@ -2424,6 +2424,8 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)mt7996_for_each_phy (dev, phy)cancel_delayed_work_sync (&phy->mt76->mac_work); +mt76_abort_scan (&dev->mt76); +mutex_lock (&dev->mt76.mutex);for (i =0 ; i <10 ; i++) {if (!mt7996_mac_restart (dev))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 399/614 wifi: mt76: mt7996: skip deflink accounting for offchannel links
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 4fe823b9ee0317b04ddc6d9e00fea892498aa0f2 ]
Do not take into account offchannel links for deflink accounting.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +4 -2
@@ -370,7 +370,8 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,ieee80211_iter_keys (mphy->hw, vif, mt7996_key_iter, &it); -if (mvif->mt76.deflink_id ==IEEE80211_LINK_UNSPECIFIED ) +if (!mlink->wcid->offchannel && + mvif->mt76.deflink_id ==IEEE80211_LINK_UNSPECIFIED ) mvif->mt76.deflink_id = link_conf->link_id;return 0 ;
@@ -401,7 +402,8 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,rcu_assign_pointer (dev->mt76.wcid[idx],NULL ); -if (mvif->mt76.deflink_id == link_conf->link_id) { +if (!mlink->wcid->offchannel && + mvif->mt76.deflink_id == link_conf->link_id) {struct ieee80211_bss_conf *iter;unsigned int link_id;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 400/614 wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove
In reply to Greg Kroah-Hartman6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 2a432a6d0066d4ce05a2d0eec1da9e061eb70c49 ]
mt7996_vif_link_remove routine is executed by mt76_scan_complete() without holding the wiphy mutex triggering the following lockdep warning.
WARNING: CPU: 0 PID: 72 at net/mac80211/key.c:1029 ieee80211_iter_keys+0xe4/0x1a0 [mac80211] CPU: 0 UID: 0 PID: 72 Comm: kworker/u32:2 Tainted: G S 6.18.0-rc5+ #27 PREEMPT(full) Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/15/2023 Workqueue: phy3 mt76_scan_work [mt76] RIP: 0010:ieee80211_iter_keys+0xe4/0x1a0 [mac80211] Code: 4c 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 8b 47 48 be ff ff ff ff 48 8d 78 68 e8 b4 eb 1e e1 85 c0 0f 85 49
ff ff ff 4c 8b ab 90 1a 00 00 48 8d 83 90
RSP: 0018:ffffc900002f7cb0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888127e00ee0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888127e00788 RDI: ffff88811132b5c8
RBP: ffffffffa0ddf400 R08: 0000000000000001 R09: 000000009dcc1dac
R10: 0000000000000001 R11: ffff88811132b5a0 R12: ffffc900002f7d00
R13: ffff8882581e6a80 R14: ffff888127e0afc8 R15: ffff888158832038
FS: 0000000000000000(0000) GS:ffff8884da486000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000030a0fd90 CR3: 0000000002c52004 CR4: 00000000003706f0
Call Trace: <TASK> ? lock_acquire+0xc2/0x2c0 mt7996_vif_link_remove+0x64/0x2b0 [mt7996e] mt76_put_vif_phy_link+0x41/0x50 [mt76] mt76_scan_complete+0x77/0x100 [mt76] mt76_scan_work+0x2eb/0x3f0 [mt76] ? process_one_work+0x1e5/0x6d0 process_one_work+0x221/0x6d0 worker_thread+0x19a/0x340 ? rescuer_thread+0x450/0x450 kthread+0x108/0x220 ? kthreads_online_cpu+0x110/0x110 ret_from_fork+0x1c6/0x220 ? kthreads_online_cpu+0x110/0x110 ret_from_fork_asm+0x11/0x20 </TASK> irq event stamp: 45471 hardirqs last enabled at (45477): [<ffffffff813d446e>] __up_console_sem+0x5e/0x70 hardirqs last disabled at (45482): [<ffffffff813d4453>] __up_console_sem+0x43/0x70 softirqs last enabled at (44500): [<ffffffff81f2ae0c>] napi_pp_put_page+0xac/0xd0 softirqs last disabled at (44498): [<ffffffff81fa32a0>] page_pool_put_unrefed_netmem+0x290/0x3d0 ---[ end trace 0000000000000000 ]---
Fix the issue skipping ieee80211_iter_keys() for scanning links in mt7996_vif_link_remove routine since we have not uploaded any hw keys for these links.
--- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7996/main.c +2 -1
@@ -392,7 +392,8 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif, };int idx = msta_link->wcid.idx; -ieee80211_iter_keys (mphy->hw, vif, mt7996_key_iter, &it); +if (!mlink->wcid->offchannel) +ieee80211_iter_keys (mphy->hw, vif, mt7996_key_iter, &it);mt7996_mcu_add_sta (dev, link_conf,NULL , link,NULL ,CONN_STATE_DISCONNECT , false);
Signature · 1 line
2.51.0