6.19.4-rc1 review
Greg Kroah-Hartman
maintainerPATCH 233/781 ASoC: nau8821: Fixup nau8821_enable_jack_detect()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 70237853edf0a69773a7370eb74ea2a44dfe3050 ]
The nau8821_enable_jack_detect() function was supposed to allow enabling or disabling jack events reporting. However, once enabled, any subsequent invocation would fail and the following splat is shown:
[ 3136.996771] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ 3136.996773] Workqueue: events_unbound deferred_probe_work_func [ 3136.996780] Call Trace: [ 3136.996782] <TASK> [ 3136.996787] dump_stack_lvl+0x6e/0xa0 [ 3136.996796] __setup_irq.cold+0x9c/0xce [ 3136.996803] ? __pfx_irq_default_primary_handler+0x10/0x10 [ 3136.996812] ? __pfx_nau8821_interrupt+0x10/0x10 [snd_soc_nau8821] [ 3136.996825] request_threaded_irq+0xd9/0x160 [ 3136.996853] devm_request_threaded_irq+0x71/0xd0 [ 3136.996859] ? __pfx_nau8821_interrupt+0x10/0x10 [snd_soc_nau8821] [ 3136.996882] nau8821_enable_jack_detect+0xa5/0xc0 [snd_soc_nau8821] [ 3136.996901] acp5x_8821_init+0x8d/0xa0 [snd_soc_acp5x_mach] [ 3136.996917] snd_soc_link_init+0x25/0x50 [snd_soc_core] [ 3136.996958] snd_soc_bind_card+0x615/0xd00 [snd_soc_core] [ 3136.997026] snd_soc_register_card+0x1b2/0x1c0 [snd_soc_core] [ 3136.997064] devm_snd_soc_register_card+0x47/0x90 [snd_soc_core] [ 3136.997108] acp5x_probe+0x72/0xb0 [snd_soc_acp5x_mach] [...] [ 3136.997508] nau8821 i2c-NVTN2020:00: Cannot request irq 58 (-16)
Introduce jdet_active flag to driver data structure and use it to provide one-time initialization of the jack detection work queue and related interrupt line.
Note this is also a prerequisite for additional fixes around module unloading and suspend handling.
--- sound/soc/codecs/nau8821.c | 5 +++++ sound/soc/codecs/nau8821.h | 1 + 2 files changed, 6 insertions(+)
sound/soc/codecs/nau8821.c +5 -0
@@ -1655,8 +1655,13 @@ int nau8821_enable_jack_detect(struct snd_soc_component *component,int ret; nau8821->jack = jack; + +if (nau8821->jdet_active) +return 0 ; +/* Initiate jack detection work queue */ INIT_DELAYED_WORK (&nau8821->jdet_work, nau8821_jdet_work); + nau8821->jdet_active = true; ret = devm_request_threaded_irq(nau8821->dev, nau8821->irq, NULL, nau8821_interrupt, IRQF_TRIGGER_LOW | IRQF_ONESHOT,
sound/soc/codecs/nau8821.h +1 -0
@@ -562,6 +562,7 @@ struct nau8821 {struct snd_soc_dapm_context *dapm;struct snd_soc_jack *jack;struct delayed_work jdet_work; +bool jdet_active;int irq;int clk_id;int micbias_voltage;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 234/781 ASoC: nau8821: Cancel delayed work on component remove
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit dbd3fd05cddfdeec1e49b0a66269881c09eebd17 ]
Attempting to unload the driver while a jack detection work is pending would likely crash the kernel when it is eventually scheduled for execution:
[ 1984.896308] BUG: unable to handle page fault for address: ffffffffc10c2a20 [...] [ 1984.896388] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ 1984.896396] Workqueue: events nau8821_jdet_work [snd_soc_nau8821] [ 1984.896414] RIP: 0010:__mutex_lock+0x9f/0x11d0 [...] [ 1984.896504] Call Trace: [ 1984.896511] <TASK> [ 1984.896524] ? snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core] [ 1984.896572] ? snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core] [ 1984.896596] snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core] [ 1984.896622] nau8821_jdet_work+0xeb/0x1e0 [snd_soc_nau8821] [ 1984.896636] process_one_work+0x211/0x590 [ 1984.896649] ? srso_return_thunk+0x5/0x5f [ 1984.896670] worker_thread+0x1cd/0x3a0
Cancel unscheduled jdet_work or wait for its execution to finish before the component driver gets removed.
--- sound/soc/codecs/nau8821.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/codecs/nau8821.c +9 -0
@@ -1264,6 +1264,14 @@ static int nau8821_component_probe(struct snd_soc_component *component)return 0 ; } +static void nau8821_component_remove (struct snd_soc_component *component) +{ +struct nau8821 *nau8821 =snd_soc_component_get_drvdata (component); + +if (nau8821->jdet_active) +cancel_delayed_work_sync (&nau8821->jdet_work); +}; +/** * nau8821_calc_fll_param - Calculate FLL parameters. * @fll_in: external clock provided to codec.
@@ -1621,6 +1629,7 @@ static int __maybe_unused nau8821_resume(struct snd_soc_component *component)static const struct snd_soc_component_driver nau8821_component_driver = { .probe = nau8821_component_probe, + .remove = nau8821_component_remove, .set_sysclk = nau8821_set_sysclk, .set_pll = nau8821_set_fll, .set_bias_level = nau8821_set_bias_level,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 235/781 ASoC: nau8821: Cancel pending work before suspend
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 7786b10688ac0ebeaff655923cbb2c7d34a98995 ]
A jack detection work that is unscheduled or in progress while executing the suspend handler could trigger a race condition.
Ensure state consistency by cancelling any pending work or wait for its execution to complete before processing the suspend. Since driver (re)enables both insert and eject interrupts on resume, there is no risk to miss the related jack events. Therefore, flush_delayed_work() is not required here.
--- sound/soc/codecs/nau8821.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/codecs/nau8821.c +4 -0
@@ -1605,6 +1605,10 @@ static int __maybe_unused nau8821_suspend(struct snd_soc_component *component)if (nau8821->irq)disable_irq (nau8821->irq); + +if (nau8821->jdet_active) +cancel_delayed_work_sync (&nau8821->jdet_work); +snd_soc_dapm_force_bias_level (nau8821->dapm,SND_SOC_BIAS_OFF );/* Power down codec power; don't support button wakeup */ snd_soc_dapm_disable_pin (nau8821->dapm,"MICBIAS" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 236/781 media: chips-media: wave5: Fix memory leak on codec_info allocation failure
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit a519e21e32398459ba357e67b541402f7295ee1b ]
In wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is allocated via kzalloc(). If the subsequent allocation for inst->codec_info fails, the functions return -ENOMEM without freeing the previously allocated instance, causing a memory leak.
Fix this by calling kfree() on the instance in this error path to ensure it is properly released.
--- drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 4 +++- drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c +3 -1
@@ -1753,8 +1753,10 @@ static int wave5_vpu_open_dec(struct file *filp)spin_lock_init (&inst->state_spinlock); inst->codec_info =kzalloc (sizeof (*inst->codec_info),GFP_KERNEL ); -if (!inst->codec_info) +if (!inst->codec_info) { +kfree (inst);return -ENOMEM ; + }v4l2_fh_init (&inst->v4l2_fh, vdev);v4l2_fh_add (&inst->v4l2_fh, filp);
drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c +3 -1
@@ -1578,8 +1578,10 @@ static int wave5_vpu_open_enc(struct file *filp) inst->ops = &wave5_vpu_enc_inst_ops; inst->codec_info =kzalloc (sizeof (*inst->codec_info),GFP_KERNEL ); -if (!inst->codec_info) +if (!inst->codec_info) { +kfree (inst);return -ENOMEM ; + }v4l2_fh_init (&inst->v4l2_fh, vdev);v4l2_fh_add (&inst->v4l2_fh, filp);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 237/781 drm/amd/display: Dont use kernel-doc comment in dc_register_software_state struct
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit b1e2a6a57aa95f8192e8edb9edaecfd326745d32 ]
Sphinx reports kernel-doc warning:
WARNING: ./drivers/gpu/drm/amd/display/dc/dc.h:2796 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst * Software state variables used to program register fields across the display pipeline
Don't use kernel-doc comment syntax to fix it.
--- drivers/gpu/drm/amd/display/dc/dc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dc.h +1 -1
@@ -2793,7 +2793,7 @@ void dc_get_underflow_debug_data_for_otg(struct dc *dc, int primary_otg_inst, stvoid dc_get_power_feature_status (struct dc *dc,int primary_otg_inst,struct power_features *out_data); -/** +/* * Software state variables used to program register fields across the display pipeline */ struct dc_register_software_state {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 238/781 drm/amdgpu: Describe @AMD_IP_BLOCK_TYPE_RAS in amd_ip_block_type enum
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
[ Upstream commit d8ccbb5e228b093eba19027a281274e7faf2da4c ]
Sphinx reports kernel-doc warning:
WARNING: ./drivers/gpu/drm/amd/include/amd_shared.h:113 Enum value 'AMD_IP_BLOCK_TYPE_RAS' not described in enum 'amd_ip_block_type'
Describe the value to fix it.
--- drivers/gpu/drm/amd/include/amd_shared.h | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/include/amd_shared.h +1 -0
@@ -89,6 +89,7 @@ enum amd_apu_flags {* @AMD_IP_BLOCK_TYPE_VPE: Video Processing Engine * @AMD_IP_BLOCK_TYPE_UMSCH_MM: User Mode Scheduler for Multimedia * @AMD_IP_BLOCK_TYPE_ISP: Image Signal Processor +* @AMD_IP_BLOCK_TYPE_RAS: Reliability, Availability, Serviceability * @AMD_IP_BLOCK_TYPE_NUM: Total number of IP block types */ enum amd_ip_block_type {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 239/781 drm/amd: Drop "amdgpu kernel modesetting enabled" message
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit 8644084a74a4573278d6f454c6638ccd5965f4e2 ]
The behavior for amdgpu was changed with commit e00e5c223878 ("drm/amdgpu: adjust drm_firmware_drivers_only() handling") to potentially allow loading even if nomodeset was set, so the message is no longer accurate.
Just drop it to avoid confusion.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +0 -1
@@ -3172,7 +3172,6 @@ static int __init amdgpu_init(void)if (r) goto error_fence; -DRM_INFO ("amdgpu kernel modesetting enabled.\n" );amdgpu_register_atpx_handler ();amdgpu_acpi_detect ();
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 240/781 drm/amdkfd: Fix signal_eviction_fence() bool return value
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 31dc58adda9874420ab8fa5a2f9c43377745753a ]
signal_eviction_fence() is declared to return bool, but returns -EINVAL when no eviction fence is present. This makes the "no fence" or "the NULL-fence" path evaluate to true and triggers a Smatch warning.
v2: Return true instead to explicitly indicate that there is no eviction fence to signal and that eviction is already complete. This matches the existing caller logic where a NULL fence means "nothing to do" and allows restore handling to proceed normally. (Christian)
Fixes the below:drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c:2099 signal_eviction_fence()
warn: '(-22)' is not bool
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_process.c
2090 static bool signal_eviction_fence(struct kfd_process *p)
^^^^
2091 {
2092 struct dma_fence *ef;
2093 bool ret;
2094
2095 rcu_read_lock();
2096 ef = dma_fence_get_rcu_safe(&p->ef);
2097 rcu_read_unlock();
2098 if (!ef)--> 2099 return -EINVAL;
This should be either true or false.
Probably true because presumably
it has been tested?
2100
2101 ret = dma_fence_check_and_signal(ef);
2102 dma_fence_put(ef);
2103
2104 return ret;
2105 }Reported by: Dan Carpenter <[email protected]>
--- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_process.c +1 -1
@@ -1996,7 +1996,7 @@ static int signal_eviction_fence(struct kfd_process *p) ef =dma_fence_get_rcu_safe (&p->ef);rcu_read_unlock ();if (!ef) -return -EINVAL ; +return true; ret =dma_fence_signal (ef);dma_fence_put (ef);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 241/781 drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit af26fa751c2eef66916acbf0d3c3e9159da56186 ]
vcn_v2_0_start_sriov() declares a local variable "i" initialized to zero and uses it only as the instance index in SOC15_REG_OFFSET(UVD, i, ...). The value is never changed and all other fields are taken from adev->vcn.inst[0], so this path only ever programs VCN instance 0.
This triggered a Smatch:
warn: iterator 'i' not incremented
Replace the dummy iterator with an explicit instance index of 0 in SOC15_REG_OFFSET() calls.
Reported by: Dan Carpenter <[email protected]>
--- drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 45 ++++++++++++++------------- 1 file changed, 23 insertions(+), 22 deletions(-)
drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c +23 -22
@@ -1964,7 +1964,8 @@ static int vcn_v2_0_start_sriov(struct amdgpu_device *adev)struct mmsch_v2_0_cmd_end end = { {0 } };struct mmsch_v2_0_init_header *header;uint32_t *init_table = adev->virt.mm_table.cpu_addr; -uint8_t i =0 ; + +/* This path only programs VCN instance 0. */ header = (struct mmsch_v2_0_init_header *)init_table; direct_wt.cmd_header.command_type =MMSCH_COMMAND__DIRECT_REG_WRITE ;
@@ -1983,93 +1984,93 @@ static int vcn_v2_0_start_sriov(struct amdgpu_device *adev) size =AMDGPU_GPU_PAGE_ALIGN (adev->vcn.inst[0 ].fw->size +4 );MMSCH_V2_0_INSERT_DIRECT_RD_MOD_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_STATUS), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_STATUS),0xFFFFFFFF ,0x00000004 );/* mc resume*/ if (adev->firmware.load_type ==AMDGPU_FW_LOAD_PSP ) {MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_VCPU_CACHE_64BIT_BAR_LOW), adev->firmware.ucode[AMDGPU_UCODE_ID_VCN ].tmr_mc_addr_lo);MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH), adev->firmware.ucode[AMDGPU_UCODE_ID_VCN ].tmr_mc_addr_hi); offset =0 ; }else {MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_VCPU_CACHE_64BIT_BAR_LOW),lower_32_bits (adev->vcn.inst->gpu_addr));MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_VCPU_CACHE_64BIT_BAR_HIGH),upper_32_bits (adev->vcn.inst->gpu_addr)); offset = size; }MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_VCPU_CACHE_OFFSET0), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_VCPU_CACHE_OFFSET0),0 );MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_VCPU_CACHE_SIZE0), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_VCPU_CACHE_SIZE0), size);MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_VCPU_CACHE1_64BIT_BAR_LOW),lower_32_bits (adev->vcn.inst->gpu_addr + offset));MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_VCPU_CACHE1_64BIT_BAR_HIGH),upper_32_bits (adev->vcn.inst->gpu_addr + offset));MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_VCPU_CACHE_OFFSET1), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_VCPU_CACHE_OFFSET1),0 );MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_VCPU_CACHE_SIZE1), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_VCPU_CACHE_SIZE1),AMDGPU_VCN_STACK_SIZE );MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_VCPU_CACHE2_64BIT_BAR_LOW),lower_32_bits (adev->vcn.inst->gpu_addr + offset +AMDGPU_VCN_STACK_SIZE ));MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_VCPU_CACHE2_64BIT_BAR_HIGH),upper_32_bits (adev->vcn.inst->gpu_addr + offset +AMDGPU_VCN_STACK_SIZE ));MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_VCPU_CACHE_OFFSET2), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_VCPU_CACHE_OFFSET2),0 );MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_VCPU_CACHE_SIZE2), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_VCPU_CACHE_SIZE2),AMDGPU_VCN_CONTEXT_SIZE );for (r =0 ; r < adev->vcn.inst[0 ].num_enc_rings; ++r) { ring = &adev->vcn.inst->ring_enc[r]; ring->wptr =0 ;MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_RB_BASE_LO), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_RB_BASE_LO),lower_32_bits (ring->gpu_addr));MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_RB_BASE_HI), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_RB_BASE_HI),upper_32_bits (ring->gpu_addr));MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_RB_SIZE), +SOC15_REG_OFFSET (UVD ,0 , mmUVD_RB_SIZE), ring->ring_size /4 ); } ring = &adev->vcn.inst->ring_dec; ring->wptr =0 ;MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_RBC_RB_64BIT_BAR_LOW),lower_32_bits (ring->gpu_addr));MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, +SOC15_REG_OFFSET (UVD ,0 , mmUVD_LMI_RBC_RB_64BIT_BAR_HIGH),upper_32_bits (ring->gpu_addr));/* force RBC into idle state */
@@ -2080,7 +2081,7 @@ static int vcn_v2_0_start_sriov(struct amdgpu_device *adev) tmp =REG_SET_FIELD (tmp,UVD_RBC_RB_CNTL ,RB_NO_UPDATE ,1 ); tmp =REG_SET_FIELD (tmp,UVD_RBC_RB_CNTL ,RB_RPTR_WR_EN ,1 );MMSCH_V2_0_INSERT_DIRECT_WT ( -SOC15_REG_OFFSET (UVD , i, mmUVD_RBC_RB_CNTL), tmp); +SOC15_REG_OFFSET (UVD ,0 , mmUVD_RBC_RB_CNTL), tmp);/* add end packet */ tmp =sizeof (struct mmsch_v2_0_cmd_end );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 242/781 drm/amd/display: Remove unused encoder types
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Lipski <[email protected]>
[ Upstream commit 4ab27b01df629545de5a5f9889867b0f19438cd8 ]
[Why&How]
We only support ENCODER_ID_INTERNAL_UNIPHY encoders now, so NUTMEG & TRAVIS can be removed from translate_encoder_to_transmitter.
Also refactor to use local variables of transmitter to exit early.
V2: Fix construct_phy check for TRANSMITTER_UKNOWN
Stable-dep-of: 436d0d22aa70 ("drm/amd/display: Pass proper DAC encoder ID to VBIOS")
--- .../drm/amd/display/dc/link/link_factory.c | 47 +++++-------------- 1 file changed, 12 insertions(+), 35 deletions(-)
drivers/gpu/drm/amd/display/dc/link/link_factory.c +12 -35
@@ -350,24 +350,6 @@ static enum transmitter translate_encoder_to_transmitter(return TRANSMITTER_UNKNOWN ; }break ; -case ENCODER_ID_EXTERNAL_NUTMEG : -switch (encoder.enum_id) { -case ENUM_ID_1 : -return TRANSMITTER_NUTMEG_CRT ; -default : -return TRANSMITTER_UNKNOWN ; - } -break ; -case ENCODER_ID_EXTERNAL_TRAVIS : -switch (encoder.enum_id) { -case ENUM_ID_1 : -return TRANSMITTER_TRAVIS_CRT ; -case ENUM_ID_2 : -return TRANSMITTER_TRAVIS_LCD ; -default : -return TRANSMITTER_UNKNOWN ; - } -break ;default :return TRANSMITTER_UNKNOWN ; }
@@ -477,14 +459,6 @@ static enum engine_id find_analog_engine(struct dc_link *link)return ENGINE_ID_UNKNOWN ; } -static bool transmitter_supported (const enum transmitter transmitter) -{ -return transmitter !=TRANSMITTER_UNKNOWN && - transmitter !=TRANSMITTER_NUTMEG_CRT && - transmitter !=TRANSMITTER_TRAVIS_CRT && - transmitter !=TRANSMITTER_TRAVIS_LCD ; -} -static bool analog_engine_supported (const enum engine_id engine_id) { return engine_id == ENGINE_ID_DACA ||
@@ -502,6 +476,8 @@ static bool construct_phy(struct dc_link *link,struct dc_bios *bios = init_params->dc->ctx->dc_bios;const struct dc_vbios_funcs *bp_funcs = bios->funcs;struct bp_disp_connector_caps_info disp_connect_caps_info = {0 }; +struct graphics_object_id link_encoder = {0 }; +enum transmitter transmitter_from_encoder;DC_LOGGER_INIT (dc_ctx->logger);
@@ -522,21 +498,21 @@ static bool construct_phy(struct dc_link *link, link->link_id = bios->funcs->get_connector_id (bios, init_params->connector_index); + link->ep_type =DISPLAY_ENDPOINT_PHY ; + +DC_LOG_DC ("BIOS object table - link_id: %d" , link->link_id.id); +/* Determine early if the link has any supported encoders, * so that we avoid initializing DDC and HPD, etc. */ - bp_funcs->get_src_obj (bios, link->link_id,0 , &enc_init_data.encoder); - enc_init_data.transmitter =translate_encoder_to_transmitter (enc_init_data.encoder); + bp_funcs->get_src_obj (bios, link->link_id,0 , &link_encoder); + transmitter_from_encoder =translate_encoder_to_transmitter (link_encoder); enc_init_data.analog_engine =find_analog_engine (link); - link->ep_type =DISPLAY_ENDPOINT_PHY ; - -DC_LOG_DC ("BIOS object table - link_id: %d" , link->link_id.id); - -if (!transmitter_supported (enc_init_data.transmitter) && +if (transmitter_from_encoder ==TRANSMITTER_UNKNOWN && !analog_engine_supported (enc_init_data.analog_engine)) {DC_LOG_WARNING ("link_id %d has unsupported encoder\n" , link->link_id.id); - goto unsupported_fail; + goto create_fail; }if (bios->funcs->get_disp_connector_caps_info) {
@@ -670,6 +646,8 @@ static bool construct_phy(struct dc_link *link, enc_init_data.connector = link->link_id; enc_init_data.channel =get_ddc_line (link); enc_init_data.hpd_source =get_hpd_line (link); + enc_init_data.transmitter = transmitter_from_encoder; + enc_init_data.encoder = link_encoder; link->hpd_src = enc_init_data.hpd_source;
@@ -806,7 +784,6 @@ static bool construct_phy(struct dc_link *link, link->hpd_gpio =NULL ; } -unsupported_fail:DC_LOG_DC ("BIOS object table - %s failed.\n" , __func__);return false; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 243/781 drm/amd/display: Use local variable for analog_engine initialization
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Lipski <[email protected]>
[ Upstream commit 6afc422e1a49d18b63f7042fb1cb6f519a972c8a ]
[Why&How]
Use local variable for analog_engine retrieval and check if it is supported instead of the struct parameter.
Stable-dep-of: 436d0d22aa70 ("drm/amd/display: Pass proper DAC encoder ID to VBIOS")
--- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/link/link_factory.c +4 -2
@@ -478,6 +478,7 @@ static bool construct_phy(struct dc_link *link,struct bp_disp_connector_caps_info disp_connect_caps_info = {0 };struct graphics_object_id link_encoder = {0 };enum transmitter transmitter_from_encoder; +enum engine_id link_analog_engine;DC_LOGGER_INIT (dc_ctx->logger);
@@ -507,10 +508,10 @@ static bool construct_phy(struct dc_link *link,*/ bp_funcs->get_src_obj (bios, link->link_id,0 , &link_encoder); transmitter_from_encoder =translate_encoder_to_transmitter (link_encoder); - enc_init_data.analog_engine =find_analog_engine (link); + link_analog_engine =find_analog_engine (link);if (transmitter_from_encoder ==TRANSMITTER_UNKNOWN && - !analog_engine_supported (enc_init_data.analog_engine)) { + !analog_engine_supported (link_analog_engine)) {DC_LOG_WARNING ("link_id %d has unsupported encoder\n" , link->link_id.id); goto create_fail; }
@@ -648,6 +649,7 @@ static bool construct_phy(struct dc_link *link, enc_init_data.hpd_source =get_hpd_line (link); enc_init_data.transmitter = transmitter_from_encoder; enc_init_data.encoder = link_encoder; + enc_init_data.analog_engine = link_analog_engine; link->hpd_src = enc_init_data.hpd_source;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 244/781 drm/amd/display: Pass proper DAC encoder ID to VBIOS
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 436d0d22aa7035a9f9b24fb14cd0e84d6571ea87 ]
Similarly to the analog_engine field, add a new analog_id field
which contains the encoder ID of the analog encoder that corresponds to the link encoder.
Previously, the default encoder ID of the link encoder was used, which meant that we passed the wrong ID in case of DVI-I.
--- drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 2 ++ drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h | 2 ++ drivers/gpu/drm/amd/display/dc/link/link_factory.c | 11 ++++++----- .../amd/display/dc/resource/dce110/dce110_resource.c | 2 ++ 4 files changed, 12 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +2 -0
@@ -850,6 +850,7 @@ void dce110_link_encoder_construct( enc110->base.funcs = &dce110_lnk_enc_funcs; enc110->base.ctx = init_data->ctx; enc110->base.id = init_data->encoder; + enc110->base.analog_id = init_data->analog_encoder; enc110->base.hpd_source = init_data->hpd_source; enc110->base.connector = init_data->connector;
@@ -1793,6 +1794,7 @@ void dce60_link_encoder_construct( enc110->base.funcs = &dce60_lnk_enc_funcs; enc110->base.ctx = init_data->ctx; enc110->base.id = init_data->encoder; + enc110->base.analog_id = init_data->analog_encoder; enc110->base.hpd_source = init_data->hpd_source; enc110->base.connector = init_data->connector;
drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h +2 -0
@@ -47,6 +47,7 @@ struct encoder_init_data {enum hpd_source_id hpd_source;/* TODO: in DAL2, here was pointer to EventManagerInterface */ struct graphics_object_id encoder; +struct graphics_object_id analog_encoder;enum engine_id analog_engine;struct dc_context *ctx;enum transmitter transmitter;
@@ -81,6 +82,7 @@ struct link_encoder {int32_t aux_channel_offset;struct dc_context *ctx;struct graphics_object_id id; +struct graphics_object_id analog_id;struct graphics_object_id connector;uint32_t output_signals;enum engine_id preferred_engine;
drivers/gpu/drm/amd/display/dc/link/link_factory.c +6 -5
@@ -433,20 +433,19 @@ static enum channel_id get_ddc_line(struct dc_link *link)return channel; } -static enum engine_id find_analog_engine (struct dc_link *link) +static enum engine_id find_analog_engine (struct dc_link *link,struct graphics_object_id *enc) {struct dc_bios *bp = link->ctx->dc_bios; -struct graphics_object_id encoder = {0 };enum bp_result bp_result =BP_RESULT_OK ;int i;for (i =0 ; i <3 ; i++) { - bp_result = bp->funcs->get_src_obj (bp, link->link_id, i, &encoder); + bp_result = bp->funcs->get_src_obj (bp, link->link_id, i, enc);if (bp_result !=BP_RESULT_OK )return ENGINE_ID_UNKNOWN ; -switch (encoder.id) { +switch (enc->id) {case ENCODER_ID_INTERNAL_DAC1 :case ENCODER_ID_INTERNAL_KLDSCP_DAC1 :return ENGINE_ID_DACA ;
@@ -456,6 +455,7 @@ static enum engine_id find_analog_engine(struct dc_link *link) } } +memset (enc,0 ,sizeof (*enc));return ENGINE_ID_UNKNOWN ; }
@@ -508,7 +508,7 @@ static bool construct_phy(struct dc_link *link,*/ bp_funcs->get_src_obj (bios, link->link_id,0 , &link_encoder); transmitter_from_encoder =translate_encoder_to_transmitter (link_encoder); - link_analog_engine =find_analog_engine (link); + link_analog_engine =find_analog_engine (link, &enc_init_data.analog_encoder);if (transmitter_from_encoder ==TRANSMITTER_UNKNOWN && !analog_engine_supported (link_analog_engine)) {
@@ -648,6 +648,7 @@ static bool construct_phy(struct dc_link *link, enc_init_data.channel =get_ddc_line (link); enc_init_data.hpd_source =get_hpd_line (link); enc_init_data.transmitter = transmitter_from_encoder; + enc_init_data.analog_engine =find_analog_engine (link, &enc_init_data.analog_encoder); enc_init_data.encoder = link_encoder; enc_init_data.analog_engine = link_analog_engine;
drivers/gpu/drm/amd/display/dc/resource/dce110/dce110_resource.c +2 -0
@@ -895,6 +895,8 @@ static void get_pixel_clock_parameters(*/ pixel_clk_params->requested_pix_clk_100hz = stream->timing.pix_clk_100hz; pixel_clk_params->encoder_object_id = stream->link->link_enc->id; +if (dc_is_rgb_signal (pipe_ctx->stream->signal)) + pixel_clk_params->encoder_object_id = stream->link->link_enc->analog_id; pixel_clk_params->signal_type = pipe_ctx->stream->signal; pixel_clk_params->controller_id = pipe_ctx->stream_res.tg->inst +1 ;/* TODO: un-hardcode*/
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 245/781 drm/amd/display: Update dc_connection_dac_load to dc_connection_analog_load
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 57c8690a84bec025a8bc22e5f867fd660c4a3e76 ]
Update to a more accurate name dc_connection_analog_load.
Stable-dep-of: 0d89268d20c9 ("drm/amd/display: Don't repeat DAC load detection")
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- drivers/gpu/drm/amd/display/dc/dc_types.h | 2 +- drivers/gpu/drm/amd/display/dc/link/link_detection.c | 8 ++++---- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -1
@@ -7434,7 +7434,7 @@ amdgpu_dm_connector_poll(struct amdgpu_dm_connector *aconnector, bool force)* * Only allow to poll such a connector again when forcing. */ -if (!force && link->local_sink && link->type == dc_connection_dac_load) +if (!force && link->local_sink && link->type == dc_connection_analog_load)return connector->status;mutex_lock (&aconnector->hpd_lock);
drivers/gpu/drm/amd/display/dc/dc_types.h +1 -1
@@ -354,7 +354,7 @@ enum dc_connection_type { dc_connection_single, dc_connection_mst_branch, dc_connection_sst_branch, - dc_connection_dac_load + dc_connection_analog_load }; struct dc_csc_adjustments {
drivers/gpu/drm/amd/display/dc/link/link_detection.c +4 -4
@@ -1176,7 +1176,7 @@ static bool detect_link_and_local_sink(struct dc_link *link,/* If we didn't do DAC load detection yet, do it now * to verify there really is a display connected. */ -if (link->type != dc_connection_dac_load && +if (link->type != dc_connection_analog_load && !link_detect_dac_load_detect (link)) {if (prev_sink)dc_sink_release (prev_sink);
@@ -1185,7 +1185,7 @@ static bool detect_link_and_local_sink(struct dc_link *link, }DC_LOG_INFO ("%s detected analog display without EDID\n" , __func__); - link->type = dc_connection_dac_load; + link->type = dc_connection_analog_load; sink->edid_caps.analog = true;break ; }
@@ -1372,7 +1372,7 @@ static bool detect_link_and_local_sink(struct dc_link *link,* @link: DC link to evaluate (must support analog signalling). * @type: Updated with the detected connection type: * dc_connection_single (analog via DDC), -* dc_connection_dac_load (via load-detect), +* dc_connection_analog_load (via load-detect), * or dc_connection_none. * * Return: true if detection completed.
@@ -1388,7 +1388,7 @@ static bool link_detect_analog(struct dc_link *link, enum dc_connection_type *ty }if (link_detect_dac_load_detect (link)) { - *type = dc_connection_dac_load; + *type = dc_connection_analog_load;return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 246/781 drm/amd/display: Dont repeat DAC load detection
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit 0d89268d20c961b6226a4aa948fdbe9f93021d95 ]
The analog link detection code path had already performed the DAC load detection by the time the EDID read is attempted. So there is no need to repeat the DAC load detection, we can know that no display is connected if no EDID is read.
--- drivers/gpu/drm/amd/display/dc/link/link_detection.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/link/link_detection.c +3 -4
@@ -1173,11 +1173,10 @@ static bool detect_link_and_local_sink(struct dc_link *link,* - cheap DVI-A cable or adapter that doesn't connect DDC */ if (dc_connector_supports_analog (link->link_id.id)) { -/* If we didn't do DAC load detection yet, do it now -* to verify there really is a display connected. +/* If we didn't already detect a display using +* DAC load detection, we know it isn't connected. */ -if (link->type != dc_connection_analog_load && - !link_detect_dac_load_detect (link)) { +if (link->type != dc_connection_analog_load) {if (prev_sink)dc_sink_release (prev_sink);link_disconnect_sink (link);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 247/781 drm/msm/disp/dpu: add merge3d support for sc7280
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahadevan P <[email protected]>
[ Upstream commit 2892de3f4f985fa779c330468e2f341fdb762ccd ]
On SC7280 targets, display modes with a width greater than the max_mixer_width (2400) are rejected during mode validation when merge3d is disabled. This limitation exists because, without a 3D merge block, two layer mixers cannot be combined(non-DSC interface), preventing large layers from being split across mixers. As a result, higher resolution modes cannot be supported.
Enable merge3d support on SC7280 to allow combining streams from two layer mixers into a single non-DSC interface. This capability removes the width restriction and enables buffer sizes beyond the 2400-pixel limit.
Patchwork: https://patchwork.freedesktop.org/patch/696713/
--- .../gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h +12 -2
@@ -13,6 +13,7 @@ static const struct dpu_caps sc7280_dpu_caps = { .has_dim_layer = true, .has_idle_pc = true, .max_linewidth = 2400, + .has_3d_merge = true, .pixel_ram_size = DEFAULT_PIXEL_RAM_SIZE, };
@@ -134,17 +135,24 @@ static const struct dpu_pingpong_cfg sc7280_pp[] = { .name = "pingpong_2", .id = PINGPONG_2, .base = 0x6b000, .len = 0, .sblk = &sc7280_pp_sblk, - .merge_3d = 0, + .merge_3d = MERGE_3D_1, .intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 10), }, { .name = "pingpong_3", .id = PINGPONG_3, .base = 0x6c000, .len = 0, .sblk = &sc7280_pp_sblk, - .merge_3d = 0, + .merge_3d = MERGE_3D_1, .intr_done = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 11), }, }; +static const struct dpu_merge_3d_cfg sc7280_merge_3d[] = { + { + .name ="merge_3d_1" , .id =MERGE_3D_1 , + .base =0x4f000 , .len =0x8 , + }, +}; +/* NOTE: sc7280 only has one DSC hard slice encoder */ static const struct dpu_dsc_cfg sc7280_dsc[] = { {
@@ -247,6 +255,8 @@ const struct dpu_mdss_cfg dpu_sc7280_cfg = { .mixer = sc7280_lm, .pingpong_count = ARRAY_SIZE(sc7280_pp), .pingpong = sc7280_pp, + .merge_3d_count = ARRAY_SIZE(sc7280_merge_3d), + .merge_3d = sc7280_merge_3d, .dsc_count = ARRAY_SIZE(sc7280_dsc), .dsc = sc7280_dsc, .wb_count = ARRAY_SIZE(sc7280_wb),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 248/781 drm/msm/dpu: Set vsync source irrespective of mdp top support
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Teguh Sobirin <[email protected]>
[ Upstream commit 1ad9880f059c9b0943e53714f9a59924cb035bbb ]
Since DPU 5.x the vsync source TE setup is split between MDP TOP and INTF blocks. Currently all code to setup vsync_source is only executed if MDP TOP implements the setup_vsync_source() callback. However on DPU >= 8.x this callback is not implemented, making DPU driver skip all vsync setup. Move the INTF part out of this condition, letting DPU driver to setup TE vsync selection on all new DPU devices.
Patchwork: https://patchwork.freedesktop.org/patch/696584/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +8 -8
@@ -785,6 +785,8 @@ static void _dpu_encoder_update_vsync_source(struct dpu_encoder_virt *dpu_enc,return ; } + vsync_cfg.vsync_source = disp_info->vsync_source; +if (hw_mdptop->ops.setup_vsync_source) {for (i =0 ; i < dpu_enc->num_phys_encs; i++) vsync_cfg.ppnumber[i] = dpu_enc->hw_pp[i]->idx;
@@ -792,17 +794,15 @@ static void _dpu_encoder_update_vsync_source(struct dpu_encoder_virt *dpu_enc, vsync_cfg.pp_count = dpu_enc->num_phys_encs; vsync_cfg.frame_rate =drm_mode_vrefresh (&dpu_enc->base.crtc->state->adjusted_mode); - vsync_cfg.vsync_source = disp_info->vsync_source; - hw_mdptop->ops.setup_vsync_source (hw_mdptop, &vsync_cfg); + } -for (i =0 ; i < dpu_enc->num_phys_encs; i++) { - phys_enc = dpu_enc->phys_encs[i]; +for (i =0 ; i < dpu_enc->num_phys_encs; i++) { + phys_enc = dpu_enc->phys_encs[i]; -if (phys_enc->has_intf_te && phys_enc->hw_intf->ops.vsync_sel) - phys_enc->hw_intf->ops.vsync_sel (phys_enc->hw_intf, - vsync_cfg.vsync_source); - } +if (phys_enc->has_intf_te && phys_enc->hw_intf->ops.vsync_sel) + phys_enc->hw_intf->ops.vsync_sel (phys_enc->hw_intf, + vsync_cfg.vsync_source); } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 249/781 drm/msm/dpu: fix WD timer handling on DPU 8.x
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 794b0e68caba49b950b42ec32e364028c2facf57 ]
Since DPU 8.x Watchdog timer settings were moved from the TOP to the INTF block. Support programming the timer in the INTF block. Fixes tag points to the commit which removed register access to those registers on DPU 8.x+ (and which also should have added proper support for WD timer on those devices).
Patchwork: https://patchwork.freedesktop.org/patch/696586/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 4 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 49 +++++++++++++++++++-- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h | 3 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c | 7 --- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h | 7 +++ 5 files changed, 57 insertions(+), 13 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +2 -2
@@ -786,13 +786,13 @@ static void _dpu_encoder_update_vsync_source(struct dpu_encoder_virt *dpu_enc, } vsync_cfg.vsync_source = disp_info->vsync_source; + vsync_cfg.frame_rate =drm_mode_vrefresh (&dpu_enc->base.crtc->state->adjusted_mode);if (hw_mdptop->ops.setup_vsync_source) {for (i =0 ; i < dpu_enc->num_phys_encs; i++) vsync_cfg.ppnumber[i] = dpu_enc->hw_pp[i]->idx; vsync_cfg.pp_count = dpu_enc->num_phys_encs; - vsync_cfg.frame_rate =drm_mode_vrefresh (&dpu_enc->base.crtc->state->adjusted_mode); hw_mdptop->ops.setup_vsync_source (hw_mdptop, &vsync_cfg); }
@@ -802,7 +802,7 @@ static void _dpu_encoder_update_vsync_source(struct dpu_encoder_virt *dpu_enc,if (phys_enc->has_intf_te && phys_enc->hw_intf->ops.vsync_sel) phys_enc->hw_intf->ops.vsync_sel (phys_enc->hw_intf, - vsync_cfg.vsync_source); + &vsync_cfg); } }
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +46 -3
73 lines not on this page · raw message
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h +2 -1
@@ -12,6 +12,7 @@#include "dpu_hw_util.h" struct dpu_hw_intf ; +struct dpu_vsync_source_cfg ;/* intf timing settings */ struct dpu_hw_intf_timing_params {
@@ -104,7 +105,7 @@ struct dpu_hw_intf_ops {int (*connect_external_te)(struct dpu_hw_intf *intf,bool enable_external_te); -void (*vsync_sel)(struct dpu_hw_intf *intf,enum dpu_vsync_source vsync_source); +void (*vsync_sel)(struct dpu_hw_intf *intf,struct dpu_vsync_source_cfg *cfg);void (*disable_autorefresh)(struct dpu_hw_intf *intf,uint32_t encoder_id,u16 vdisplay);
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c +0 -7
@@ -22,13 +22,6 @@#define TRAFFIC_SHAPER_WR_CLIENT (num) (0x060 + (num * 4))#define TRAFFIC_SHAPER_FIXPOINT_FACTOR 4 -#define MDP_TICK_COUNT 16 -#define XO_CLK_RATE 19200 -#define MS_TICKS_IN_SEC 1000 - -#define CALCULATE_WD_LOAD_VALUE (fps) \ - ((uint32_t)((MS_TICKS_IN_SEC * XO_CLK_RATE)/(MDP_TICK_COUNT * fps))) -static void dpu_hw_setup_split_pipe (struct dpu_hw_mdp *mdp,struct split_pipe_cfg *cfg) {
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h +7 -0
@@ -21,6 +21,13 @@#define TO_S15D16 (_x_)((_x_) << 7) +#define MDP_TICK_COUNT 16 +#define XO_CLK_RATE 19200 +#define MS_TICKS_IN_SEC 1000 + +#define CALCULATE_WD_LOAD_VALUE (fps) \ + ((uint32_t)((MS_TICKS_IN_SEC * XO_CLK_RATE)/(MDP_TICK_COUNT * fps))) +extern const struct dpu_csc_cfg dpu_csc_YUV2RGB_601L;extern const struct dpu_csc_cfg dpu_csc10_YUV2RGB_601L;extern const struct dpu_csc_cfg dpu_csc10_rgb2yuv_601l;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 250/781 drm/msm/dp: Update msm_dp_controller IDs for sa8775p
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mani Chandana Ballary Kuntumalla <[email protected]>
[ Upstream commit 1338e8ae4084e55c0359a79e617b2ae183d01579 ]
The Qualcomm SA8775P platform comes with 2 DisplayPort controllers for each mdss. Update controller id for DPTX0 and DPTX1 of mdss1.
Patchwork: https://patchwork.freedesktop.org/patch/690234/
--- drivers/gpu/drm/msm/dp/dp_display.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +2 -2
@@ -141,8 +141,8 @@ static const struct msm_dp_desc msm_dp_desc_glymur[] = {static const struct msm_dp_desc msm_dp_desc_sa8775p[] = { { .io_start =0x0af54000 , .id =MSM_DP_CONTROLLER_0 , .wide_bus_supported = true }, { .io_start =0x0af5c000 , .id =MSM_DP_CONTROLLER_1 , .wide_bus_supported = true }, - { .io_start =0x22154000 , .id =MSM_DP_CONTROLLER_2 , .wide_bus_supported = true }, - { .io_start =0x2215c000 , .id =MSM_DP_CONTROLLER_3 , .wide_bus_supported = true }, + { .io_start =0x22154000 , .id =MSM_DP_CONTROLLER_0 , .wide_bus_supported = true }, + { .io_start =0x2215c000 , .id =MSM_DP_CONTROLLER_1 , .wide_bus_supported = true }, {} };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 251/781 ALSA: hda - fix function names & missing function parameter
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit b47ce586300b3c2b6650f4c7ac5c0f59c6bf6f4b ]
Use the correct function names and add a function parameter description to avoid kernel-doc warnings:
hda_jack.h:97: warning: Function parameter or struct member 'cb' not
described in 'snd_hda_jack_detect_enable_callback'
hda_jack.h:97: warning: expecting prototype for snd_hda_jack_detect_enable().
Prototype was for snd_hda_jack_detect_enable_callback() instead
hda_local.h:441: warning: expecting prototype for _snd_hda_set_pin_ctl().
Prototype was for snd_hda_set_pin_ctl() instead
--- sound/hda/common/hda_jack.h | 4 ++-- sound/hda/common/hda_local.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
sound/hda/common/hda_jack.h +2 -2
@@ -82,10 +82,10 @@ snd_hda_jack_detect_enable_callback_mst(struct hda_codec *codec, hda_nid_t nid, int dev_id, hda_jack_callback_fn func);/** -* snd_hda_jack_detect_enable - enable the jack-detection +* snd_hda_jack_detect_enable_callback - enable the jack-detection * @codec: the HDA codec * @nid: pin NID to enable -* @func: callback function to register +* @cb: callback function to register * * In the case of error, the return value will be a pointer embedded with * errno. Check and handle the return value appropriately with standard
sound/hda/common/hda_local.h +1 -1
@@ -424,7 +424,7 @@ int _snd_hda_set_pin_ctl(struct hda_codec *codec, hda_nid_t pin, unsigned int val, bool cached);/** -* _snd_hda_set_pin_ctl - Set a pin-control value safely +* snd_hda_set_pin_ctl - Set a pin-control value safely * @codec: the codec instance * @pin: the pin NID to set the control * @val: the pin-control value (AC_PINCTL_* bits)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 252/781 mei: late_bind: fix struct intel_lb_component_ops kernel-doc
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit 936cae9254e55a39aeaa0c156a764d22f319338b ]
Fix kernel-doc warnings on struct intel_lb_component_ops:
Warning: include/drm/intel/intel_lb_mei_interface.h:55 Incorrect use of
kernel-doc format: * push_payload - Sends a payload to the authentication firmware
And a bunch more. There isn't really support for documenting function pointer struct members in kernel-doc, but at least reference the member properly.
--- include/drm/intel/intel_lb_mei_interface.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/drm/intel/intel_lb_mei_interface.h +2 -1
@@ -53,7 +53,8 @@ enum intel_lb_status {*/ struct intel_lb_component_ops {/** -* push_payload - Sends a payload to the authentication firmware +* @push_payload: Sends a payload to the authentication firmware +* * @dev: Device struct corresponding to the mei device * @type: Payload type (see &enum intel_lb_type) * @flags: Payload flags bitmap (e.g. %INTEL_LB_FLAGS_IS_PERSISTENT)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 253/781 spi: microchip-core: use XOR instead of ANDNOT to fix the logic
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 19a4505a7a5d4eea70f1a42d601c25d730922fdf ]
Use XOR instead of ANDNOT to fix the logic. The current approach with (foo & BAR & ~baz) is harder to process, and it proved to be wrong, than more usual pattern for the comparing misconfiguration using ((foo ^ baz) & BAR) which can be read as "find all different bits between foo and baz that are related to BAR (mask)". Besides that it makes the binary code shorter.
Function old new deltamchp_corespi_setup 103 99 -4
--- drivers/spi/spi-microchip-core-spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-microchip-core-spi.c +1 -1
@@ -161,7 +161,7 @@ static int mchp_corespi_setup(struct spi_device *spi)return -EOPNOTSUPP ; } -if (spi->mode &SPI_MODE_X_MASK & ~spi->controller->mode_bits) { +if ((spi->mode ^ spi->controller->mode_bits) &SPI_MODE_X_MASK ) {dev_err (&spi->dev,"incompatible CPOL/CPHA, must match controller's Motorola mode\n" );return -EINVAL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 254/781 regulator: core: fix locking in regulator_resolve_supply() error path
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
[ Upstream commit 497330b203d2c59c5ff3fa4c34d14494d7203bc3 ]
If late enabling of a supply regulator fails in regulator_resolve_supply(), the code currently triggers a lockdep warning:
WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596
...
Call trace:
_regulator_put+0x80/0xa0 (P)
regulator_resolve_supply+0x7cc/0xbe0
regulator_register_resolve_supply+0x28/0xb8as the regulator_list_mutex must be held when calling _regulator_put().
To solve this, simply switch to using regulator_put().
While at it, we should also make sure that no concurrent access happens to our rdev while we clear out the supply pointer. Add appropriate locking to ensure that.
While the code in question will be removed altogether in a follow-up commit, I believe it is still beneficial to have this corrected before removal for future reference.
--- drivers/regulator/core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/regulator/core.c +9 -1
@@ -2285,8 +2285,16 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)if (rdev->use_count) { ret =regulator_enable (rdev->supply);if (ret <0 ) { -_regulator_put (rdev->supply); +struct regulator *supply; + +regulator_lock_two (rdev, rdev->supply->rdev, &ww_ctx); + + supply = rdev->supply; rdev->supply =NULL ; + +regulator_unlock_two (rdev, supply->rdev, &ww_ctx); + +regulator_put (supply); goto out; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 255/781 regulator: core: move supply check earlier in set_machine_constraints()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
[ Upstream commit 86a8eeb0e913f4b6a55dabba5122098d4e805e55 ]
Since commit 98e48cd9283d ("regulator: core: resolve supply for boot-on/always-on regulators"), set_machine_constraints() can return -EPROBE_DEFER very late, after it has done a lot of work and configuration of the regulator.
This means that configuration will happen multiple times for no benefit in that case. Furthermore, this can lead to timing-dependent voltage glitches as mentioned e.g. in commit 8a866d527ac0 ("regulator:
core: Resolve supply name earlier to prevent double-init").
We can know that it's going to fail very early, in particular before going through the complete regulator configuration by moving some code around a little.
Do so to avoid re-configuring the regulator multiple times, also avoiding the voltage glitches if we can.
--- drivers/regulator/core.c | 55 ++++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 25 deletions(-)
drivers/regulator/core.c +30 -25
@@ -1444,6 +1444,33 @@ static int set_machine_constraints(struct regulator_dev *rdev)int ret =0 ;const struct regulator_ops *ops = rdev->desc->ops; +/* +* If there is no mechanism for controlling the regulator then +* flag it as always_on so we don't end up duplicating checks +* for this so much. Note that we could control the state of +* a supply to control the output on a regulator that has no +* direct control. +*/ +if (!rdev->ena_pin && !ops->enable) { +if (rdev->supply_name && !rdev->supply) +return -EPROBE_DEFER ; + +if (rdev->supply) + rdev->constraints->always_on = + rdev->supply->rdev->constraints->always_on; +else + rdev->constraints->always_on = true; + } + +/* +* If we want to enable this regulator, make sure that we know the +* supplying regulator. +*/ +if (rdev->constraints->always_on || rdev->constraints->boot_on) { +if (rdev->supply_name && !rdev->supply) +return -EPROBE_DEFER ; + } + ret =machine_constraints_voltage (rdev, rdev->constraints);if (ret !=0 )return ret;
@@ -1609,37 +1636,15 @@ static int set_machine_constraints(struct regulator_dev *rdev) } } -/* -* If there is no mechanism for controlling the regulator then -* flag it as always_on so we don't end up duplicating checks -* for this so much. Note that we could control the state of -* a supply to control the output on a regulator that has no -* direct control. -*/ -if (!rdev->ena_pin && !ops->enable) { -if (rdev->supply_name && !rdev->supply) -return -EPROBE_DEFER ; - -if (rdev->supply) - rdev->constraints->always_on = - rdev->supply->rdev->constraints->always_on; -else - rdev->constraints->always_on = true; - } -/* If the constraints say the regulator should be on at this point * and we have control then make sure it is enabled. */ if (rdev->constraints->always_on || rdev->constraints->boot_on) {bool supply_enabled = false; -/* If we want to enable this regulator, make sure that we know -* the supplying regulator. -*/ -if (rdev->supply_name && !rdev->supply) -return -EPROBE_DEFER ; - -/* If supplying regulator has already been enabled, +/* We have ensured a potential supply has been resolved above. +* +* If supplying regulator has already been enabled, * it's not intended to have use_count increment * when rdev is only boot-on. */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 256/781 regulator: core: dont ignore errors from event forwarding setup
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <[email protected]>
[ Upstream commit e23c0a59dabae9166bbea26fc05d08e7d9e900b7 ]
Receiving and forwarding critical supply events seems like they're important information and we shouldn't ignore errors occurring during registration for such events.
With this change the supply is unset on event registration failure, allowing us to potentially retry another time.
--- drivers/regulator/core.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/regulator/core.c +12 -1
@@ -2273,10 +2273,21 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)* under-voltage. */ ret =register_regulator_event_forwarding (rdev); -if (ret <0 ) +if (ret <0 ) { +struct regulator *supply; +rdev_warn (rdev,"Failed to register event forwarding: %pe\n" ,ERR_PTR (ret)); + supply = rdev->supply; + rdev->supply =NULL ; + +regulator_unlock_two (rdev, supply->rdev, &ww_ctx); + +regulator_put (supply); + goto out; + } +regulator_unlock_two (rdev, r, &ww_ctx);/* rdev->supply was created in set_supply() */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 257/781 HID: playstation: Add missing check for input_ff_create_memless
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit e6807641ac94e832988655a1c0e60ccc806b76dc ]
The ps_gamepad_create() function calls input_ff_create_memless() without verifying its return value, which can lead to incorrect behavior or potential crashes when FF effects are triggered.
Add a check for the return value of input_ff_create_memless().
--- drivers/hid/hid-playstation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/hid-playstation.c +3 -1
@@ -774,7 +774,9 @@ ps_gamepad_create(struct hid_device *hdev,#if IS_ENABLED (CONFIG_PLAYSTATION_FF )if (play_effect) {input_set_capability (gamepad,EV_FF ,FF_RUMBLE ); -input_ff_create_memless (gamepad,NULL , play_effect); + ret =input_ff_create_memless (gamepad,NULL , play_effect); +if (ret) +return ERR_PTR (ret); }#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 258/781 drm/amdgpu/ttm: Pin 4K MMIO_REMAP Singleton BO at Init v2
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit de8955508b72f8a88afc3f2cbb62334d5f79ccc3 ]
MMIO_REMAP (HDP flush page) is a hardware I/O window exposed via a PCI BAR. It must not migrate or be evicted.
Allocate a single 4 KB GEM BO in AMDGPU_GEM_DOMAIN_MMIO_REMAP during TTM initialization when the hardware exposes a remap bus address and the host page size is <= 4 KiB. Reserve the BO and pin it at the TTM level so it remains fixed for its lifetime. No CPU mapping is established here.
On teardown, reserve, unpin, and free the BO if present.
This prepares the object to be shared (e.g., via dma-buf) without triggering placement changes or no CPU-access migration
v2: Added extra NULL checks
Stable-dep-of: 96e97a562d06 ("drm/amdgpu: Drop MMIO_REMAP domain bit and keep it Internal")
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +32 -0
@@ -1820,6 +1820,10 @@ static void amdgpu_ttm_pools_fini(struct amdgpu_device *adev)* PAGE_SIZE is <= AMDGPU_GPU_PAGE_SIZE (4K). The BO is created as a regular * GEM object (amdgpu_bo_create). * +* The BO is created as a normal GEM object via amdgpu_bo_create(), then +* reserved and pinned at the TTM level (ttm_bo_pin()) so it can never be +* migrated or evicted. No CPU mapping is established here. +* * Return: * * 0 on success or intentional skip (feature not present/unsupported) * * negative errno on allocation failure
@@ -1848,7 +1852,26 @@ static int amdgpu_ttm_mmio_remap_bo_init(struct amdgpu_device *adev)if (r)return r; + r =amdgpu_bo_reserve (adev->rmmio_remap.bo, true); +if (r) + goto err_unref; + +/* +* MMIO_REMAP is a fixed I/O placement (AMDGPU_PL_MMIO_REMAP). +* Use TTM-level pin so the BO cannot be evicted/migrated, +* independent of GEM domains. This +* enforces the “fixed I/O window” +*/ +ttm_bo_pin (&adev->rmmio_remap.bo->tbo); + +amdgpu_bo_unreserve (adev->rmmio_remap.bo);return 0 ; + +err_unref: +if (adev->rmmio_remap.bo) +amdgpu_bo_unref (&adev->rmmio_remap.bo); + adev->rmmio_remap.bo =NULL ; +return r; }/**
@@ -1860,6 +1883,15 @@ static int amdgpu_ttm_mmio_remap_bo_init(struct amdgpu_device *adev)*/ static void amdgpu_ttm_mmio_remap_bo_fini (struct amdgpu_device *adev) { +struct amdgpu_bo *bo = adev->rmmio_remap.bo; + +if (!bo) +return ;/* <-- safest early exit */ + +if (!amdgpu_bo_reserve (adev->rmmio_remap.bo, true)) { +ttm_bo_unpin (&adev->rmmio_remap.bo->tbo); +amdgpu_bo_unreserve (adev->rmmio_remap.bo); + }amdgpu_bo_unref (&adev->rmmio_remap.bo); adev->rmmio_remap.bo =NULL ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 259/781 drm/amdgpu: Drop MMIO_REMAP domain bit and keep it Internal
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian König <[email protected]>
[ Upstream commit 96e97a562d067a6d867862db79864cc66aae99c2 ]
"AMDGPU_GEM_DOMAIN_MMIO_REMAP" - Never activated as UAPI and it turned out that this was to inflexible.
Allocate the MMIO_REMAP buffer object as a regular GEM BO and explicitly move it into the fixed AMDGPU_PL_MMIO_REMAP placement at the TTM level.
This avoids relying on GEM domain bits for MMIO_REMAP, keeps the placement purely internal, and makes the lifetime and pinning of the global MMIO_REMAP BO explicit. The BO is pinned in TTM so it cannot be migrated or evicted.
The corresponding free path relies on normal DRM teardown ordering, where no further user ioctls can access the global BO once TTM teardown begins.
v2 (Srini):
- Updated patch title.
- Drop use of AMDGPU_GEM_DOMAIN_MMIO_REMAP in amdgpu_ttm.c. The MMIO_REMAP domain bit is removed from UAPI, so keep the MMIO_REMAP BO allocation domain-less (bp.domain = 0) and rely on the TTM placement (AMDGPU_PL_MMIO_REMAP) for backing/pinning.
- Keep fdinfo/mem-stats visibility for MMIO_REMAP by classifying BOs based on bo->tbo.resource->mem_type == AMDGPU_PL_MMIO_REMAP, since the domain bit is removed.
v3: Squash patches #1 & #3
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 3 - drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 21 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 2 - drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 77 ++++++++++++++-------- include/uapi/drm/amdgpu_drm.h | 6 +- 5 files changed, 60 insertions(+), 49 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +0 -3
@@ -458,9 +458,6 @@ int amdgpu_gem_create_ioctl(struct drm_device *dev, void *data,/* always clear VRAM */ flags |=AMDGPU_GEM_CREATE_VRAM_CLEARED ; -if (args->in.domains &AMDGPU_GEM_DOMAIN_MMIO_REMAP ) -return -EINVAL ; -/* create a gem object to contain this object in */ if (args->in.domains & (AMDGPU_GEM_DOMAIN_GDS |AMDGPU_GEM_DOMAIN_GWS |AMDGPU_GEM_DOMAIN_OA )) {
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +10 -11
@@ -153,14 +153,6 @@ void amdgpu_bo_placement_from_domain(struct amdgpu_bo *abo, u32 domain) c++; } -if (domain &AMDGPU_GEM_DOMAIN_MMIO_REMAP ) { - places[c].fpfn =0 ; - places[c].lpfn =0 ; - places[c].mem_type =AMDGPU_PL_MMIO_REMAP ; - places[c].flags =0 ; - c++; - } -if (domain &AMDGPU_GEM_DOMAIN_GTT ) { places[c].fpfn =0 ; places[c].lpfn =0 ;
@@ -1534,8 +1526,17 @@ u64 amdgpu_bo_gpu_offset_no_check(struct amdgpu_bo *bo)*/ uint32_t amdgpu_bo_mem_stats_placement (struct amdgpu_bo *bo) { -uint32_t domain = bo->preferred_domains &AMDGPU_GEM_DOMAIN_MASK ; +u32 domain; +/* +* MMIO_REMAP is internal now, so it no longer maps from a userspace +* domain bit. Keep fdinfo/mem-stats visibility by checking the actual +* TTM placement. +*/ +if (bo->tbo.resource && bo->tbo.resource->mem_type ==AMDGPU_PL_MMIO_REMAP ) +return AMDGPU_PL_MMIO_REMAP ; + + domain = bo->preferred_domains &AMDGPU_GEM_DOMAIN_MASK ;if (!domain)return TTM_PL_SYSTEM ;
@@ -1554,8 +1555,6 @@ uint32_t amdgpu_bo_mem_stats_placement(struct amdgpu_bo *bo)return AMDGPU_PL_OA ;case AMDGPU_GEM_DOMAIN_DOORBELL :return AMDGPU_PL_DOORBELL ; -case AMDGPU_GEM_DOMAIN_MMIO_REMAP : -return AMDGPU_PL_MMIO_REMAP ;default :return TTM_PL_SYSTEM ; }
drivers/gpu/drm/amd/amdgpu/amdgpu_object.h +0 -2
@@ -168,8 +168,6 @@ static inline unsigned amdgpu_mem_type_to_domain(u32 mem_type)return AMDGPU_GEM_DOMAIN_OA ;case AMDGPU_PL_DOORBELL :return AMDGPU_GEM_DOMAIN_DOORBELL ; -case AMDGPU_PL_MMIO_REMAP : -return AMDGPU_GEM_DOMAIN_MMIO_REMAP ;default :break ; }
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +49 -28
148 lines not on this page · raw message
include/uapi/drm/amdgpu_drm.h +1 -5
@@ -105,8 +105,6 @@ extern "C" {* * %AMDGPU_GEM_DOMAIN_DOORBELL Doorbell. It is an MMIO region for * signalling user mode queues. -* -* %AMDGPU_GEM_DOMAIN_MMIO_REMAP MMIO remap page (special mapping for HDP flushing). */ #define AMDGPU_GEM_DOMAIN_CPU 0x1#define AMDGPU_GEM_DOMAIN_GTT 0x2
@@ -115,15 +113,13 @@ extern "C" {#define AMDGPU_GEM_DOMAIN_GWS 0x10#define AMDGPU_GEM_DOMAIN_OA 0x20#define AMDGPU_GEM_DOMAIN_DOORBELL 0x40 -#define AMDGPU_GEM_DOMAIN_MMIO_REMAP 0x80#define AMDGPU_GEM_DOMAIN_MASK (AMDGPU_GEM_DOMAIN_CPU | \ AMDGPU_GEM_DOMAIN_GTT | \ AMDGPU_GEM_DOMAIN_VRAM | \ AMDGPU_GEM_DOMAIN_GDS | \ AMDGPU_GEM_DOMAIN_GWS | \ AMDGPU_GEM_DOMAIN_OA | \ - AMDGPU_GEM_DOMAIN_DOORBELL | \ - AMDGPU_GEM_DOMAIN_MMIO_REMAP) + AMDGPU_GEM_DOMAIN_DOORBELL)/* Flag that CPU access will be required for the case of VRAM domain */ #define AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED (1 << 0)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 260/781 gpu: nova-core: check for overflow to DMATRFBASE1
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <[email protected]>
[ Upstream commit 5cf76277cdec872aef9ff2e9008ae129bb303787 ]
The NV_PFALCON_FALCON_DMATRFBASE/1 register pair supports DMA addresses up to 49 bits only, but the write to DMATRFBASE1 could exceed that. To mitigate, check first that the DMA address will fit.
--- drivers/gpu/nova-core/falcon.rs | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/gpu/nova-core/falcon.rs +10 -1
@@ -8,7 +8,10 @@use kernel::{ device, - dma::DmaAddress , + dma::{ +DmaAddress , +DmaMask ,// + }, io::poll::read_poll_timeout, prelude::*, sync::aref::ARef ,
@@ -472,6 +475,12 @@ fn dma_wr<F: FalconFirmware<Target = E>>(return Err (EINVAL ); } +// The DMATRFBASE/1 register pair only supports a 49-bit address. +if dma_start >DmaMask ::new ::<49 >().value () { +dev_err! (self.dev,"DMA address {:#x} exceeds 49 bits\n" , dma_start); +return Err (ERANGE ); + } +// DMA transfers can only be done in units of 256 bytes. Compute how many such transfers we // need to perform. let num_transfers = load_offsets.len.div_ceil (DMA_LEN );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 261/781 drm/msm/disp: set num_planes to 1 for interleaved YUV formats
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 6421e1c5075b7e1536a8fcbe6b4086db07103048 ]
Interleaved YUV formats use only one plane for all pixel data. Specify num_planes = 1 for those formats. This was left unnoticed since _dpu_format_populate_plane_sizes_linear() overrides layout->num_planes.
Patchwork: https://patchwork.freedesktop.org/patch/688162/
--- drivers/gpu/drm/msm/disp/mdp_format.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/disp/mdp_format.c +4 -4
@@ -479,25 +479,25 @@ static const struct msm_format mdp_formats[] = { 0, BPC8, BPC8, BPC8, C2_R_Cr, C0_G_Y, C1_B_Cb, C0_G_Y, false, CHROMA_H2V1, 4, 2, MSM_FORMAT_FLAG_YUV, - MDP_FETCH_LINEAR, 2), + MDP_FETCH_LINEAR, 1),INTERLEAVED_YUV_FMT (UYVY ,0 ,BPC8 ,BPC8 ,BPC8 , C1_B_Cb,C0_G_Y , C2_R_Cr,C0_G_Y , false,CHROMA_H2V1 ,4 ,2 ,MSM_FORMAT_FLAG_YUV , -MDP_FETCH_LINEAR ,2 ), +MDP_FETCH_LINEAR ,1 ),INTERLEAVED_YUV_FMT (YUYV ,0 ,BPC8 ,BPC8 ,BPC8 ,C0_G_Y , C1_B_Cb,C0_G_Y , C2_R_Cr, false,CHROMA_H2V1 ,4 ,2 ,MSM_FORMAT_FLAG_YUV , -MDP_FETCH_LINEAR ,2 ), +MDP_FETCH_LINEAR ,1 ),INTERLEAVED_YUV_FMT (YVYU ,0 ,BPC8 ,BPC8 ,BPC8 ,C0_G_Y , C2_R_Cr,C0_G_Y , C1_B_Cb, false,CHROMA_H2V1 ,4 ,2 ,MSM_FORMAT_FLAG_YUV , -MDP_FETCH_LINEAR ,2 ), +MDP_FETCH_LINEAR ,1 ),/* 3 plane YUV */ PLANAR_YUV_FMT(YUV420,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 262/781 drm/msm/dpu: drop intr_start from DPU 3.x catalog files
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit f4a8e3a34ea4129c743c0d1d050b91b6511abf11 ]
DPU 3.x don't have separate intr_start interrupt, drop it from catalog files.
Patchwork: https://patchwork.freedesktop.org/patch/696488/
--- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h | 5 ----- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h | 5 ----- drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h | 5 ----- 3 files changed, 15 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h +0 -5
@@ -42,24 +42,19 @@ static const struct dpu_ctl_cfg msm8998_ctl[] = { .name = "ctl_0", .id = CTL_0, .base = 0x1000, .len = 0x94, .features = BIT(DPU_CTL_SPLIT_DISPLAY), - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9), }, { .name = "ctl_1", .id = CTL_1, .base = 0x1200, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10), }, { .name = "ctl_2", .id = CTL_2, .base = 0x1400, .len = 0x94, .features = BIT(DPU_CTL_SPLIT_DISPLAY), - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11), }, { .name = "ctl_3", .id = CTL_3, .base = 0x1600, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12), }, { .name = "ctl_4", .id = CTL_4, .base = 0x1800, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13), }, };
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h +0 -5
@@ -37,24 +37,19 @@ static const struct dpu_ctl_cfg sdm660_ctl[] = { .name = "ctl_0", .id = CTL_0, .base = 0x1000, .len = 0x94, .features = BIT(DPU_CTL_SPLIT_DISPLAY), - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9), }, { .name = "ctl_1", .id = CTL_1, .base = 0x1200, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10), }, { .name = "ctl_2", .id = CTL_2, .base = 0x1400, .len = 0x94, .features = BIT(DPU_CTL_SPLIT_DISPLAY), - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11), }, { .name = "ctl_3", .id = CTL_3, .base = 0x1600, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12), }, { .name = "ctl_4", .id = CTL_4, .base = 0x1800, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13), }, };
drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h +0 -5
@@ -36,24 +36,19 @@ static const struct dpu_ctl_cfg sdm630_ctl[] = { .name = "ctl_0", .id = CTL_0, .base = 0x1000, .len = 0x94, .features = BIT(DPU_CTL_SPLIT_DISPLAY), - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 9), }, { .name = "ctl_1", .id = CTL_1, .base = 0x1200, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 10), }, { .name = "ctl_2", .id = CTL_2, .base = 0x1400, .len = 0x94, .features = BIT(DPU_CTL_SPLIT_DISPLAY), - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 11), }, { .name = "ctl_3", .id = CTL_3, .base = 0x1600, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 12), }, { .name = "ctl_4", .id = CTL_4, .base = 0x1800, .len = 0x94, - .intr_start = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR2, 13), }, };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 263/781 drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 59ca3d11f5311d9167015fe4f431701614ae0048 ]
DPU units before 4.x don't have a separate CTL_START IRQ to mark the begin of the data transfer. In such a case, wait for the frame transfer to complete rather than trying to wait for the CTL_START interrupt (and obviously hitting the timeout).
Patchwork: https://patchwork.freedesktop.org/patch/696490/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +4 -3
@@ -681,10 +681,11 @@ static int dpu_encoder_phys_cmd_wait_for_commit_done(if (!dpu_encoder_phys_cmd_is_master (phys_enc))return 0 ; -if (phys_enc->hw_ctl->ops.is_started (phys_enc->hw_ctl)) -return dpu_encoder_phys_cmd_wait_for_tx_complete (phys_enc); +if (phys_enc->irq[INTR_IDX_CTL_START ] && + !phys_enc->hw_ctl->ops.is_started (phys_enc->hw_ctl)) +return _dpu_encoder_phys_cmd_wait_for_ctl_start (phys_enc); -return _dpu_encoder_phys_cmd_wait_for_ctl_start (phys_enc); +return dpu_encoder_phys_cmd_wait_for_tx_complete (phys_enc); } static void dpu_encoder_phys_cmd_handle_post_kickoff(
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 264/781 drm/msm/dsi_phy_14nm: convert from divider_round_rate() to divider_determine_rate()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Masney <[email protected]>
[ Upstream commit 1d232f793d4dbffd329ad48b52954d4c8ca24db5 ]
The divider_round_rate() function is now deprecated, so let's migrate to divider_determine_rate() instead so that this deprecated API can be removed.
Note that when the main function itself was migrated to use determine_rate, this was mistakenly converted to:
req->rate = divider_round_rate(...)
This is invalid in the case when an error occurs since it can set the rate to a negative value.
Patchwork: https://patchwork.freedesktop.org/patch/697613/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c +1 -6
@@ -628,12 +628,7 @@ static int dsi_pll_14nm_postdiv_determine_rate(struct clk_hw *hw,DBG ("DSI%d PLL parent rate=%lu" , pll_14nm->phy->id, req->rate); - req->rate =divider_round_rate (hw, req->rate, &req->best_parent_rate, -NULL , - postdiv->width, - postdiv->flags); - -return 0 ; +return divider_determine_rate (hw, req,NULL , postdiv->width, postdiv->flags); } static int dsi_pll_14nm_postdiv_set_rate(struct clk_hw *hw, unsigned long rate,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 265/781 accel/amdxdna: Fix notifier_wq flushing warning
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit b36178488d479e9a53bbef2b01280378b5586e60 ]
Create notifier_wq with WQ_MEM_RECLAIM flag to fix the possible warning.
workqueue: WQ_MEM_RECLAIM amdxdna_js:drm_sched_free_job_work [gpu_sched] is flushing !WQ_MEM_RECLAIM notifier_wq:0x0
--- drivers/accel/amdxdna/amdxdna_pci_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accel/amdxdna/amdxdna_pci_drv.c +1 -1
@@ -282,7 +282,7 @@ static int amdxdna_probe(struct pci_dev *pdev, const struct pci_device_id *id)fs_reclaim_release (GFP_KERNEL ); } - xdna->notifier_wq =alloc_ordered_workqueue ("notifier_wq" ,0 ); + xdna->notifier_wq =alloc_ordered_workqueue ("notifier_wq" ,WQ_MEM_RECLAIM );if (!xdna->notifier_wq)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 266/781 drm/msm: Fix x2-85 TPL1_DBG_ECO_CNTL1
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 56cd8adff8cbe82a13a1db998f1353d68ed84305 ]
We actually need to set b26, just claiming to do so is not enough :-)
Patchwork: https://patchwork.freedesktop.org/patch/697778/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_catalog.c +1 -1
@@ -1689,7 +1689,7 @@ static const struct adreno_reglist_pipe x285_nonctxt_regs[] = { { REG_A7XX_SP_READ_SEL, 0x0001ff00, BIT(PIPE_NONE) }, { REG_A6XX_TPL1_DBG_ECO_CNTL, 0x10000000, BIT(PIPE_NONE) },/* BIT(26): Disable final clamp for bicubic filtering */ - { REG_A6XX_TPL1_DBG_ECO_CNTL1, 0x00000720, BIT(PIPE_NONE) }, + { REG_A6XX_TPL1_DBG_ECO_CNTL1, 0x04000720, BIT(PIPE_NONE) }, { REG_A6XX_UCHE_MODE_CNTL, 0x80080000, BIT(PIPE_NONE) }, { REG_A8XX_UCHE_CCHE_MODE_CNTL, 0x00001000, BIT(PIPE_NONE) }, { REG_A8XX_UCHE_CCHE_CACHE_WAYS, 0x00000800, BIT(PIPE_NONE) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 267/781 drm/msm: Fix GMEM_BASE for gen8
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit dc220915ddb2d1c646a7d0816b398e73ed5a5d50 ]
This should also be zero for gen8. This does change a7xx-gen1 to zero. It was almost certainly incorrect before, but we have no such devices in CI currently.
Patchwork: https://patchwork.freedesktop.org/patch/697779/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +1 -2
@@ -376,8 +376,7 @@ int adreno_get_param(struct msm_gpu *gpu, struct msm_context *ctx, *value = adreno_gpu->info->gmem;return 0 ;case MSM_PARAM_GMEM_BASE : -if (adreno_is_a650_family (adreno_gpu) || -adreno_is_a740_family (adreno_gpu)) +if (adreno_gpu->info->family >=ADRENO_6XX_GEN4 ) *value =0 ;else *value =0x100000 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 268/781 media: ccs: Accommodate C-PHY into the calculation
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Heidelberg <[email protected]>
[ Upstream commit 3085977e734dab74adebb1dda195befce25addff ]
We need to set correct mode for PLL to calculate correct frequency. Signalling mode is known at this point, so use it for that.
--- drivers/media/i2c/ccs/ccs-core.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/media/i2c/ccs/ccs-core.c +15 -1
@@ -3425,7 +3425,21 @@ static int ccs_probe(struct i2c_client *client) sensor->scale_m =CCS_LIM (sensor,SCALER_N_MIN );/* prepare PLL configuration input values */ - sensor->pll.bus_type =CCS_PLL_BUS_TYPE_CSI2_DPHY ; +switch (sensor->hwcfg.csi_signalling_mode) { +case CCS_CSI_SIGNALING_MODE_CSI_2_CPHY : + sensor->pll.bus_type =CCS_PLL_BUS_TYPE_CSI2_CPHY ; +break ; +case CCS_CSI_SIGNALING_MODE_CSI_2_DPHY : +case SMIAPP_CSI_SIGNALLING_MODE_CCP2_DATA_CLOCK : +case SMIAPP_CSI_SIGNALLING_MODE_CCP2_DATA_STROBE : + sensor->pll.bus_type =CCS_PLL_BUS_TYPE_CSI2_DPHY ; +break ; +default : +dev_err (&client->dev,"unsupported signalling mode %u\n" , + sensor->hwcfg.csi_signalling_mode); + rval = -EINVAL ; + goto out_cleanup; + } sensor->pll.csi2.lanes = sensor->hwcfg.lanes;if (CCS_LIM (sensor,CLOCK_CALCULATION ) &CCS_CLOCK_CALCULATION_LANE_SPEED ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 269/781 drm/msm/a2xx: fix pixel shader start on A225
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 6a7b0a670ba4d283285d76d45233cbecc5af5e40 ]
A225 has a different PixelShader start address, write correct address while initializing GPU.
Patchwork: https://patchwork.freedesktop.org/patch/689906/
Message-ID: <[email protected]>
--- drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a2xx_gpu.c +4 -1
@@ -77,7 +77,10 @@ static bool a2xx_me_init(struct msm_gpu *gpu)/* Vertex and Pixel Shader Start Addresses in instructions * (3 DWORDS per instruction) */ -OUT_RING (ring,0x80000180 ); +if (adreno_is_a225 (adreno_gpu)) +OUT_RING (ring,0x80000300 ); +else +OUT_RING (ring,0x80000180 );/* Maximum Contexts */ OUT_RING (ring,0x00000001 );/* Write Confirm Interval and The CP will wait the
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 270/781 drm/buddy: release free_trees array on buddy mm teardown
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michał Grzelak <[email protected]>
[ Upstream commit 7d0507772406e129329983b8b807e5b499bd74fd ]
During initialization of DRM buddy memory manager at drm_buddy_init, mm->free_trees array is allocated for both clear and dirty RB trees. During cleanup happening at drm_buddy_fini it is never freed, leading to following memory leaks observed on xe module load & unload cycles:
kmemleak_alloc+0x4a/0x90
__kmalloc_cache_noprof+0x488/0x800
drm_buddy_init+0xc2/0x330 [drm_buddy]
__xe_ttm_vram_mgr_init+0xc3/0x190 [xe]
xe_ttm_stolen_mgr_init+0xf5/0x9d0 [xe]
xe_device_probe+0x326/0x9e0 [xe]
xe_pci_probe+0x39a/0x610 [xe]
local_pci_probe+0x47/0xb0
pci_device_probe+0xf3/0x260
really_probe+0xf1/0x3c0
__driver_probe_device+0x8c/0x180
driver_probe_device+0x24/0xd0
__driver_attach+0x10f/0x220
bus_for_each_dev+0x7f/0xe0
driver_attach+0x1e/0x30
bus_add_driver+0x151/0x290Deallocate array for free trees when cleaning up buddy memory manager in the same way as if going through out_free_tree label.
--- drivers/gpu/drm/drm_buddy.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_buddy.c +1 -0
@@ -420,6 +420,7 @@ void drm_buddy_fini(struct drm_buddy *mm)for_each_free_tree (i)kfree (mm->free_trees[i]); +kfree (mm->free_trees);kfree (mm->roots); }EXPORT_SYMBOL (drm_buddy_fini);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 271/781 drm/hisilicon/hibmc: fix dp probabilistical detect errors after HPD irq
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baihan Li <[email protected]>
[ Upstream commit 3906e7a3b26d683868704fe262db443207f392fe ]
The issue is that drm_connector_helper_detect_from_ddc() returns wrong status when plugging or unplugging the monitor, which may cause the link failed err.[0] Use HPD pin status in DP's detect_ctx() for real physical monitor in/out, and implement a complete DP detection including read DPCD, check if it's a branch device and its sink count for different situations.
[0]:
hibme-drm 0000:83:00.0: [drm] *ERROR* channel equalization failed 5 times hibme-drm 0000:83:00.0: [drm] *ERROR* channel equalization failed 5 times hibme-drm 0000:83:00.0: [drm] *ERROR* dp link training failed, ret: -16 hibmc-drm 0000:83:00.0: [drm] *ERROR* hibme dp mode set failed: -16
--- drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 4 ++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 19 +++++++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 6 +++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 3 ++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 52 +++++++++++++++++-- 5 files changed, 80 insertions(+), 4 deletions(-)
drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h +4 -0
@@ -40,6 +40,10 @@ struct hibmc_dp_dev {struct mutex lock;/* protects concurrent RW in hibmc_dp_reg_write_field() */ struct hibmc_dp_link link;u8 dpcd[DP_RECEIVER_CAP_SIZE ]; +u8 downstream_ports[DP_MAX_DOWNSTREAM_PORTS ]; +struct drm_dp_desc desc; +bool is_branch; +int hpd_status;void __iomem *serdes_base; };
drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +19 -0
@@ -2,6 +2,7 @@// Copyright (c) 2024 Hisilicon Limited. #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/delay.h> #include "dp_config.h" #include "dp_comm.h"
@@ -305,3 +306,21 @@ void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg)hibmc_dp_reg_write_field (dp_dev,HIBMC_DP_COLOR_BAR_CTRL ,BIT (0 ), cfg->enable);writel (HIBMC_DP_SYNC_EN_MASK , dp_dev->base +HIBMC_DP_TIMING_SYNC_CTRL ); } + +bool hibmc_dp_check_hpd_status (struct hibmc_dp *dp,int exp_status) +{ +u32 status; +int ret; + + ret =readl_poll_timeout (dp->dp_dev->base +HIBMC_DP_HPD_STATUS , status, +FIELD_GET (HIBMC_DP_HPD_CUR_STATE , status) == exp_status, +1000 ,100000 );/* DP spec says 100ms */ +if (ret) { +drm_dbg_dp (dp->drm_dev,"wait hpd status timeout" ); +return false; + } + + dp->dp_dev->hpd_status = exp_status; + +return true; +}
drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h +6 -0
@@ -14,6 +14,11 @@struct hibmc_dp_dev ; +enum hibmc_hpd_status { +HIBMC_HPD_OUT , +HIBMC_HPD_IN , +}; +enum hibmc_dp_cbar_pattern {CBAR_COLOR_BAR ,CBAR_WHITE ,
@@ -60,5 +65,6 @@ void hibmc_dp_reset_link(struct hibmc_dp *dp);void hibmc_dp_hpd_cfg (struct hibmc_dp *dp);void hibmc_dp_enable_int (struct hibmc_dp *dp);void hibmc_dp_disable_int (struct hibmc_dp *dp); +bool hibmc_dp_check_hpd_status (struct hibmc_dp *dp,int exp_status);#endif
drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h +3 -0
@@ -24,6 +24,9 @@#define HIBMC_DP_CFG_AUX_READY_DATA_BYTE GENMASK(16, 12)#define HIBMC_DP_CFG_AUX GENMASK(24, 17) +#define HIBMC_DP_HPD_STATUS 0x98 +#define HIBMC_DP_HPD_CUR_STATE GENMASK(7, 4) +#define HIBMC_DP_PHYIF_CTRL0 0xa0#define HIBMC_DP_CFG_SCRAMBLE_EN BIT(0)#define HIBMC_DP_CFG_PAT_SEL GENMASK(7, 4)
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c +48 -4
85 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 272/781 drm/hisilicon/hibmc: add dp mode valid check
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baihan Li <[email protected]>
[ Upstream commit 607805abfb747b98f43aa57d6d9ba4caed4d106f ]
If DP is connected, check the DP BW in mode_valid_ctx() to ensure that DP's link rate supports high-resolution data transmission.
--- .../gpu/drm/hisilicon/hibmc/dp/dp_config.h | 2 ++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 10 ++++++++++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 2 ++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 19 +++++++++++++++++++ 4 files changed, 33 insertions(+)
drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h +2 -0
@@ -17,5 +17,7 @@#define HIBMC_DP_LINK_RATE_CAL 27#define HIBMC_DP_SYNC_DELAY (lanes) ((lanes) == 0x2 ? 86 : 46)#define HIBMC_DP_INT_ENABLE 0xc +/* HIBMC_DP_LINK_RATE_CAL * 10000 * 80% = 216000 */ +#define DP_MODE_VALI_CAL 216000#endif
drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +10 -0
@@ -264,6 +264,16 @@ void hibmc_dp_reset_link(struct hibmc_dp *dp) dp->dp_dev->link.status.channel_equalized = false; } +u8 hibmc_dp_get_link_rate (struct hibmc_dp *dp) +{ +return dp->dp_dev->link.cap.link_rate; +} + +u8 hibmc_dp_get_lanes (struct hibmc_dp *dp) +{ +return dp->dp_dev->link.cap.lanes; +} +static const struct hibmc_dp_color_raw g_rgb_raw[] = { {CBAR_COLOR_BAR ,0x000 ,0x000 ,0x000 }, {CBAR_WHITE ,0xfff ,0xfff ,0xfff },
drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h +2 -0
@@ -66,5 +66,7 @@ void hibmc_dp_hpd_cfg(struct hibmc_dp *dp);void hibmc_dp_enable_int (struct hibmc_dp *dp);void hibmc_dp_disable_int (struct hibmc_dp *dp);bool hibmc_dp_check_hpd_status (struct hibmc_dp *dp,int exp_status); +u8 hibmc_dp_get_link_rate (struct hibmc_dp *dp); +u8 hibmc_dp_get_lanes (struct hibmc_dp *dp);#endif
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c +19 -0
@@ -13,6 +13,7 @@#include "hibmc_drm_drv.h" #include "dp/dp_hw.h" #include "dp/dp_comm.h" +#include "dp/dp_config.h" #define DP_MASKED_SINK_HPD_PLUG_INT BIT(2)
@@ -81,9 +82,27 @@ static int hibmc_dp_detect(struct drm_connector *connector,return connector_status_disconnected; } +static int hibmc_dp_mode_valid (struct drm_connector *connector, +const struct drm_display_mode *mode, +struct drm_modeset_acquire_ctx *ctx, +enum drm_mode_status *status) +{ +struct hibmc_dp *dp =to_hibmc_dp (connector); +u64 cur_val, max_val; + +/* check DP link BW */ + cur_val = (u64 )mode->clock *HIBMC_DP_BPP ; + max_val = (u64 )hibmc_dp_get_link_rate (dp) *DP_MODE_VALI_CAL *hibmc_dp_get_lanes (dp); + + *status = cur_val > max_val ?MODE_CLOCK_HIGH :MODE_OK ; + +return 0 ; +} +static const struct drm_connector_helper_funcs hibmc_dp_conn_helper_funcs = { .get_modes = hibmc_dp_connector_get_modes, .detect_ctx = hibmc_dp_detect, + .mode_valid_ctx = hibmc_dp_mode_valid, };static int hibmc_dp_late_register (struct drm_connector *connector)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 273/781 drm/hisilicon/hibmc: fix no showing problem with loading hibmc manually
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baihan Li <[email protected]>
[ Upstream commit 0607052a6aee1e3d218a99fae70ba9f14b3b47ed ]
When using command rmmod and insmod, there is no showing in second time insmoding. Because DP controller won't send HPD signals, if connection doesn't change or controller isn't reset. So add reset before unreset in hibmc_dp_hw_init().
And also need to move the HDCP cfg after DP controller de-resets, so that HDCP configuration takes effect.
--- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +5 -2
@@ -177,13 +177,16 @@ int hibmc_dp_hw_init(struct hibmc_dp *dp) dp_dev->link.cap.lanes =0x2 ; dp_dev->link.cap.link_rate =DP_LINK_BW_8_1 ; -/* hdcp data */ -writel (HIBMC_DP_HDCP , dp_dev->base +HIBMC_DP_HDCP_CFG );/* int init */ writel (0 , dp_dev->base +HIBMC_DP_INTR_ENABLE );writel (HIBMC_DP_INT_RST , dp_dev->base +HIBMC_DP_INTR_ORIGINAL_STATUS );/* rst */ +writel (0 , dp_dev->base +HIBMC_DP_DPTX_RST_CTRL ); +usleep_range (30 ,50 ); +/* de-rst */ writel (HIBMC_DP_DPTX_RST , dp_dev->base +HIBMC_DP_DPTX_RST_CTRL ); +/* hdcp data */ +writel (HIBMC_DP_HDCP , dp_dev->base +HIBMC_DP_HDCP_CFG );/* clock enable */ writel (HIBMC_DP_CLK_EN , dp_dev->base +HIBMC_DP_DPTX_CLK_CTRL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 274/781 drm/hisilicon/hibmc: Adding reset colorbar cfg in dp init.
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baihan Li <[email protected]>
[ Upstream commit 6dad7fa8581e96321ec8a6a4f8160762466f539a ]
Add colorbar disable operation before reset chontroller, to make sure colorbar status is clear in the DP init, so if rmmod the driver and the previous colorbar configuration will not affect the next time insmod the driver.
--- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +2 -0
@@ -180,6 +180,8 @@ int hibmc_dp_hw_init(struct hibmc_dp *dp)/* int init */ writel (0 , dp_dev->base +HIBMC_DP_INTR_ENABLE );writel (HIBMC_DP_INT_RST , dp_dev->base +HIBMC_DP_INTR_ORIGINAL_STATUS ); +/* clr colorbar */ +writel (0 , dp_dev->base +HIBMC_DP_COLOR_BAR_CTRL );/* rst */ writel (0 , dp_dev->base +HIBMC_DP_DPTX_RST_CTRL );usleep_range (30 ,50 );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 275/781 drm/rockchip: dw_hdmi_qp: Fix RK3576 HPD interrupt handling
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 5f7be8afc40c5ccf1be0410514703e50a49532c0 ]
The threaded interrupt handler on RK3576 checks HPD IRQ status before deciding to continue with interrupt clearing and unmasking.
This is not only redundant, since a similar verification has been already performed by the hard IRQ handler before masking the interrupt, but is also error prone, because it might happen that hardware clears the status register right after the masking operation completes, and before the threaded handler reads its value.
The consequence is that HPD IRQ gets never unmasked, which breaks hotplug detection until reloading the driver or rebooting the system.
Drop the unnecessary verification of the HPD interrupt status from the threaded interrupt handler.
--- drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c +1 -6
@@ -280,12 +280,7 @@ static irqreturn_t dw_hdmi_qp_rk3576_hardirq(int irq, void *dev_id)static irqreturn_t dw_hdmi_qp_rk3576_irq (int irq,void *dev_id) {struct rockchip_hdmi_qp *hdmi = dev_id; -u32 intr_stat, val; - -regmap_read (hdmi->regmap,RK3576_IOC_HDMI_HPD_STATUS , &intr_stat); - -if (!intr_stat) -return IRQ_NONE ; +u32 val; val =FIELD_PREP_WM16 (RK3576_HDMI_HPD_INT_CLR ,1 );regmap_write (hdmi->regmap,RK3576_IOC_MISC_CON0 , val);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 276/781 rust: pwm: Fix potential memory leak on init error
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kari Argillander <[email protected]>
[ Upstream commit a2633dc243c35754a0c2270131d8a199c987c9bf ]
When initializing a PWM chip using pwmchip_alloc(), the allocated device owns an initial reference that must be released on all error paths.
If __pinned_init() were to fail, the allocated pwm_chip would currently leak because the error path returns without calling pwmchip_put().
--- rust/kernel/pwm.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
rust/kernel/pwm.rs +5 -1
@@ -601,7 +601,11 @@ pub fn new(let drvdata_ptr =unsafe { bindings::pwmchip_get_drvdata (c_chip_ptr) };// SAFETY: We construct the `T` object in-place in the allocated private memory. -unsafe { data.__pinned_init (drvdata_ptr.cast ())? }; +unsafe { data.__pinned_init (drvdata_ptr.cast ()) }.inspect_err (|_| { +// SAFETY: It is safe to call `pwmchip_put()` with a valid pointer obtained +// from `pwmchip_alloc()`. We will not use pointer after this. +unsafe { bindings::pwmchip_put (c_chip_ptr) } + })?;// SAFETY: `c_chip_ptr` points to a valid chip. unsafe {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 277/781 drm/amd/pm: Fix unneeded semicolon warning
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 05138e8ff287188be7b1bedf022c8b4fd1f09a25 ]
Fix the warning reported. drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c:909:3-4: Unneeded semicolon
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c +1 -1
@@ -922,7 +922,7 @@ void smu_v13_0_12_get_gpu_metrics(struct smu_context *smu, void **table, gpu_metrics->gfx_below_host_limit_total_acc [i] =SMUQ10_ROUND ( metrics->GfxclkBelowHostLimitTotalAcc[inst]); - }; + } } gpu_metrics->xgmi_link_width = metrics->XgmiWidth;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 278/781 drm/msm/mdss: correct HBB programmed on UBWC 5.x and 6.x devices
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit e6177c7a2401b87b016728b75992926971d871fc ]
As in the previous generations, on UBWC 5.x and 6.x devices the Highest Bank Bit value should be programmed into the hardware with the offset of -13. Correct the value written into the register to prevent unpredictable results.
Patchwork: https://patchwork.freedesktop.org/patch/699274/
--- drivers/gpu/drm/msm/msm_mdss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_mdss.c +1 -1
@@ -229,7 +229,7 @@ static void msm_mdss_setup_ubwc_dec_50(struct msm_mdss *msm_mdss) {const struct qcom_ubwc_cfg_data *data = msm_mdss->mdss_data;u32 value =MDSS_UBWC_STATIC_UBWC_SWIZZLE (data->ubwc_swizzle) | -MDSS_UBWC_STATIC_HIGHEST_BANK_BIT (data->highest_bank_bit); +MDSS_UBWC_STATIC_HIGHEST_BANK_BIT (data->highest_bank_bit -13 );if (data->ubwc_bank_spread) value |=MDSS_UBWC_STATIC_UBWC_BANK_SPREAD ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 279/781 drm/msm/dpu: offset HBB values written to DPU by -13
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7ead14d4b9742b5ed244f35b999f0fe26dc23586 ]
As in all other places, the Highest Bank Bit value should be programmed into the hardware with the offset of -13. Correct the value written into the register to prevent unpredictable results.
Patchwork: https://patchwork.freedesktop.org/patch/699276/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c +6 -4
@@ -270,30 +270,32 @@ static void dpu_hw_sspp_setup_format(struct dpu_sw_pipe *pipe, ((fmt->bpp -1 ) <<9 );if (fmt->fetch_mode !=MDP_FETCH_LINEAR ) { +u32 hbb = ctx->ubwc->highest_bank_bit -13 ; +if (MSM_FORMAT_IS_UBWC (fmt)) opmode |=MDSS_MDP_OP_BWC_EN ; src_format |= (fmt->fetch_mode &3 ) <<30 ;/*FRAME_FORMAT */ DPU_REG_WRITE (c,SSPP_FETCH_CONFIG ,DPU_FETCH_CONFIG_RESET_VALUE | - ctx->ubwc->highest_bank_bit <<18 ); + hbb <<18 );switch (ctx->ubwc->ubwc_enc_version) {case UBWC_1_0 : fast_clear = fmt->alpha_enable ?BIT (31 ) :0 ;DPU_REG_WRITE (c,SSPP_UBWC_STATIC_CTRL , fast_clear | (ctx->ubwc->ubwc_swizzle &0x1 ) |BIT (8 ) | - (ctx->ubwc->highest_bank_bit <<4 )); + (hbb <<4 ));break ;case UBWC_2_0 : fast_clear = fmt->alpha_enable ?BIT (31 ) :0 ;DPU_REG_WRITE (c,SSPP_UBWC_STATIC_CTRL , fast_clear | (ctx->ubwc->ubwc_swizzle) | - (ctx->ubwc->highest_bank_bit <<4 )); + (hbb <<4 ));break ;case UBWC_3_0 :DPU_REG_WRITE (c,SSPP_UBWC_STATIC_CTRL ,BIT (30 ) | (ctx->ubwc->ubwc_swizzle) | - (ctx->ubwc->highest_bank_bit <<4 )); + (hbb <<4 ));break ;case UBWC_4_0 : DPU_REG_WRITE(c, SSPP_UBWC_STATIC_CTRL,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 280/781 drm/msm/dpu: program correct register for UBWC config on DPU 8.x+
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 5dcec3fc1311c277369a4bdf8b292781e5cc91fd ]
Since DPU 8.0 there is a separate register for the second rectangle, which needs to be programmed with the UBWC config if multirect is being used. Write pipe's UBWC configuration to the correct register.
Patchwork: https://patchwork.freedesktop.org/patch/699277/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c | 25 ++++++++++++++++----- 1 file changed, 19 insertions(+), 6 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c +19 -6
@@ -72,6 +72,8 @@#define SSPP_EXCL_REC_XY_REC1 0x188#define SSPP_EXCL_REC_SIZE 0x1B4#define SSPP_EXCL_REC_XY 0x1B8 +#define SSPP_UBWC_STATIC_CTRL_REC1 0x1c0 +#define SSPP_UBWC_ERROR_STATUS_REC1 0x1c8#define SSPP_CLK_CTRL 0x330/* SSPP_SRC_OP_MODE & OP_MODE_REC1 */
@@ -215,7 +217,7 @@ static void dpu_hw_sspp_setup_format(struct dpu_sw_pipe *pipe,u32 chroma_samp, unpack, src_format;u32 opmode =0 ;u32 fast_clear =0 ; -u32 op_mode_off, unpack_pat_off, format_off; +u32 op_mode_off, unpack_pat_off, format_off, ubwc_ctrl_off, ubwc_error_off;if (!ctx || !fmt)return ;
@@ -225,10 +227,21 @@ static void dpu_hw_sspp_setup_format(struct dpu_sw_pipe *pipe, op_mode_off =SSPP_SRC_OP_MODE ; unpack_pat_off =SSPP_SRC_UNPACK_PATTERN ; format_off =SSPP_SRC_FORMAT ; + ubwc_ctrl_off =SSPP_UBWC_STATIC_CTRL ; + ubwc_error_off =SSPP_UBWC_ERROR_STATUS ; }else { op_mode_off =SSPP_SRC_OP_MODE_REC1 ; unpack_pat_off =SSPP_SRC_UNPACK_PATTERN_REC1 ; format_off =SSPP_SRC_FORMAT_REC1 ; + +/* reg wasn't present before DPU 8.0 */ +if (ctx->mdss_ver->core_major_ver >=8 ) { + ubwc_ctrl_off =SSPP_UBWC_STATIC_CTRL_REC1 ; + ubwc_error_off =SSPP_UBWC_ERROR_STATUS_REC1 ; + }else { + ubwc_ctrl_off =SSPP_UBWC_STATIC_CTRL ; + ubwc_error_off =SSPP_UBWC_ERROR_STATUS ; + } } c = &ctx->hw;
@@ -281,24 +294,24 @@ static void dpu_hw_sspp_setup_format(struct dpu_sw_pipe *pipe,switch (ctx->ubwc->ubwc_enc_version) {case UBWC_1_0 : fast_clear = fmt->alpha_enable ?BIT (31 ) :0 ; -DPU_REG_WRITE (c,SSPP_UBWC_STATIC_CTRL , +DPU_REG_WRITE (c, ubwc_ctrl_off, fast_clear | (ctx->ubwc->ubwc_swizzle &0x1 ) |BIT (8 ) | (hbb <<4 ));break ;case UBWC_2_0 : fast_clear = fmt->alpha_enable ?BIT (31 ) :0 ; -DPU_REG_WRITE (c,SSPP_UBWC_STATIC_CTRL , +DPU_REG_WRITE (c, ubwc_ctrl_off, fast_clear | (ctx->ubwc->ubwc_swizzle) | (hbb <<4 ));break ;case UBWC_3_0 : -DPU_REG_WRITE (c,SSPP_UBWC_STATIC_CTRL , +DPU_REG_WRITE (c, ubwc_ctrl_off,BIT (30 ) | (ctx->ubwc->ubwc_swizzle) | (hbb <<4 ));break ;case UBWC_4_0 : -DPU_REG_WRITE (c,SSPP_UBWC_STATIC_CTRL , +DPU_REG_WRITE (c, ubwc_ctrl_off,MSM_FORMAT_IS_YUV (fmt) ?0 :BIT (30 ));break ; }
@@ -327,7 +340,7 @@ static void dpu_hw_sspp_setup_format(struct dpu_sw_pipe *pipe,DPU_REG_WRITE (c, op_mode_off, opmode);/* clear previous UBWC error */ -DPU_REG_WRITE (c,SSPP_UBWC_ERROR_STATUS ,BIT (31 )); +DPU_REG_WRITE (c, ubwc_error_off,BIT (31 )); } static void dpu_hw_sspp_setup_pe_config(struct dpu_hw_sspp *ctx,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 281/781 drm/msm/dpu: fix SSPP_UBWC_STATIC_CTRL programming on UBWC 5.x+
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 258b080dc280e927d200af51992048ec818d0491 ]
Code in dpu_hw_sspp_setup_format() doesn't handle UBWC versions bigger than 4.0. Replace switch-case with if-else checks, making sure that the register is initialized on UBWC 5.x (and later) hosts.
Patchwork: https://patchwork.freedesktop.org/patch/699280/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c | 45 +++++++++++---------- 1 file changed, 24 insertions(+), 21 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c +24 -21
@@ -284,6 +284,7 @@ static void dpu_hw_sspp_setup_format(struct dpu_sw_pipe *pipe,if (fmt->fetch_mode !=MDP_FETCH_LINEAR ) {u32 hbb = ctx->ubwc->highest_bank_bit -13 ; +u32 ctrl_val;if (MSM_FORMAT_IS_UBWC (fmt)) opmode |=MDSS_MDP_OP_BWC_EN ;
@@ -291,30 +292,32 @@ static void dpu_hw_sspp_setup_format(struct dpu_sw_pipe *pipe,DPU_REG_WRITE (c,SSPP_FETCH_CONFIG ,DPU_FETCH_CONFIG_RESET_VALUE | hbb <<18 ); -switch (ctx->ubwc->ubwc_enc_version) { -case UBWC_1_0 : + +if (ctx->ubwc->ubwc_enc_version ==UBWC_1_0 ) { fast_clear = fmt->alpha_enable ?BIT (31 ) :0 ; -DPU_REG_WRITE (c, ubwc_ctrl_off, - fast_clear | (ctx->ubwc->ubwc_swizzle &0x1 ) | -BIT (8 ) | - (hbb <<4 )); -break ; -case UBWC_2_0 : + ctrl_val = fast_clear | (ctx->ubwc->ubwc_swizzle &0x1 ) | +BIT (8 ) | (hbb <<4 ); + }else if (ctx->ubwc->ubwc_enc_version ==UBWC_2_0 ) { fast_clear = fmt->alpha_enable ?BIT (31 ) :0 ; -DPU_REG_WRITE (c, ubwc_ctrl_off, - fast_clear | (ctx->ubwc->ubwc_swizzle) | - (hbb <<4 )); -break ; -case UBWC_3_0 : -DPU_REG_WRITE (c, ubwc_ctrl_off, -BIT (30 ) | (ctx->ubwc->ubwc_swizzle) | - (hbb <<4 )); -break ; -case UBWC_4_0 : -DPU_REG_WRITE (c, ubwc_ctrl_off, -MSM_FORMAT_IS_YUV (fmt) ?0 :BIT (30 )); -break ; + ctrl_val = fast_clear | ctx->ubwc->ubwc_swizzle | (hbb <<4 ); + }else if (ctx->ubwc->ubwc_enc_version ==UBWC_3_0 ) { + ctrl_val =BIT (30 ) | (ctx->ubwc->ubwc_swizzle) | (hbb <<4 ); + }else if (ctx->ubwc->ubwc_enc_version ==UBWC_4_0 ) { + ctrl_val =MSM_FORMAT_IS_YUV (fmt) ?0 :BIT (30 ); + }else if (ctx->ubwc->ubwc_enc_version <=UBWC_6_0 ) { +if (MSM_FORMAT_IS_YUV (fmt)) + ctrl_val =0 ; +else if (MSM_FORMAT_IS_DX (fmt))/* or FP16, but it's unsupported */ + ctrl_val =BIT (30 ); +else + ctrl_val =BIT (30 ) |BIT (31 ); +/* SDE also sets bits for lossy formats, but we don't support them yet */ + }else { +DRM_WARN_ONCE ("Unsupported UBWC version %x\n" , ctx->ubwc->ubwc_enc_version); + ctrl_val =0 ; } + +DPU_REG_WRITE (c, ubwc_ctrl_off, ctrl_val); } opmode |=MDSS_MDP_OP_PE_OVERRIDE ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 282/781 drm/msm/dp: Avoid division by zero in msm_dp_ctrl_config_msa()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
[ Upstream commit f185076da44c774241a16a82a7773ece3c1c607b ]
An (admittedly problematic) optimization change in LLVM 20 [1] turns known division by zero into the equivalent of __builtin_unreachable(), which invokes undefined behavior if it is encountered in a control flow graph, destroying code generation. When compile testing for x86_64, objtool flags an instance of this optimization triggering in msm_dp_ctrl_config_msa(), inlined into msm_dp_ctrl_on_stream():
drivers/gpu/drm/msm/msm.o: warning: objtool: msm_dp_ctrl_on_stream(): unexpected end of section .text.msm_dp_ctrl_on_stream
The zero division happens if the else branch in the first if statement in msm_dp_ctrl_config_msa() is taken because pixel_div is initialized to zero and it is not possible for LLVM to eliminate the else branch since rate is still not known after inlining into msm_dp_ctrl_on_stream().
Transform the if statements into a switch statement with a default case with the existing error print and an early return to avoid the invalid division. Add a comment to note this helps the compiler, even though the case is known to be unreachable. With this, pixel_dev's default zero initialization can be dropped, as it is dead with this change.
Patchwork: https://patchwork.freedesktop.org/patch/698355/
--- drivers/gpu/drm/msm/dp/dp_ctrl.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/gpu/drm/msm/dp/dp_ctrl.c +18 -6
@@ -2395,20 +2395,32 @@ static void msm_dp_ctrl_config_msa(struct msm_dp_ctrl_private *ctrl, bool is_ycbcr_420) {u32 pixel_m, pixel_n; -u32 mvid, nvid, pixel_div =0 , dispcc_input_rate; +u32 mvid, nvid, pixel_div, dispcc_input_rate;u32 const nvid_fixed =DP_LINK_CONSTANT_N_VALUE ;u32 const link_rate_hbr2 =540000 ;u32 const link_rate_hbr3 =810000 ;unsigned long den, num; -if (rate == link_rate_hbr3) +switch (rate) { +case link_rate_hbr3: pixel_div =6 ; -else if (rate ==162000 || rate ==270000 ) - pixel_div =2 ; -else if (rate == link_rate_hbr2) +break ; +case link_rate_hbr2: pixel_div =4 ; -else +break ; +case 162000 : +case 270000 : + pixel_div =2 ; +break ; +default : +/* +* This cannot be reached but the compiler is not able to know +* that statically so return early to avoid a possibly invalid +* division. +*/ DRM_ERROR ("Invalid pixel mux divider\n" ); +return ; + } dispcc_input_rate = (rate *10 ) / pixel_div;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 283/781 platform/chrome: cros_typec_switch: Dont touch struct fwnode_handle::dev
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit e1adf48853bc715f4deea074932aa1c44eb7abea ]
The 'dev' field in struct fwnode is special and related to device links, There no driver should use it for printing messages. Fix incorrect use of private field.
--- drivers/platform/chrome/cros_typec_switch.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/platform/chrome/cros_typec_switch.c +3 -3
@@ -230,20 +230,20 @@ static int cros_typec_register_switches(struct cros_typec_switch_data *sdata) adev =to_acpi_device_node (fwnode);if (!adev) { -dev_err (fwnode->dev,"Couldn't get ACPI device handle\n" ); +dev_err (dev,"Couldn't get ACPI device handle for %pfwP\n" , fwnode); ret = -ENODEV ; goto err_switch; } ret =acpi_evaluate_integer (adev->handle,"_ADR" ,NULL , &index);if (ACPI_FAILURE (ret)) { -dev_err (fwnode->dev,"_ADR wasn't evaluated\n" ); +dev_err (dev,"_ADR wasn't evaluated for %pfwP\n" , fwnode); ret = -ENODATA ; goto err_switch; }if (index >=EC_USB_PD_MAX_PORTS ) { -dev_err (fwnode->dev,"Invalid port index number: %llu\n" , index); +dev_err (dev,"%pfwP: Invalid port index number: %llu\n" , fwnode, index); ret = -EINVAL ; goto err_switch; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 284/781 pwm: tiehrpwm: Enable pwmchips parent device before setting configuration
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Praveen <[email protected]>
[ Upstream commit 75e7ed52ac7c1da90f304dcda2906636404df921 ]
The period and duty cycle configurations on J7200 and J784S4 SoCs does not get reflected after setting them using sysfs nodes. This is because at the end of ehrpwm_pwm_config function, the put_sync function is called which resets the hardware.
Hold the PWM controller out of low-power mode during .apply() to make sure it accepts the writes to its registers.
This renders the calls to pm_runtime_get_sync() and pm_runtime_put_sync() in ehrpwm_pwm_config() into no-ops, so these can be dropped.
--- drivers/pwm/pwm-tiehrpwm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/pwm/pwm-tiehrpwm.c +2 -4
@@ -237,8 +237,6 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,if (period_cycles <1 ) period_cycles =1 ; -pm_runtime_get_sync (pwmchip_parent (chip)); -/* Update clock prescaler values */ ehrpwm_modify (pc->mmio_base,TBCTL ,TBCTL_CLKDIV_MASK , tb_divval);
@@ -290,8 +288,6 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,if (!(duty_cycles > period_cycles))ehrpwm_write (pc->mmio_base, cmp_reg, duty_cycles); -pm_runtime_put_sync (pwmchip_parent (chip)); -return 0 ; }
@@ -378,6 +374,8 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,int err;bool enabled = pwm->state.enabled; +guard (pm_runtime_active)(pwmchip_parent (chip)); +if (state->polarity != pwm->state.polarity) {if (enabled) {ehrpwm_pwm_disable (chip, pwm);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 285/781 drm/amd/pm: Return -EOPNOTSUPP when cant read power limit
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <[email protected]>
[ Upstream commit e53dcefe30df4f317161f36e8bc11926e7dd7a2e ]
So that hwmon_attributes_visible() will see that the power2_cap attributes should not be visible on GPUs that don't support the get_power_limit() function.
This fixes an error when running the "sensors" command on SI.
--- drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/amdgpu_dpm.c +1 -1
@@ -1589,7 +1589,7 @@ int amdgpu_dpm_get_power_limit(struct amdgpu_device *adev,int ret =0 ;if (!pp_funcs->get_power_limit) -return -ENODATA ; +return -EOPNOTSUPP ;mutex_lock (&adev->pm.mutex); ret = pp_funcs->get_power_limit(adev->powerplay.pp_handle,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 286/781 media: uvcvideo: Fix allocation for small frame sizes
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 40d3ac25c11310bfaa50ed7614846ef75cb69a1e ]
If a frame has size of less or equal than one packet size uvc_alloc_urb_buffers() is unable to allocate memory for it due to a off-by-one error.
Fix the off-by-one-error and now that we are at it, make sure that stream->urb_size has always a valid value when we return from the function, even when an error happens.
--- drivers/media/usb/uvc/uvc_video.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_video.c +2 -1
@@ -1812,7 +1812,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream, npackets =UVC_MAX_PACKETS ;/* Retry allocations until one succeed. */ -for (; npackets >1 ; npackets /=2 ) { +for (; npackets >0 ; npackets /=2 ) { stream->urb_size = psize * npackets;for (i =0 ; i <UVC_URBS ; ++i) {
@@ -1837,6 +1837,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,uvc_dbg (stream->dev,VIDEO ,"Failed to allocate URB buffers (%u bytes per packet)\n" , psize); + stream->urb_size =0 ;return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 287/781 evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Sassu <[email protected]>
[ Upstream commit 0496fc9cdc384f67be4413b1c6156eb64fccd5c4 ]
Commit 8e5d9f916a96 ("smack: deduplicate xattr setting in smack_inode_init_security()") introduced xattr_dupval() to simplify setting the xattrs to be provided by the SMACK LSM on inode creation, in the smack_inode_init_security().
Unfortunately, moving lsm_get_xattr_slot() caused the SMACK64TRANSMUTE xattr be added in the array of new xattrs before SMACK64. This causes the HMAC of xattrs calculated by evm_init_hmac() for new files to diverge from the one calculated by both evm_calc_hmac_or_hash() and evmctl.
evm_init_hmac() calculates the HMAC of the xattrs of new files based on the order LSMs provide them, while evm_calc_hmac_or_hash() and evmctl calculate the HMAC based on an ordered xattrs list.
Fix the issue by making evm_init_hmac() calculate the HMAC of new files based on the ordered xattrs list too.
--- security/integrity/evm/evm_crypto.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
security/integrity/evm/evm_crypto.c +10 -4
@@ -401,6 +401,7 @@ int evm_init_hmac(struct inode *inode, const struct xattr *xattrs, {struct shash_desc *desc;const struct xattr *xattr; +struct xattr_list *xattr_entry; desc =init_desc (EVM_XATTR_HMAC ,HASH_ALGO_SHA1 );if (IS_ERR (desc)) {
@@ -408,11 +409,16 @@ int evm_init_hmac(struct inode *inode, const struct xattr *xattrs,return PTR_ERR (desc); } -for (xattr = xattrs; xattr->name; xattr++) { -if (!evm_protected_xattr (xattr->name)) -continue ; +list_for_each_entry_lockless (xattr_entry, &evm_config_xattrnames, + list) { +for (xattr = xattrs; xattr->name; xattr++) { +if (strcmp (xattr_entry->name + +XATTR_SECURITY_PREFIX_LEN , xattr->name) !=0 ) +continue ; -crypto_shash_update (desc, xattr->value, xattr->value_len); +crypto_shash_update (desc, xattr->value, + xattr->value_len); + } }hmac_add_misc (desc, inode,EVM_XATTR_HMAC , hmac_val);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 288/781 drm/xe/ptl: Disable DCC on PTL
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinay Belgaumkar <[email protected]>
[ Upstream commit 801a6e61f5fbab2c0dd76c8360f45b625b49e410 ]
On PTL, the recommendation is to disable DCC(Duty Cycle Control) as it may cause some regressions due to added latencies. Upcoming GuC releases will disable DCC on PTL as well, but we need to force it in KMD so that this behavior is propagated to older kernels.
v2: Update commit message (Rodrigo)
v3: Rebase
v4: Fix typo: s/propagted/propagated
--- drivers/gpu/drm/xe/xe_guc_pc.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+)
drivers/gpu/drm/xe/xe_guc_pc.c +34 -0
@@ -1214,6 +1214,36 @@ int xe_guc_pc_set_power_profile(struct xe_guc_pc *pc, const char *buf)return ret; } +static int pc_action_set_dcc (struct xe_guc_pc *pc,bool enable) +{ +int ret; + + ret =pc_action_set_param (pc, +SLPC_PARAM_TASK_ENABLE_DCC , + enable); +if (!ret) +return pc_action_set_param (pc, +SLPC_PARAM_TASK_DISABLE_DCC , + !enable); +else +return ret; +} + +static int pc_modify_defaults (struct xe_guc_pc *pc) +{ +struct xe_device *xe =pc_to_xe (pc); +struct xe_gt *gt =pc_to_gt (pc); +int ret =0 ; + +if (xe->info.platform ==XE_PANTHERLAKE ) { + ret =pc_action_set_dcc (pc, false); +if (unlikely (ret)) +xe_gt_err (gt,"Failed to modify DCC default: %pe\n" ,ERR_PTR (ret)); + } + +return ret; +} +/** * xe_guc_pc_start - Start GuC's Power Conservation component * @pc: Xe_GuC_PC instance
@@ -1271,6 +1301,10 @@ int xe_guc_pc_start(struct xe_guc_pc *pc) ktime_ms_delta(ktime_get(), earlier)); } + ret =pc_modify_defaults (pc); +if (ret) +return ret; + ret =pc_init_freqs (pc);if (ret) goto out;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 289/781 drm/xe: Unregister drm device on probe error
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <[email protected]>
[ Upstream commit 96c2c72b817d70e8d110e78b0162e044a0c41f9f ]
Call drm_dev_unregister() when xe_device_probe() fails after successful drm_dev_register(). This ensures the DRM device is promptly unregistered before returning an error, avoiding leaving it registered on the failure path.
Otherwise, there is warn message if xe_device_probe() is called again:
"
[ 207.322365] [drm:drm_minor_register] [ 207.322381] debugfs: '128' already exists in 'dri' [ 207.322432] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/renderD128' [ 207.322435] CPU: 5 UID: 0 PID: 10261 Comm: modprobe Tainted: G B W 6.19.0-rc2-lgci-xe-kernel+ #223 PREEMPT(voluntary) [ 207.322439] Tainted: [B]=BAD_PAGE, [W]=WARN [ 207.322440] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 [ 207.322441] Call Trace: [ 207.322442] <TASK> [ 207.322443] dump_stack_lvl+0xa0/0xc0 [ 207.322446] dump_stack+0x10/0x20 [ 207.322448] sysfs_warn_dup+0xd5/0x110 [ 207.322451] sysfs_create_dir_ns+0x1f6/0x280 [ 207.322453] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 207.322455] ? lock_acquire+0x1a4/0x2e0 [ 207.322458] ? __kasan_check_read+0x11/0x20 [ 207.322461] kobject_add_internal+0x28d/0x8e0 [ 207.322464] kobject_add+0x11f/0x1f0 [ 207.322465] ? lock_acquire+0x1a4/0x2e0 [ 207.322467] ? __pfx_kobject_add+0x10/0x10 [ 207.322469] ? __kasan_check_write+0x14/0x20 [ 207.322471] ? kobject_put+0x62/0x4a0 [ 207.322473] ? get_device_parent.isra.0+0x1bb/0x4c0 [ 207.322475] ? kobject_put+0x62/0x4a0 [ 207.322477] device_add+0x2d7/0x1500 [ 207.322479] ? __pfx_device_add+0x10/0x10 [ 207.322481] ? drm_debugfs_add_file+0xfa/0x170 [ 207.322483] ? drm_debugfs_add_files+0x82/0xd0 [ 207.322485] ? drm_debugfs_add_files+0x82/0xd0 [ 207.322487] drm_minor_register+0x10a/0x2d0 [ 207.322489] drm_dev_register+0x143/0x860 [ 207.322491] ? xe_configfs_get_psmi_enabled+0x12/0x90 [xe] [ 207.322667] xe_device_probe+0x185b/0x2c40 [xe] [ 207.322812] ? __pfx___drm_dev_dbg+0x10/0x10 [ 207.322815] ? add_dr+0x180/0x220 [ 207.322818] ? __pfx___drmm_mutex_release+0x10/0x10 [ 207.322821] ? __pfx_xe_device_probe+0x10/0x10 [xe] [ 207.322966] ? xe_pm_init_early+0x33a/0x410 [xe] [ 207.323136] xe_pci_probe+0x936/0x1250 [xe] [ 207.323298] ? lock_acquire+0x1a4/0x2e0 [ 207.323302] ? __pfx_xe_pci_probe+0x10/0x10 [xe] [ 207.323464] local_pci_probe+0xe6/0x1a0 [ 207.323468] pci_device_probe+0x523/0x840 [ 207.323470] ? __pfx_pci_device_probe+0x10/0x10 [ 207.323473] ? sysfs_do_create_link_sd.isra.0+0x8c/0x110 [ 207.323476] ? sysfs_create_link+0x48/0xc0 [ 207.323479] really_probe+0x1fd/0x8a0
...
"
--- drivers/gpu/drm/xe/xe_device.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/xe/xe_device.c +1 -0
@@ -976,6 +976,7 @@ int xe_device_probe(struct xe_device *xe) err_unregister_display:xe_display_unregister (xe); +drm_dev_unregister (&xe->drm);return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 290/781 mm/slab: fix false lockdep warning in __kfree_rcu_sheaf()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Yoo <[email protected]>
[ Upstream commit f8b4cd2dad097e4ea5aed3511f42b9eb771e7b19 ]
kvfree_call_rcu() can be called while holding a raw_spinlock_t. Since __kfree_rcu_sheaf() may acquire a spinlock_t (which becomes a sleeping lock on PREEMPT_RT) and violate lock nesting rules, kvfree_call_rcu() bypasses the sheaves layer entirely on PREEMPT_RT.
However, lockdep still complains about acquiring spinlock_t while holding raw_spinlock_t, even on !PREEMPT_RT where spinlock_t is a spinning lock. This causes a false lockdep warning [1]:
=============================
[ BUG: Invalid wait context ]
6.19.0-rc6-next-20260120 #21508 Not tainted
-----------------------------
migration/1/23 is trying to lock:
ffff8afd01054e98 (&barn->lock){..-.}-{3:3}, at: barn_get_empty_sheaf+0x1d/0xb0 other info that might help us debug this:
context-{5:5}
3 locks held by migration/1/23:
#0: ffff8afd01fd89a8 (&p->pi_lock){-.-.}-{2:2}, at: __balance_push_cpu_stop+0x3f/0x200 #1: ffffffff9f15c5c8 (rcu_read_lock){....}-{1:3}, at: cpuset_cpus_allowed_fallback+0x27/0x250 #2: ffff8afd1f470be0 ((local_lock_t *)&pcs->lock){+.+.}-{3:3}, at: __kfree_rcu_sheaf+0x52/0x3d0
stack backtrace: CPU: 1 UID: 0 PID: 23 Comm: migration/1 Not tainted 6.19.0-rc6-next-20260120 #21508 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Stopper: __balance_push_cpu_stop+0x0/0x200 <- balance_push+0x118/0x170 Call Trace: <TASK> __dump_stack+0x22/0x30 dump_stack_lvl+0x60/0x80 dump_stack+0x19/0x24 __lock_acquire+0xd3a/0x28e0 ? __lock_acquire+0x5a9/0x28e0 ? __lock_acquire+0x5a9/0x28e0 ? barn_get_empty_sheaf+0x1d/0xb0 lock_acquire+0xc3/0x270 ? barn_get_empty_sheaf+0x1d/0xb0 ? __kfree_rcu_sheaf+0x52/0x3d0 _raw_spin_lock_irqsave+0x47/0x70 ? barn_get_empty_sheaf+0x1d/0xb0 barn_get_empty_sheaf+0x1d/0xb0 ? __kfree_rcu_sheaf+0x52/0x3d0 __kfree_rcu_sheaf+0x19f/0x3d0 kvfree_call_rcu+0xaf/0x390 set_cpus_allowed_force+0xc8/0xf0 [...] </TASK>
This wasn't triggered until sheaves were enabled for all slab caches, since kfree_rcu() wasn't being called with a raw spinlock held for caches with sheaves (vma, maple node).
As suggested by Vlastimil Babka, fix this by using a lockdep map with LD_WAIT_CONFIG wait type to tell lockdep that acquiring spinlock_t is valid in this case, as those spinlocks won't be used on PREEMPT_RT.
Note that kfree_rcu_sheaf_map should be acquired using _try() variant, otherwise the acquisition of the lockdep map itself will trigger an invalid wait context warning.
--- mm/slub.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
mm/slub.c +20 -0
@@ -6265,11 +6265,29 @@ static void rcu_free_sheaf(struct rcu_head *head)free_empty_sheaf (s, sheaf); } +/* +* kvfree_call_rcu() can be called while holding a raw_spinlock_t. Since +* __kfree_rcu_sheaf() may acquire a spinlock_t (sleeping lock on PREEMPT_RT), +* this would violate lock nesting rules. Therefore, kvfree_call_rcu() avoids +* this problem by bypassing the sheaves layer entirely on PREEMPT_RT. +* +* However, lockdep still complains that it is invalid to acquire spinlock_t +* while holding raw_spinlock_t, even on !PREEMPT_RT where spinlock_t is a +* spinning lock. Tell lockdep that acquiring spinlock_t is valid here +* by temporarily raising the wait-type to LD_WAIT_CONFIG. +*/ +static DEFINE_WAIT_OVERRIDE_MAP(kfree_rcu_sheaf_map, LD_WAIT_CONFIG); +bool __kfree_rcu_sheaf (struct kmem_cache *s,void *obj) {struct slub_percpu_sheaves *pcs;struct slab_sheaf *rcu_sheaf; +if (WARN_ON_ONCE (IS_ENABLED (CONFIG_PREEMPT_RT ))) +return false; + +lock_map_acquire_try (&kfree_rcu_sheaf_map); +if (!local_trylock (&s->cpu_sheaves->lock)) goto fail;
@@ -6346,10 +6364,12 @@ bool __kfree_rcu_sheaf(struct kmem_cache *s, void *obj)local_unlock (&s->cpu_sheaves->lock);stat (s,FREE_RCU_SHEAF ); +lock_map_release (&kfree_rcu_sheaf_map);return true; fail:stat (s,FREE_RCU_SHEAF_FAIL ); +lock_map_release (&kfree_rcu_sheaf_map);return false; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 291/781 ASoC: tegra: Add AHUB writeable_reg for RX holes
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheetal <[email protected]>
[ Upstream commit 0ba6286a71581aaf8413a55b9bd90ea3463fd23b ]
Add writeable_reg callbacks for Tegra210/186 AHUB RX registers so the flat cache only treats valid RX locations as writable, avoiding holes in the register map.
--- sound/soc/tegra/tegra210_ahub.c | 57 +++++++++++++++++++++++++++++++++ sound/soc/tegra/tegra210_ahub.h | 30 +++++++++++++++++ 2 files changed, 87 insertions(+)
sound/soc/tegra/tegra210_ahub.c +57 -0
@@ -2049,6 +2049,61 @@ static const struct snd_soc_component_driver tegra264_ahub_component = { .num_dapm_routes = ARRAY_SIZE(tegra264_ahub_routes), }; +static bool tegra210_ahub_wr_reg (struct device *dev,unsigned int reg) +{ +int part; + +if (reg %TEGRA210_XBAR_RX_STRIDE ) +return false; + +for (part =0 ; part <TEGRA210_XBAR_UPDATE_MAX_REG ; part++) { +switch (reg & ~(part *TEGRA210_XBAR_PART1_RX )) { + case TEGRA210_AXBAR_PART_0_ADMAIF_RX1_0 ... TEGRA210_AXBAR_PART_0_ADMAIF_RX10_0: + case TEGRA210_AXBAR_PART_0_I2S1_RX1_0 ... TEGRA210_AXBAR_PART_0_I2S5_RX1_0: + case TEGRA210_AXBAR_PART_0_SFC1_RX1_0 ... TEGRA210_AXBAR_PART_0_SFC4_RX1_0: + case TEGRA210_AXBAR_PART_0_MIXER1_RX1_0 ... TEGRA210_AXBAR_PART_0_MIXER1_RX10_0: + case TEGRA210_AXBAR_PART_0_SPDIF1_RX1_0 ... TEGRA210_AXBAR_PART_0_SPDIF1_RX2_0: + case TEGRA210_AXBAR_PART_0_AFC1_RX1_0 ... TEGRA210_AXBAR_PART_0_AFC6_RX1_0: + case TEGRA210_AXBAR_PART_0_OPE1_RX1_0 ... TEGRA210_AXBAR_PART_0_OPE2_RX1_0: +case TEGRA210_AXBAR_PART_0_SPKPROT1_RX1_0 : + case TEGRA210_AXBAR_PART_0_MVC1_RX1_0 ... TEGRA210_AXBAR_PART_0_MVC2_RX1_0: + case TEGRA210_AXBAR_PART_0_AMX1_RX1_0 ... TEGRA210_AXBAR_PART_0_ADX2_RX1_0: +return true; +default : +break ; + } + } + +return false; +} + +static bool tegra186_ahub_wr_reg (struct device *dev,unsigned int reg) +{ +int part; + +if (reg %TEGRA210_XBAR_RX_STRIDE ) +return false; + +for (part =0 ; part <TEGRA186_XBAR_UPDATE_MAX_REG ; part++) { +switch (reg & ~(part *TEGRA210_XBAR_PART1_RX )) { + case TEGRA210_AXBAR_PART_0_ADMAIF_RX1_0 ... TEGRA186_AXBAR_PART_0_I2S6_RX1_0: + case TEGRA210_AXBAR_PART_0_SFC1_RX1_0 ... TEGRA210_AXBAR_PART_0_SFC4_RX1_0: + case TEGRA210_AXBAR_PART_0_MIXER1_RX1_0 ... TEGRA210_AXBAR_PART_0_MIXER1_RX10_0: + case TEGRA186_AXBAR_PART_0_DSPK1_RX1_0 ... TEGRA186_AXBAR_PART_0_DSPK2_RX1_0: + case TEGRA210_AXBAR_PART_0_AFC1_RX1_0 ... TEGRA210_AXBAR_PART_0_AFC6_RX1_0: +case TEGRA210_AXBAR_PART_0_OPE1_RX1_0 : + case TEGRA186_AXBAR_PART_0_MVC1_RX1_0 ... TEGRA186_AXBAR_PART_0_MVC2_RX1_0: + case TEGRA186_AXBAR_PART_0_AMX1_RX1_0 ... TEGRA186_AXBAR_PART_0_AMX3_RX4_0: + case TEGRA210_AXBAR_PART_0_ADX1_RX1_0 ... TEGRA186_AXBAR_PART_0_ASRC1_RX7_0: +return true; +default : +break ; + } + } + +return false; +} +static bool tegra264_ahub_wr_reg (struct device *dev,unsigned int reg) {int part;
@@ -2076,6 +2131,7 @@ static const struct regmap_config tegra210_ahub_regmap_config = { .reg_bits = 32, .val_bits = 32, .reg_stride = 4, + .writeable_reg = tegra210_ahub_wr_reg, .max_register = TEGRA210_MAX_REGISTER_ADDR, .cache_type = REGCACHE_FLAT, };
@@ -2084,6 +2140,7 @@ static const struct regmap_config tegra186_ahub_regmap_config = { .reg_bits = 32, .val_bits = 32, .reg_stride = 4, + .writeable_reg = tegra186_ahub_wr_reg, .max_register = TEGRA186_MAX_REGISTER_ADDR, .cache_type = REGCACHE_FLAT, };
sound/soc/tegra/tegra210_ahub.h +30 -0
@@ -68,6 +68,36 @@#define TEGRA210_MAX_REGISTER_ADDR (TEGRA210_XBAR_PART2_RX + \ (TEGRA210_XBAR_RX_STRIDE * (TEGRA210_XBAR_AUDIO_RX_COUNT - 1))) +/* AXBAR register offsets */ +#define TEGRA186_AXBAR_PART_0_AMX1_RX1_0 0x120 +#define TEGRA186_AXBAR_PART_0_AMX3_RX4_0 0x14c +#define TEGRA186_AXBAR_PART_0_ASRC1_RX7_0 0x1a8 +#define TEGRA186_AXBAR_PART_0_DSPK1_RX1_0 0xc0 +#define TEGRA186_AXBAR_PART_0_DSPK2_RX1_0 0xc4 +#define TEGRA186_AXBAR_PART_0_I2S6_RX1_0 0x54 +#define TEGRA186_AXBAR_PART_0_MVC1_RX1_0 0x110 +#define TEGRA186_AXBAR_PART_0_MVC2_RX1_0 0x114 +#define TEGRA210_AXBAR_PART_0_ADMAIF_RX10_0 0x24 +#define TEGRA210_AXBAR_PART_0_ADMAIF_RX1_0 0x0 +#define TEGRA210_AXBAR_PART_0_ADX1_RX1_0 0x160 +#define TEGRA210_AXBAR_PART_0_ADX2_RX1_0 0x164 +#define TEGRA210_AXBAR_PART_0_AFC1_RX1_0 0xd0 +#define TEGRA210_AXBAR_PART_0_AFC6_RX1_0 0xe4 +#define TEGRA210_AXBAR_PART_0_AMX1_RX1_0 0x140 +#define TEGRA210_AXBAR_PART_0_I2S1_RX1_0 0x40 +#define TEGRA210_AXBAR_PART_0_I2S5_RX1_0 0x50 +#define TEGRA210_AXBAR_PART_0_MIXER1_RX10_0 0xa4 +#define TEGRA210_AXBAR_PART_0_MIXER1_RX1_0 0x80 +#define TEGRA210_AXBAR_PART_0_MVC1_RX1_0 0x120 +#define TEGRA210_AXBAR_PART_0_MVC2_RX1_0 0x124 +#define TEGRA210_AXBAR_PART_0_OPE1_RX1_0 0x100 +#define TEGRA210_AXBAR_PART_0_OPE2_RX1_0 0x104 +#define TEGRA210_AXBAR_PART_0_SFC1_RX1_0 0x60 +#define TEGRA210_AXBAR_PART_0_SFC4_RX1_0 0x6c +#define TEGRA210_AXBAR_PART_0_SPDIF1_RX1_0 0xc0 +#define TEGRA210_AXBAR_PART_0_SPDIF1_RX2_0 0xc4 +#define TEGRA210_AXBAR_PART_0_SPKPROT1_RX1_0 0x110 +#define MUX_REG (id) (TEGRA210_XBAR_RX_STRIDE * (id))#define MUX_VALUE (npart, nbit) (1 + (nbit) + (npart) * 32)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 292/781 platform/chrome: cros_ec_lightbar: Fix response size initialization
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit ec0dd36dbf8b0b209e63d0cd795451fa2203c736 ]
Commit 1e7913ff5f9f ("platform/chrome: cros_ec_lightbar: Reduce ligthbar get version command") meant to set smaller values for both request and response sizes.
However, it incorrectly assigned the response size to the result field instead of insize. Fix it.
--- drivers/platform/chrome/cros_ec_lightbar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/chrome/cros_ec_lightbar.c +1 -1
@@ -126,7 +126,7 @@ static int get_lightbar_version(struct cros_ec_dev *ec, param = (struct ec_params_lightbar *)msg->data; param->cmd =LIGHTBAR_CMD_VERSION ; msg->outsize =sizeof (param->cmd); - msg->result =sizeof (resp->version); + msg->insize =sizeof (resp->version); ret =cros_ec_cmd_xfer_status (ec->ec_dev, msg);if (ret <0 && ret != -EINVAL ) { ret =0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 293/781 accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit a9162439ad792afcddc04718408ec1380b7a5f63 ]
Some tests trigger a crash in iommu_sva_unbind_device() due to accessing iommu_mm after the associated mm structure has been freed.
Fix this by taking an explicit reference to the mm structure after successfully binding the device, and releasing it only after the device is unbound. This ensures the mm remains valid for the entire SVA bind/unbind lifetime.
--- drivers/accel/amdxdna/amdxdna_pci_drv.c | 3 +++ drivers/accel/amdxdna/amdxdna_pci_drv.h | 1 + 2 files changed, 4 insertions(+)
drivers/accel/amdxdna/amdxdna_pci_drv.c +3 -0
@@ -83,6 +83,8 @@ static int amdxdna_drm_open(struct drm_device *ddev, struct drm_file *filp) ret = -ENODEV ; goto unbind_sva; } + client->mm = current->mm; +mmgrab (client->mm);init_srcu_struct (&client->hwctx_srcu);xa_init_flags (&client->hwctx_xa,XA_FLAGS_ALLOC );mutex_init (&client->mm_lock);
@@ -119,6 +121,7 @@ static void amdxdna_drm_close(struct drm_device *ddev, struct drm_file *filp)drm_gem_object_put (to_gobj (client->dev_heap));iommu_sva_unbind_device (client->sva); +mmdrop (client->mm);XDNA_DBG (xdna,"pid %d closed" , client->pid);kfree (client);
drivers/accel/amdxdna/amdxdna_pci_drv.h +1 -0
@@ -130,6 +130,7 @@ struct amdxdna_client {struct iommu_sva *sva;int pasid; +struct mm_struct *mm; };#define amdxdna_for_each_hwctx (client, hwctx_id, entry) \
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 294/781 accel/amdxdna: Stop job scheduling across aie2_release_resource()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit f1370241fe8045702bc9d0812b996791f0500f1b ]
Running jobs on a hardware context while it is in the process of releasing resources can lead to use-after-free and crashes.
Fix this by stopping job scheduling before calling aie2_release_resource() and restarting it after the release completes. Additionally, aie2_sched_job_run() now checks whether the hardware context is still active.
--- drivers/accel/amdxdna/aie2_ctx.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/accel/amdxdna/aie2_ctx.c +6 -0
@@ -315,6 +315,9 @@ aie2_sched_job_run(struct drm_sched_job *sched_job)struct dma_fence *fence;int ret; +if (hwctx->status !=HWCTX_STAT_READY ) +return NULL ; +if (!mmget_not_zero (job->mm))return ERR_PTR (-ESRCH );
@@ -693,7 +696,10 @@ void aie2_hwctx_fini(struct amdxdna_hwctx *hwctx)aie2_hwctx_wait_for_idle (hwctx);/* Request fw to destroy hwctx and cancel the rest pending requests */ +drm_sched_stop (&hwctx->priv->sched,NULL );aie2_release_resource (hwctx); + hwctx->status =HWCTX_STAT_STOP ; +drm_sched_start (&hwctx->priv->sched,0 );mutex_unlock (&xdna->dev_lock);drm_sched_entity_destroy (&hwctx->priv->entity);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 295/781 accel/amdxdna: Fix memory leak in amdxdna_ubuf_map
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zishun Yi <[email protected]>
[ Upstream commit 84dd57fb0359500092f1101409ca32091731490d ]
The amdxdna_ubuf_map() function allocates memory for sg and internal sg table structures, but it fails to free them if subsequent operations (sg_alloc_table_from_pages or dma_map_sgtable) fail.
--- drivers/accel/amdxdna/amdxdna_ubuf.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/accel/amdxdna/amdxdna_ubuf.c +8 -2
@@ -34,15 +34,21 @@ static struct sg_table *amdxdna_ubuf_map(struct dma_buf_attachment *attach, ret =sg_alloc_table_from_pages (sg, ubuf->pages, ubuf->nr_pages,0 , ubuf->nr_pages <<PAGE_SHIFT ,GFP_KERNEL );if (ret) -return ERR_PTR (ret); + goto err_free_sg;if (ubuf->flags &AMDXDNA_UBUF_FLAG_MAP_DMA ) { ret =dma_map_sgtable (attach->dev, sg, direction,0 );if (ret) -return ERR_PTR (ret); + goto err_free_table; }return sg; + +err_free_table: +sg_free_table (sg); +err_free_sg: +kfree (sg); +return ERR_PTR (ret); } static void amdxdna_ubuf_unmap(struct dma_buf_attachment *attach,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 296/781 drm/i915/display: fix the pixel normalization handling for xe3p_lpd
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Govindapillai <[email protected]>
[ Upstream commit 3e28a67a85f9b569066f6dfcddadb39294c0c9d4 ]
Pixel normalizer is enabled with normalization factor as 1.0 for FP16 formats in order to support FBC for those formats in xe3p_lpd. Previously pixel normalizer gets disabled during the plane disable routine. But there could be plane format settings without explicitly calling the plane disable in-between and we could endup keeping the pixel normalizer enabled for formats which we don't require that. This is causing crc mismatches in yuv formats and FIFO underruns in planar formats like NV12. Fix this by updating the pixel normalizer configuration based on the pixel formats explicitly during the plane settings arm calls itself - enable it for FP16 and disable it for other formats in HDR capable planes.
v2: avoid redundant pixel normalization setting updates
v3: moved the normalization factor definition to intel_fbc.c and some
updates to comments
v4: simplified the pixel normalizer setting handling
--- .../drm/i915/display/intel_display_device.h | 1 + drivers/gpu/drm/i915/display/intel_fbc.c | 10 +++--- drivers/gpu/drm/i915/display/intel_fbc.h | 3 +- .../drm/i915/display/skl_universal_plane.c | 36 +++++++++---------- 4 files changed, 26 insertions(+), 24 deletions(-)
drivers/gpu/drm/i915/display/intel_display_device.h +1 -0
@@ -189,6 +189,7 @@ struct intel_display_platforms {#define HAS_MSO (__display) (DISPLAY_VER(__display) >= 12)#define HAS_OVERLAY (__display) (DISPLAY_INFO(__display)->has_overlay)#define HAS_PIPEDMC (__display) (DISPLAY_VER(__display) >= 12) +#define HAS_PIXEL_NORMALIZER (__display) (DISPLAY_VER(__display) >= 35)#define HAS_PSR (__display) (DISPLAY_INFO(__display)->has_psr)#define HAS_PSR_HW_TRACKING (__display) (DISPLAY_INFO(__display)->has_psr_hw_tracking)#define HAS_PSR2_SEL_FETCH (__display) (DISPLAY_VER(__display) >= 12)
drivers/gpu/drm/i915/display/intel_fbc.c +6 -4
@@ -1120,13 +1120,15 @@ static bool xe3p_lpd_fbc_pixel_format_is_valid(const struct intel_plane_state *p } } -bool -intel_fbc_is_enable_pixel_normalizer (const struct intel_plane_state *plane_state) +bool intel_fbc_need_pixel_normalizer (const struct intel_plane_state *plane_state) {struct intel_display *display =to_intel_display (plane_state); -return DISPLAY_VER (display) >=35 && -xe3p_lpd_fbc_fp16_format_is_valid (plane_state); +if (HAS_PIXEL_NORMALIZER (display) && +xe3p_lpd_fbc_fp16_format_is_valid (plane_state)) +return true; + +return false; }static bool pixel_format_is_valid (const struct intel_plane_state *plane_state)
drivers/gpu/drm/i915/display/intel_fbc.h +1 -2
@@ -53,7 +53,6 @@ void intel_fbc_prepare_dirty_rect(struct intel_atomic_state *state, struct intel_crtc *crtc);void intel_fbc_dirty_rect_update_noarm (struct intel_dsb *dsb,struct intel_plane *plane); -bool -intel_fbc_is_enable_pixel_normalizer (const struct intel_plane_state *plane_state); +bool intel_fbc_need_pixel_normalizer (const struct intel_plane_state *plane_state);#endif /* __INTEL_FBC_H__ */
drivers/gpu/drm/i915/display/skl_universal_plane.c +18 -18
@@ -892,23 +892,20 @@ static void icl_plane_disable_sel_fetch_arm(struct intel_dsb *dsb,intel_de_write_dsb (display, dsb,SEL_FETCH_PLANE_CTL (pipe, plane->id),0 ); } -static void x3p_lpd_plane_update_pixel_normalizer (struct intel_dsb *dsb, -struct intel_plane *plane, -bool enable) +static bool plane_has_normalizer (struct intel_plane *plane) {struct intel_display *display =to_intel_display (plane); -enum intel_fbc_id fbc_id =skl_fbc_id_for_pipe (plane->pipe); -u32 val; -/* Only HDR planes have pixel normalizer and don't matter if no FBC */ -if (!skl_plane_has_fbc (display, fbc_id, plane->id)) -return ; +return HAS_PIXEL_NORMALIZER (display) &&icl_is_hdr_plane (display, plane->id); +} - val = enable ?PLANE_PIXEL_NORMALIZE_NORM_FACTOR (PLANE_PIXEL_NORMALIZE_NORM_FACTOR_1_0 ) | -PLANE_PIXEL_NORMALIZE_ENABLE :0 ; +static u32 pixel_normalizer_value (const struct intel_plane_state *plane_state) +{ +if (!intel_fbc_need_pixel_normalizer (plane_state)) +return 0 ; -intel_de_write_dsb (display, dsb, -PLANE_PIXEL_NORMALIZE (plane->pipe, plane->id), val); +return PLANE_PIXEL_NORMALIZE_ENABLE | +PLANE_PIXEL_NORMALIZE_NORM_FACTOR (PLANE_PIXEL_NORMALIZE_NORM_FACTOR_1_0 ); } static void
@@ -927,8 +924,9 @@ icl_plane_disable_arm(struct intel_dsb *dsb,icl_plane_disable_sel_fetch_arm (dsb, plane, crtc_state); -if (DISPLAY_VER (display) >=35 ) -x3p_lpd_plane_update_pixel_normalizer (dsb, plane, false); +if (plane_has_normalizer (plane)) +intel_de_write_dsb (display, dsb, +PLANE_PIXEL_NORMALIZE (plane->pipe, plane->id),0 );intel_de_write_dsb (display, dsb,PLANE_CTL (pipe, plane_id),0 );intel_de_write_dsb (display, dsb,PLANE_SURF (pipe, plane_id),0 );
@@ -1677,11 +1675,13 @@ icl_plane_update_arm(struct intel_dsb *dsb,/* * In order to have FBC for fp16 formats pixel normalizer block must be -* active. Check if pixel normalizer block need to be enabled for FBC. -* If needed, use normalization factor as 1.0 and enable the block. +* active. For FP16 formats, use normalization factor as 1.0 and enable +* the block. */ -if (intel_fbc_is_enable_pixel_normalizer (plane_state)) -x3p_lpd_plane_update_pixel_normalizer (dsb, plane, true); +if (plane_has_normalizer (plane)) +intel_de_write_dsb (display, dsb, +PLANE_PIXEL_NORMALIZE (plane->pipe, plane->id), +pixel_normalizer_value (plane_state));/* * The control register self-arms if the plane was previously
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 297/781 HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Lin <[email protected]>
[ Upstream commit 56f7db581ee73af53cd512e00a6261a025bf1d58 ]
During a warm reset flow, the cl->device pointer may be NULL if the reset occurs while clients are still being enumerated. Accessing cl->device->reference_count without a NULL check leads to a kernel panic.
This issue was identified during multi-unit warm reboot stress clycles. Add a defensive NULL check for cl->device to ensure stability under such intensive testing conditions.
KASAN: null-ptr-deref in range [0000000000000000-0000000000000007] Workqueue: ish_fw_update_wq fw_reset_work_fn Call Trace: ishtp_bus_remove_all_clients+0xbe/0x130 [intel_ishtp] ishtp_reset_handler+0x85/0x1a0 [intel_ishtp] fw_reset_work_fn+0x8a/0xc0 [intel_ish_ipc]
--- drivers/hid/intel-ish-hid/ishtp/bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/intel-ish-hid/ishtp/bus.c +1 -1
@@ -730,7 +730,7 @@ void ishtp_bus_remove_all_clients(struct ishtp_device *ishtp_dev,spin_lock_irqsave (&ishtp_dev->cl_list_lock, flags);list_for_each_entry (cl, &ishtp_dev->cl_list, link) { cl->state =ISHTP_CL_DISCONNECTED ; -if (warm_reset && cl->device->reference_count) +if (warm_reset && cl->device && cl->device->reference_count)continue ;/*
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 298/781 HID: Intel-thc-hid: Intel-thc: Fix wrong register fields updating
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Even Xu <[email protected]>
[ Upstream commit e4aa247d94a04574297a8bc9fabbede0dcba1ab6 ]
Clear the target bit fields in register before setting new values. This ensures proper field updates by removing any existing bits that might interfere with the new configuration.
--- drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c +2 -0
@@ -1597,6 +1597,7 @@ int thc_i2c_set_rx_max_size(struct thc_device *dev, u32 max_rx_size)if (ret)return ret; + val = val & ~THC_M_PRT_SPI_ICRRD_OPCODE_I2C_MAX_SIZE ; val |=FIELD_PREP (THC_M_PRT_SPI_ICRRD_OPCODE_I2C_MAX_SIZE , max_rx_size); ret =regmap_write (dev->thc_regmap,THC_M_PRT_SPI_ICRRD_OPCODE_OFFSET , val);
@@ -1667,6 +1668,7 @@ int thc_i2c_set_rx_int_delay(struct thc_device *dev, u32 delay_us)return ret;/* THC hardware counts at 10us unit */ + val = val & ~THC_M_PRT_SPI_ICRRD_OPCODE_I2C_INTERVAL ; val |=FIELD_PREP (THC_M_PRT_SPI_ICRRD_OPCODE_I2C_INTERVAL ,DIV_ROUND_UP (delay_us,10 )); ret =regmap_write (dev->thc_regmap,THC_M_PRT_SPI_ICRRD_OPCODE_OFFSET , val);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 299/781 accel/amdxdna: Enable temporal sharing only mode
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit 7818618a09a06320f409571bf28801ccfe7e0a30 ]
Newer firmware versions prefer temporal sharing only mode. In this mode, the driver no longer needs to manage AIE array column allocation. Instead, a new field, num_unused_col, is added to the hardware context creation request to specify how many columns will not be used by this hardware context.
Stable-dep-of: b853007fdcdd ("accel/amdxdna: Remove hardware context status")
--- drivers/accel/amdxdna/aie2_ctx.c | 18 +++++++++++++++--- drivers/accel/amdxdna/aie2_message.c | 1 + drivers/accel/amdxdna/aie2_msg_priv.h | 3 ++- drivers/accel/amdxdna/aie2_pci.h | 1 + drivers/accel/amdxdna/amdxdna_ctx.h | 1 + drivers/accel/amdxdna/npu4_regs.c | 1 + 6 files changed, 21 insertions(+), 4 deletions(-)
drivers/accel/amdxdna/aie2_ctx.c +15 -3
@@ -471,6 +471,12 @@ static int aie2_alloc_resource(struct amdxdna_hwctx *hwctx)struct alloc_requests *xrs_req;int ret; +if (AIE2_FEATURE_ON (xdna->dev_handle,AIE2_TEMPORAL_ONLY )) { + hwctx->num_unused_col = xdna->dev_handle->total_col - hwctx->num_col; + hwctx->num_col = xdna->dev_handle->total_col; +return aie2_create_context (xdna->dev_handle, hwctx); + } + xrs_req =kzalloc (sizeof (*xrs_req),GFP_KERNEL );if (!xrs_req)return -ENOMEM ;
@@ -502,9 +508,15 @@ static void aie2_release_resource(struct amdxdna_hwctx *hwctx)struct amdxdna_dev *xdna = hwctx->client->xdna;int ret; - ret =xrs_release_resource (xdna->xrs_hdl, (uintptr_t )hwctx); -if (ret) -XDNA_ERR (xdna,"Release AIE resource failed, ret %d" , ret); +if (AIE2_FEATURE_ON (xdna->dev_handle,AIE2_TEMPORAL_ONLY )) { + ret =aie2_destroy_context (xdna->dev_handle, hwctx); +if (ret) +XDNA_ERR (xdna,"Destroy temporal only context failed, ret %d" , ret); + }else { + ret =xrs_release_resource (xdna->xrs_hdl, (uintptr_t )hwctx); +if (ret) +XDNA_ERR (xdna,"Release AIE resource failed, ret %d" , ret); + } }static int aie2_ctx_syncobj_create (struct amdxdna_hwctx *hwctx)
drivers/accel/amdxdna/aie2_message.c +1 -0
@@ -211,6 +211,7 @@ int aie2_create_context(struct amdxdna_dev_hdl *ndev, struct amdxdna_hwctx *hwct req.aie_type =1 ; req.start_col = hwctx->start_col; req.num_col = hwctx->num_col; + req.num_unused_col = hwctx->num_unused_col; req.num_cq_pairs_requested =1 ; req.pasid = hwctx->client->pasid; req.context_priority =2 ;
drivers/accel/amdxdna/aie2_msg_priv.h +2 -1
@@ -112,7 +112,8 @@ struct create_ctx_req {__u32 aie_type;__u8 start_col;__u8 num_col; -__u16 reserved; +__u8 num_unused_col; +__u8 reserved;__u8 num_cq_pairs_requested;__u8 reserved1;__u16 pasid;
drivers/accel/amdxdna/aie2_pci.h +1 -0
@@ -231,6 +231,7 @@ struct aie2_hw_ops {enum aie2_fw_feature {AIE2_NPU_COMMAND ,AIE2_PREEMPT , +AIE2_TEMPORAL_ONLY ,AIE2_FEATURE_MAX };
drivers/accel/amdxdna/amdxdna_ctx.h +1 -0
@@ -98,6 +98,7 @@ struct amdxdna_hwctx {u32 *col_list;u32 start_col;u32 num_col; +u32 num_unused_col;#define HWCTX_STAT_INIT 0#define HWCTX_STAT_READY 1#define HWCTX_STAT_STOP 2
drivers/accel/amdxdna/npu4_regs.c +1 -0
@@ -89,6 +89,7 @@ const struct dpm_clk_freq npu4_dpm_clk_table[] = {const struct aie2_fw_feature_tbl npu4_fw_feature_table[] = { { .feature =AIE2_NPU_COMMAND , .min_minor =15 }, { .feature =AIE2_PREEMPT , .min_minor =12 }, + { .feature =AIE2_TEMPORAL_ONLY , .min_minor =12 }, {0 } };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 300/781 accel/amdxdna: Remove hardware context status
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit b853007fdcdd64b49601a993c2b30c28279ae15d ]
One newly supported command does not require hardware context configuration to be performed upfront. As a result, checking hardware context status causes this command to fail incorrectly.
Remove hardware context status handling entirely. For other commands, if userspace submits a request without configuring the hardware context first, the firmware will report an error or time out as appropriate.
--- drivers/accel/amdxdna/aie2_ctx.c | 25 ++----------------------- drivers/accel/amdxdna/aie2_message.c | 3 +++ drivers/accel/amdxdna/amdxdna_ctx.h | 5 ----- 3 files changed, 5 insertions(+), 28 deletions(-)
drivers/accel/amdxdna/aie2_ctx.c +2 -23
@@ -47,17 +47,6 @@ static void aie2_job_put(struct amdxdna_sched_job *job)kref_put (&job->refcnt, aie2_job_release); } -static void aie2_hwctx_status_shift_stop (struct amdxdna_hwctx *hwctx) -{ - hwctx->old_status = hwctx->status; - hwctx->status =HWCTX_STAT_STOP ; -} - -static void aie2_hwctx_status_restore (struct amdxdna_hwctx *hwctx) -{ - hwctx->status = hwctx->old_status; -} -/* The bad_job is used in aie2_sched_job_timedout, otherwise, set it to NULL */ static void aie2_hwctx_stop (struct amdxdna_dev *xdna,struct amdxdna_hwctx *hwctx,struct drm_sched_job *bad_job)
@@ -84,11 +73,6 @@ static int aie2_hwctx_restart(struct amdxdna_dev *xdna, struct amdxdna_hwctx *hw goto out; } -if (hwctx->status !=HWCTX_STAT_READY ) { -XDNA_DBG (xdna,"hwctx is not ready, status %d" , hwctx->status); - goto out; - } - ret =aie2_config_cu (hwctx,NULL );if (ret) {XDNA_ERR (xdna,"Config cu failed, ret %d" , ret);
@@ -140,7 +124,6 @@ static int aie2_hwctx_suspend_cb(struct amdxdna_hwctx *hwctx, void *arg)aie2_hwctx_wait_for_idle (hwctx);aie2_hwctx_stop (xdna, hwctx,NULL ); -aie2_hwctx_status_shift_stop (hwctx);return 0 ; }
@@ -162,7 +145,6 @@ static int aie2_hwctx_resume_cb(struct amdxdna_hwctx *hwctx, void *arg) {struct amdxdna_dev *xdna = hwctx->client->xdna; -aie2_hwctx_status_restore (hwctx);return aie2_hwctx_restart (xdna, hwctx); }
@@ -315,7 +297,7 @@ aie2_sched_job_run(struct drm_sched_job *sched_job)struct dma_fence *fence;int ret; -if (hwctx->status !=HWCTX_STAT_READY ) +if (!hwctx->priv->mbox_chann)return NULL ;if (!mmget_not_zero (job->mm))
@@ -666,7 +648,6 @@ int aie2_hwctx_init(struct amdxdna_hwctx *hwctx) }amdxdna_pm_suspend_put (xdna); - hwctx->status =HWCTX_STAT_INIT ;init_waitqueue_head (&priv->job_free_wq);XDNA_DBG (xdna,"hwctx %s init completed" , hwctx->name);
@@ -710,7 +691,6 @@ void aie2_hwctx_fini(struct amdxdna_hwctx *hwctx)/* Request fw to destroy hwctx and cancel the rest pending requests */ drm_sched_stop (&hwctx->priv->sched,NULL );aie2_release_resource (hwctx); - hwctx->status =HWCTX_STAT_STOP ;drm_sched_start (&hwctx->priv->sched,0 );mutex_unlock (&xdna->dev_lock);
@@ -755,7 +735,7 @@ static int aie2_hwctx_cu_config(struct amdxdna_hwctx *hwctx, void *buf, u32 sizeif (XDNA_MBZ_DBG (xdna, config->pad,sizeof (config->pad)))return -EINVAL ; -if (hwctx->status !=HWCTX_STAT_INIT ) { +if (hwctx->cus) {XDNA_ERR (xdna,"Not support re-config CU" );return -EINVAL ; }
@@ -786,7 +766,6 @@ static int aie2_hwctx_cu_config(struct amdxdna_hwctx *hwctx, void *buf, u32 size }wmb ();/* To avoid locking in command submit when check status */ - hwctx->status =HWCTX_STAT_READY ;return 0 ;
drivers/accel/amdxdna/aie2_message.c +3 -0
@@ -450,6 +450,9 @@ int aie2_config_cu(struct amdxdna_hwctx *hwctx,if (!chann)return -ENODEV ; +if (!hwctx->cus) +return 0 ; +if (hwctx->cus->num_cus >MAX_NUM_CUS ) {XDNA_DBG (xdna,"Exceed maximum CU %d" ,MAX_NUM_CUS );return -EINVAL ;
drivers/accel/amdxdna/amdxdna_ctx.h +0 -5
@@ -99,11 +99,6 @@ struct amdxdna_hwctx {u32 start_col;u32 num_col;u32 num_unused_col; -#define HWCTX_STAT_INIT 0 -#define HWCTX_STAT_READY 1 -#define HWCTX_STAT_STOP 2 -u32 status; -u32 old_status;struct amdxdna_qos_info qos;struct amdxdna_hwctx_param_config_cu *cus;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 301/781 accel/amdxdna: Fix incorrect error code returned for failed chain command
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit 750817a7c41de083ca5d73052e97bb7b67d7c394 ]
The driver currently returns an incorrect error code when a chain command fails. In this case, ERT_CMD_STATE_ERROR is expected to be reported for failed chain commands.
--- drivers/accel/amdxdna/aie2_ctx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/accel/amdxdna/aie2_ctx.c +1 -1
@@ -274,7 +274,7 @@ aie2_sched_cmdlist_resp_handler(void *handle, void __iomem *data, size_t size) ret = -EINVAL ; goto out; } -amdxdna_cmd_set_state (cmd_abo, fail_cmd_status); +amdxdna_cmd_set_state (cmd_abo,ERT_CMD_STATE_ERROR );if (amdxdna_cmd_get_op (cmd_abo) ==ERT_CMD_CHAIN ) {struct amdxdna_cmd_chain *cc =amdxdna_cmd_get_payload (cmd_abo,NULL );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 302/781 ASoC: SDCA: Remove outdated todo comment
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit b27b57f85fe3f0eca479556ac55bc9cbd1a5685a ]
Support for -cn- properties has already been added, however the TODO comment noting this feature was required was not removed. Remove the now redundant comment.
--- sound/soc/sdca/sdca_functions.c | 4 ---- 1 file changed, 4 deletions(-)
sound/soc/sdca/sdca_functions.c +0 -4
@@ -911,10 +911,6 @@ static int find_sdca_control_value(struct device *dev, struct sdca_entity *entitreturn 0 ; } -/* -* TODO: Add support for -cn- properties, allowing different channels to have -* different defaults etc. -*/ static int find_sdca_entity_control (struct device *dev,struct sdca_entity *entity,struct fwnode_handle *control_node,struct sdca_control *control)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 303/781 ASoC: SDCA: Handle volatile controls correctly
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 9fad74b79e5ff353fe156c4b685cceffa5afdb1d ]
There are very few volatile controls in SDCA that are exported as ALSA controls, typically Detected Mode is the only common one. However, the current code does not resume the device when these ALSA controls are accessed, which will result in the read/write failing.
Add a new wrapper specifically for volatile controls that will do the required pm_runtime operations before accessing the register.
--- sound/soc/sdca/sdca_asoc.c | 52 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 50 insertions(+), 2 deletions(-)
sound/soc/sdca/sdca_asoc.c +50 -2
@@ -16,6 +16,7 @@#include <linux/minmax.h> #include <linux/module.h> #include <linux/overflow.h> +#include <linux/pm_runtime.h> #include <linux/regmap.h> #include <linux/soundwire/sdw_registers.h> #include <linux/string_helpers.h>
@@ -792,6 +793,48 @@ static int control_limit_kctl(struct device *dev,return 0 ; } +static int volatile_get_volsw (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *component =snd_kcontrol_chip (kcontrol); +struct device *dev = component->dev; +int ret; + + ret =pm_runtime_resume_and_get (dev); +if (ret <0 ) { +dev_err (dev,"failed to resume reading %s: %d\n" , + kcontrol->id.name, ret); +return ret; + } + + ret =snd_soc_get_volsw (kcontrol, ucontrol); + +pm_runtime_put (dev); + +return ret; +} + +static int volatile_put_volsw (struct snd_kcontrol *kcontrol, +struct snd_ctl_elem_value *ucontrol) +{ +struct snd_soc_component *component =snd_kcontrol_chip (kcontrol); +struct device *dev = component->dev; +int ret; + + ret =pm_runtime_resume_and_get (dev); +if (ret <0 ) { +dev_err (dev,"failed to resume writing %s: %d\n" , + kcontrol->id.name, ret); +return ret; + } + + ret =snd_soc_put_volsw (kcontrol, ucontrol); + +pm_runtime_put (dev); + +return ret; +} + static int populate_control(struct device *dev, struct sdca_function_data *function, struct sdca_entity *entity,
@@ -849,8 +892,13 @@ static int populate_control(struct device *dev, (*kctl)->private_value = (unsigned long )mc; (*kctl)->iface =SNDRV_CTL_ELEM_IFACE_MIXER ; (*kctl)->info = snd_soc_info_volsw; - (*kctl)->get = snd_soc_get_volsw; - (*kctl)->put = snd_soc_put_volsw; +if (control->is_volatile) { + (*kctl)->get = volatile_get_volsw; + (*kctl)->put = volatile_put_volsw; + }else { + (*kctl)->get = snd_soc_get_volsw; + (*kctl)->put = snd_soc_put_volsw; + }if (readonly_control (control)) (*kctl)->access =SNDRV_CTL_ELEM_ACCESS_READ ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 304/781 ASoC: SDCA: Factor out jack handling into new c file
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 3addd63d1fba8d9013e00b06d9420e39271c0c4e ]
The jack code is perhaps a bit large for being in the interrupt code directly. Improve the encapsulation by factoring out the jack handling code into a new c file, as is already done for HID and FDL. Whilst doing so also add a jack_state structure to hold the jack state for improved expandability in the future.
Stable-dep-of: d7730c44b7dd ("ASoC: SDCA: Still process most of the jack detect if control is missing")
--- include/sound/sdca_jack.h | 27 ++++++ sound/soc/sdca/Makefile | 2 +- sound/soc/sdca/sdca_interrupts.c | 83 ++---------------- sound/soc/sdca/sdca_jack.c | 140 +++++++++++++++++++++++++++++++ 4 files changed, 175 insertions(+), 77 deletions(-) create mode 100644 include/sound/sdca_jack.h create mode 100644 sound/soc/sdca/sdca_jack.c
include/sound/sdca_jack.h new file +27 -0
@@ -0,0 +1,27 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* The MIPI SDCA specification is available for public downloads at +* https://www.mipi.org/mipi-sdca-v1-0-download +* +* Copyright (C) 2025 Cirrus Logic, Inc. and +* Cirrus Logic International Semiconductor Ltd. +*/ + +#ifndef __SDCA_JACK_H__ +#define __SDCA_JACK_H__ + +struct sdca_interrupt ; +struct snd_kcontrol ; + +/** +* struct jack_state - Jack state structure to keep data between interrupts +* @kctl: Pointer to the ALSA control attached to this jack +*/ +struct jack_state { +struct snd_kcontrol *kctl; +}; + +int sdca_jack_alloc_state (struct sdca_interrupt *interrupt); +int sdca_jack_process (struct sdca_interrupt *interrupt); + +#endif // __SDCA_JACK_H__
sound/soc/sdca/Makefile +1 -1
@@ -3,7 +3,7 @@ snd-soc-sdca-y := sdca_functions.o sdca_device.o sdca_function_device.o \ sdca_regmap.o sdca_asoc.o sdca_ump.o snd-soc-sdca-$(CONFIG_SND_SOC_SDCA_HID) += sdca_hid.o -snd-soc-sdca-$(CONFIG_SND_SOC_SDCA_IRQ) += sdca_interrupts.o +snd-soc-sdca-$(CONFIG_SND_SOC_SDCA_IRQ) += sdca_interrupts.o sdca_jack.o snd-soc-sdca-$(CONFIG_SND_SOC_SDCA_FDL) += sdca_fdl.o snd-soc-sdca-class-y := sdca_class.o
sound/soc/sdca/sdca_interrupts.c +7 -76
109 lines not on this page · raw message
sound/soc/sdca/sdca_jack.c new file +140 -0
140 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 305/781 ASoC: SDCA: Add ability to connect SDCA jacks to ASoC jacks
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 82e12800f563baf663277ef0017f40a335b8e84c ]
Add handling for the ASoC jack API to SDCA to allow user-space to be hooked up normally.
Stable-dep-of: d7730c44b7dd ("ASoC: SDCA: Still process most of the jack detect if control is missing")
--- include/sound/sdca_jack.h | 5 ++ sound/soc/sdca/sdca_jack.c | 106 ++++++++++++++++++++++++++++++++++++- 2 files changed, 110 insertions(+), 1 deletion(-)
include/sound/sdca_jack.h +5 -0
@@ -12,16 +12,21 @@struct sdca_interrupt ;struct snd_kcontrol ; +struct snd_soc_jack ;/** * struct jack_state - Jack state structure to keep data between interrupts * @kctl: Pointer to the ALSA control attached to this jack +* @jack: Pointer to the ASoC jack struct for this jack */ struct jack_state {struct snd_kcontrol *kctl; +struct snd_soc_jack *jack; };int sdca_jack_alloc_state (struct sdca_interrupt *interrupt);int sdca_jack_process (struct sdca_interrupt *interrupt); +int sdca_jack_set_jack (struct sdca_interrupt_info *info,struct snd_soc_jack *jack); +int sdca_jack_report (struct sdca_interrupt *interrupt);#endif // __SDCA_JACK_H__
sound/soc/sdca/sdca_jack.c +105 -1
126 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 306/781 ASoC: SDCA: Still process most of the jack detect if control is missing
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit d7730c44b7dddbc5063505ce9e0c21d8bf298368 ]
DAPM creates its controls very late in the card creation, so there is no call into the driver after the controls are created. This means the jack IRQs can't be guaranteed to be registered after the ALSA controls are available. If a jack IRQ is received before the controls are available, currently the driver does not update the Selected Mode as it is required by the specification to do.
If the ALSA controls are not available update the Selected Mode directly rather than going through the ALSA control. The ALSA control should pick up the state once it is created.
--- sound/soc/sdca/sdca_jack.c | 52 ++++++++++++++++++++------------------ 1 file changed, 28 insertions(+), 24 deletions(-)
sound/soc/sdca/sdca_jack.c +28 -24
@@ -41,10 +41,11 @@ int sdca_jack_process(struct sdca_interrupt *interrupt)struct jack_state *state = interrupt->priv;struct snd_kcontrol *kctl = state->kctl; struct snd_ctl_elem_value *ucontrol __free(kfree) = NULL; -struct soc_enum *soc_enum;unsigned int reg, val;int ret; +guard (rwsem_write)(rwsem); +if (!kctl) { const char *name __free(kfree) = kasprintf(GFP_KERNEL, "%s %s", interrupt->entity->label,
@@ -54,16 +55,12 @@ int sdca_jack_process(struct sdca_interrupt *interrupt)return -ENOMEM ; kctl =snd_soc_component_get_kcontrol (component, name); -if (!kctl) { +if (!kctl)dev_dbg (dev,"control not found: %s\n" , name); -return -ENOENT ; - } - - state->kctl = kctl; +else + state->kctl = kctl; } - soc_enum = (struct soc_enum *)kctl->private_value; - reg =SDW_SDCA_CTL (interrupt->function->desc->adr, interrupt->entity->id, interrupt->control->sel,0 );
@@ -73,13 +70,12 @@ int sdca_jack_process(struct sdca_interrupt *interrupt)return ret; } + reg =SDW_SDCA_CTL (interrupt->function->desc->adr, interrupt->entity->id, +SDCA_CTL_GE_SELECTED_MODE ,0 ); +switch (val) {case SDCA_DETECTED_MODE_DETECTION_IN_PROGRESS :case SDCA_DETECTED_MODE_JACK_UNKNOWN : - reg =SDW_SDCA_CTL (interrupt->function->desc->adr, - interrupt->entity->id, -SDCA_CTL_GE_SELECTED_MODE ,0 ); -/* * Selected mode is not normally marked as volatile register * (RW), but here force a read from the hardware. If the
@@ -100,21 +96,29 @@ int sdca_jack_process(struct sdca_interrupt *interrupt)dev_dbg (dev,"%s: %#x\n" , interrupt->name, val); - ucontrol =kzalloc (sizeof (*ucontrol),GFP_KERNEL ); -if (!ucontrol) -return -ENOMEM ; +if (kctl) { +struct soc_enum *soc_enum = (struct soc_enum *)kctl->private_value; + + ucontrol =kzalloc (sizeof (*ucontrol),GFP_KERNEL ); +if (!ucontrol) +return -ENOMEM ; - ucontrol->value.enumerated.item[0 ] =snd_soc_enum_val_to_item (soc_enum, val); + ucontrol->value.enumerated.item[0 ] =snd_soc_enum_val_to_item (soc_enum, val); -down_write (rwsem); - ret = kctl->put (kctl, ucontrol); -up_write (rwsem); -if (ret <0 ) { -dev_err (dev,"failed to update selected mode: %d\n" , ret); -return ret; - } + ret = kctl->put (kctl, ucontrol); +if (ret <0 ) { +dev_err (dev,"failed to update selected mode: %d\n" , ret); +return ret; + } -snd_ctl_notify (card->snd_card,SNDRV_CTL_EVENT_MASK_VALUE , &kctl->id); +snd_ctl_notify (card->snd_card,SNDRV_CTL_EVENT_MASK_VALUE , &kctl->id); + }else { + ret =regmap_write (interrupt->function_regmap, reg, val); +if (ret) { +dev_err (dev,"failed to write selected mode: %d\n" , ret); +return ret; + } + }return sdca_jack_report (interrupt); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 307/781 accel/amdxdna: Fix incorrect DPM level after suspend/resume
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit d19d963d2a4acb5bbf03e25733ba565a7f6e1422 ]
The suspend routine sets the DPM level to 0, which unintentionally overwrites the previously saved DPM level. As a result, the device always resumes with DPM level 0 instead of restoring the original value.
Fix this by ensuring the suspend path does not overwrite the saved DPM level, allowing the correct DPM level to be restored during resume.
--- drivers/accel/amdxdna/aie2_pm.c | 3 +++ drivers/accel/amdxdna/aie2_smu.c | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/accel/amdxdna/aie2_pm.c +3 -0
@@ -36,6 +36,8 @@ int aie2_pm_set_dpm(struct amdxdna_dev_hdl *ndev, u32 dpm_level)return ret; ret = ndev->priv->hw_ops.set_dpm (ndev, dpm_level); +if (!ret) + ndev->dpm_level = dpm_level;amdxdna_pm_suspend_put (ndev->xdna);return ret;
@@ -65,6 +67,7 @@ int aie2_pm_init(struct amdxdna_dev_hdl *ndev) ret = ndev->priv->hw_ops.set_dpm (ndev, ndev->max_dpm_level);if (ret)return ret; + ndev->dpm_level = ndev->max_dpm_level; ret =aie2_pm_set_clk_gating (ndev,AIE2_CLK_GATING_ENABLE );if (ret)
drivers/accel/amdxdna/aie2_smu.c +0 -2
@@ -84,7 +84,6 @@ int npu1_set_dpm(struct amdxdna_dev_hdl *ndev, u32 dpm_level) } ndev->hclk_freq = freq; - ndev->dpm_level = dpm_level; ndev->max_tops =2 * ndev->total_col; ndev->curr_tops = ndev->max_tops * freq /1028 ;
@@ -114,7 +113,6 @@ int npu4_set_dpm(struct amdxdna_dev_hdl *ndev, u32 dpm_level) ndev->npuclk_freq = ndev->priv->dpm_clk_tbl[dpm_level].npuclk; ndev->hclk_freq = ndev->priv->dpm_clk_tbl[dpm_level].hclk; - ndev->dpm_level = dpm_level; ndev->max_tops =NPU4_DPM_TOPS (ndev, ndev->max_dpm_level); ndev->curr_tops =NPU4_DPM_TOPS (ndev, dpm_level);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 308/781 accel/amdxdna: Move RPM resume into job run function
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit 69674c1c704c0199ca7a3947f3cdcd575973175d ]
Currently, amdxdna_pm_resume_get() is called during job creation, and amdxdna_pm_suspend_put() is called when the hardware notifies job completion. If a job is canceled before it is run, no hardware completion notification is generated, resulting in an unbalanced runtime PM resume/suspend pair.
Fix this by moving amdxdna_pm_resume_get() to the job run path, ensuring runtime PM is only resumed for jobs that are actually executed.
--- drivers/accel/amdxdna/aie2_ctx.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/accel/amdxdna/aie2_ctx.c +9 -10
@@ -306,6 +306,10 @@ aie2_sched_job_run(struct drm_sched_job *sched_job)kref_get (&job->refcnt); fence =dma_fence_get (job->fence); + ret =amdxdna_pm_resume_get (hwctx->client->xdna); +if (ret) + goto out; +if (job->drv_cmd) {switch (job->drv_cmd->opcode) {case SYNC_DEBUG_BO :
@@ -332,6 +336,7 @@ aie2_sched_job_run(struct drm_sched_job *sched_job) out:if (ret) { +amdxdna_pm_suspend_put (hwctx->client->xdna);dma_fence_put (job->fence);aie2_job_put (job);mmput (job->mm);
@@ -988,15 +993,11 @@ int aie2_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job, goto free_chain; } - ret =amdxdna_pm_resume_get (xdna); -if (ret) - goto cleanup_job; - retry: ret =drm_gem_lock_reservations (job->bos, job->bo_cnt, &acquire_ctx);if (ret) {XDNA_WARN (xdna,"Failed to lock BOs, ret %d" , ret); - goto suspend_put; + goto cleanup_job; }for (i =0 ; i < job->bo_cnt; i++) {
@@ -1004,7 +1005,7 @@ int aie2_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job,if (ret) {XDNA_WARN (xdna,"Failed to reserve fences %d" , ret);drm_gem_unlock_reservations (job->bos, job->bo_cnt, &acquire_ctx); - goto suspend_put; + goto cleanup_job; } }
@@ -1019,12 +1020,12 @@ int aie2_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job,msecs_to_jiffies (HMM_RANGE_DEFAULT_TIMEOUT ); }else if (time_after (jiffies, timeout)) { ret = -ETIME ; - goto suspend_put; + goto cleanup_job; } ret =aie2_populate_range (abo);if (ret) - goto suspend_put; + goto cleanup_job; goto retry; } }
@@ -1050,8 +1051,6 @@ int aie2_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job,return 0 ; -suspend_put: -amdxdna_pm_suspend_put (xdna); cleanup_job:drm_sched_job_cleanup (&job->base); free_chain:
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 309/781 ASoC: cs4271: Fix resource leak in cs4271_soc_resume()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
[ Upstream commit fef1f756155c30511397bbcd9d55640ab2e44d99 ]
Smatch detects this resource leak:
sound/soc/codecs/cs4271.c:548 cs4271_soc_resume() warn:
'cs4271->clk' from clk_prepare_enable() not released on lines: 540,546.
Instead of direct returns, unprepare the clock and disable regulators on the error paths.
--- sound/soc/codecs/cs4271.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
sound/soc/codecs/cs4271.c +9 -3
@@ -528,7 +528,7 @@ static int cs4271_soc_resume(struct snd_soc_component *component) ret =clk_prepare_enable (cs4271->clk);if (ret) {dev_err (component->dev,"Failed to enable clk: %d\n" , ret); -return ret; + goto err_disable_regulators; }/* Do a proper reset after power up */
@@ -537,15 +537,21 @@ static int cs4271_soc_resume(struct snd_soc_component *component)/* Restore codec state */ ret =regcache_sync (cs4271->regmap);if (ret <0 ) -return ret; + goto err_disable_clk;/* then disable the power-down bit */ ret =regmap_update_bits (cs4271->regmap,CS4271_MODE2 ,CS4271_MODE2_PDN ,0 );if (ret <0 ) -return ret; + goto err_disable_clk;return 0 ; + +err_disable_clk: +clk_disable_unprepare (cs4271->clk); +err_disable_regulators: +regulator_bulk_disable (ARRAY_SIZE (cs4271->supplies), cs4271->supplies); + return ret; }#else #define cs4271_soc_suspend NULL
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 310/781 vsnprintf: drop __printf() attributes on binary printing functions
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit b07829d546c83134629591f02c5348d57cea0c1e ]
The printf() format attributes are applied inconsistently for the binary printf helpers, which causes warnings for the bpf_trace code using them from functions that pass down format strings:
kernel/trace/bpf_trace.c: In function '____bpf_trace_printk':
kernel/trace/bpf_trace.c:377:9: error: function '____bpf_trace_printk' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format]
377 | ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt, data.bin_args);
| ^~~
This can be addressed either by annotating all five callers in bpf code, or by removing the annotations on the callees that were added by Andy Shevchenko last year.
As Alexei Starovoitov points out, there are no callers in C code that would benefit from the __printf attributes, the only users are in BPF code or in the do_trace_printk() helper that already checks the arguments.
Drop all three of these annotations, reverting the earlierl commits that added these, in order to get a clean build with -Wsuggest-attribute=format.
--- include/linux/seq_file.h | 1 - include/linux/string.h | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-)
include/linux/seq_file.h +0 -1
@@ -181,7 +181,6 @@ int seq_open_private(struct file *, const struct seq_operations *, int);int seq_release_private (struct inode *,struct file *);#ifdef CONFIG_BINARY_PRINTF -__printf(2, 0)void seq_bprintf (struct seq_file *m,const char *f,const u32 *binary);#endif
include/linux/string.h +2 -2
@@ -336,8 +336,8 @@ int __sysfs_match_string(const char * const *array, size_t n, const char *s);#define sysfs_match_string (_a, _s) __sysfs_match_string(_a, ARRAY_SIZE(_a), _s)#ifdef CONFIG_BINARY_PRINTF -__printf(3, 0) int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args); -__printf(3, 0) int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf); +int vbin_printf (u32 *bin_buf,size_t size,const char *fmt,va_list args); +int bstr_printf (char *buf,size_t size,const char *fmt,const u32 *bin_buf);#endif extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 311/781 ALSA: oss: delete self assignment
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit ee1afacc356c84bba4b89e0655ffdcfa84d4f714 ]
No need to assign "uctl" to itself. Delete it.
--- sound/core/oss/mixer_oss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/oss/mixer_oss.c +1 -1
@@ -792,7 +792,7 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned struct snd_ctl_elem_info *uinfo __free(kfree) =kzalloc (sizeof (*uinfo),GFP_KERNEL ); struct snd_ctl_elem_value *uctl __free(kfree) = - uctl =kzalloc (sizeof (*uctl),GFP_KERNEL ); +kzalloc (sizeof (*uctl),GFP_KERNEL );if (uinfo ==NULL || uctl ==NULL )return -ENOMEM ;guard (rwsem_read)(&card->controls_rwsem);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 312/781 spi: tools: Add include folder to .gitignore
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <[email protected]>
[ Upstream commit 5af56f30c4fcbade4a92f94dadfea517d1db9703 ]
The Makefile for the SPI tools creates an include/linux/spi folder and some symlinks inside it. After running make -C spi/tools, this folder shows up as untracked in the git status.
Add the above folder to the .gitignore file.
--- tools/spi/.gitignore | 1 + 1 file changed, 1 insertion(+)
tools/spi/.gitignore +1 -0
@@ -1,3 +1,4 @@ # SPDX-License-Identifier: GPL-2.0-only spidev_fdx spidev_test +include/
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 313/781 Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 8bde3e395a85017f12af2b0ba5c3684f5af9c006 ]
This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.
Jean Delvare points out that the patch does not completely fix the reported problem, that it in fact introduces a (new) race condition, and that it may actually not be needed in the first place.
Various AI reviews agree. Specific and relevant AI feedback:
"
This reordering sets the driver data to NULL before removing the sensor attributes in the loop below.
ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but does not check if it is NULL before dereferencing it to access data->sensors[].
If a userspace process reads a sensor file (like temp1_input) while this delete function is running, could it race with the dev_set_drvdata(..., NULL) call here and crash in ibmpex_show_sensor()?
Would it be safer to keep the original order where device_remove_file() is called before clearing the driver data? device_remove_file() should wait for any active sysfs callbacks to complete, which might already prevent the use-after-free this patch intends to fix.
"
Revert the offending patch. If it can be shown that the originally reported alleged race condition does indeed exist, it can always be re-introduced with a complete fix.
--- drivers/hwmon/ibmpex.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/hwmon/ibmpex.c +2 -7
@@ -277,9 +277,6 @@ static ssize_t ibmpex_high_low_store(struct device *dev, {struct ibmpex_bmc_data *data =dev_get_drvdata (dev); -if (!data) -return -ENODEV ; -ibmpex_reset_high_low_data (data);return count;
@@ -511,9 +508,6 @@ static void ibmpex_bmc_delete(struct ibmpex_bmc_data *data) {int i, j; -hwmon_device_unregister (data->hwmon_dev); -dev_set_drvdata (data->bmc_device,NULL ); -device_remove_file (data->bmc_device, &sensor_dev_attr_reset_high_low.dev_attr);device_remove_file (data->bmc_device, &dev_attr_name.attr);
@@ -527,7 +521,8 @@ static void ibmpex_bmc_delete(struct ibmpex_bmc_data *data) }list_del (&data->list); - +dev_set_drvdata (data->bmc_device,NULL ); +hwmon_device_unregister (data->hwmon_dev);ipmi_destroy_user (data->user);kfree (data->sensors);kfree (data);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 314/781 hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carl Lee <[email protected]>
[ Upstream commit 9e33c1dba22431bea9b2bf48adf56859e52fc7ec ]
When MPQ8785 reports VOUT_MODE as VID mode, mpq8785_identify() configures the driver for direct mode. The subsequent pmbus_identify_common() check then fails due to a mismatch between the reported mode and the configured mode, causing device initialization to fail.
Override the reported VOUT_MODE to direct mode to keep the driver configuration consistent with the reported mode and allow successful device initialization.
This does not change how voltages are interpreted, but avoids a false identification failure caused by mismatched mode handling.
--- drivers/hwmon/pmbus/mpq8785.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/hwmon/pmbus/mpq8785.c +28 -0
@@ -47,6 +47,33 @@ static int mpq8785_identify(struct i2c_client *client,return 0 ; }; +static int mpq8785_read_byte_data (struct i2c_client *client,int page,int reg) +{ +int ret; + +switch (reg) { +case PMBUS_VOUT_MODE : + ret =pmbus_read_byte_data (client, page, reg); +if (ret <0 ) +return ret; + +if ((ret >>5 ) ==1 ) { +/* +* The MPQ8785 chip reports VOUT_MODE as VID mode, but the driver +* treats VID as direct mode. Without this, identification would fail +* due to mode mismatch. +* This override ensures the reported mode matches the driver +* configuration, allowing successful initialization. +*/ +return PB_VOUT_MODE_DIRECT ; + } + +return ret; +default : +return -ENODATA ; + } +} +static int mpm82504_read_word_data (struct i2c_client *client,int page,int phase,int reg) {
@@ -129,6 +156,7 @@ static int mpq8785_probe(struct i2c_client *client)break ;case mpq8785: info->identify = mpq8785_identify; + info->read_byte_data = mpq8785_read_byte_data;break ;default :return -ENODEV ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 315/781 PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 7f0cdcddf8bef1c8c18f9be6708073fd3790a20f ]
In mtk_pcie_init_irq_domain(), if mtk_pcie_allocate_msi_domains() fails after port->irq_domain has been successfully created via irq_domain_create_linear(), the function returns directly without cleaning up the allocated IRQ domain, resulting in a resource leak.
Add irq_domain_remove() call in the error path to properly release the INTx IRQ domain before returning the error.
--- drivers/pci/controller/pcie-mediatek.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/controller/pcie-mediatek.c +3 -1
@@ -585,8 +585,10 @@ static int mtk_pcie_init_irq_domain(struct mtk_pcie_port *port,if (IS_ENABLED (CONFIG_PCI_MSI )) { ret =mtk_pcie_allocate_msi_domains (port); -if (ret) +if (ret) { +irq_domain_remove (port->irq_domain);return ret; + } }return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 316/781 wifi: rtw89: correct use sequence of driver_data in skb->info
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit d3a9e132a4c6273a5254e743da14887502e928c8 ]
As ieee80211_tx_info is used to assist filling TX descriptor, and layout of IEEE80211_SKB_CB(skb)->driver_data (accessing by RTW89_TX_SKB_CB()) is union, so driver_data must be used by/after rtw89_hci_tx_write() or just before calling rtw89_hci_tx_write(). Otherwise, ieee80211_tx_info::control data is overwritten.
Found this by using injected packets which uses ieee80211_tx_info::control, but always sending incorrect data rate.
--- drivers/net/wireless/realtek/rtw89/core.c | 6 ++++-- drivers/net/wireless/realtek/rtw89/core.h | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/core.c +4 -2
@@ -1207,7 +1207,7 @@ rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev,if (addr_cam->valid && desc_info->mlo) upd_wlan_hdr = true; -if (rtw89_is_tx_rpt_skb (rtwdev, tx_req->skb)) +if (info->flags &IEEE80211_TX_CTL_REQ_TX_STATUS || tx_req->with_wait)rtw89_tx_rpt_init (rtwdev, tx_req); is_bmc = (is_broadcast_ether_addr(hdr->addr1) ||
@@ -1342,13 +1342,15 @@ static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev, tx_req.rtwvif_link = rtwvif_link; tx_req.rtwsta_link = rtwsta_link; tx_req.desc_info.sw_mld = sw_mld; -rcu_assign_pointer (skb_data->wait, wait); + tx_req.with_wait = !!wait;rtw89_traffic_stats_accu (rtwdev, rtwvif, skb, true, true);rtw89_wow_parse_akm (rtwdev, skb);rtw89_core_tx_update_desc_info (rtwdev, &tx_req);rtw89_core_tx_wake (rtwdev, &tx_req); +rcu_assign_pointer (skb_data->wait, wait); + ret =rtw89_hci_tx_write (rtwdev, &tx_req);if (ret) {rtw89_err (rtwdev,"failed to transmit skb to HCI\n" );
drivers/net/wireless/realtek/rtw89/core.h +2 -0
@@ -1211,6 +1211,8 @@ struct rtw89_core_tx_request {struct rtw89_vif_link *rtwvif_link;struct rtw89_sta_link *rtwsta_link;struct rtw89_tx_desc_info desc_info; + +bool with_wait; };struct rtw89_txq {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 317/781 PCI: xilinx: Fix INTx IRQ domain leak in error paths
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit f42b3c053b1554d66af6fe45bb1ef357464c0456 ]
In xilinx_pcie_init_irq_domain(), if xilinx_allocate_msi_domains() fails after pcie->leg_domain has been successfully created via irq_domain_create_linear(), the function returns directly without cleaning up the allocated IRQ domain, resulting in a resource leak. In xilinx_free_msi_domains(), pcie->leg_domain is also neglected.
Add irq_domain_remove() call in the error path to properly release the IRQ domain before returning the error. Also rename xilinx_free_msi_domains() to xilinx_free_irq_domains() and add the release of pcie->leg_domain to it.
--- drivers/pci/controller/pcie-xilinx.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/pci/controller/pcie-xilinx.c +6 -3
@@ -302,9 +302,10 @@ static int xilinx_allocate_msi_domains(struct xilinx_pcie *pcie)return 0 ; } -static void xilinx_free_msi_domains (struct xilinx_pcie *pcie) +static void xilinx_free_irq_domains (struct xilinx_pcie *pcie) {irq_domain_remove (pcie->msi_domain); +irq_domain_remove (pcie->leg_domain); }/* INTx Functions */
@@ -480,8 +481,10 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie *pcie)phys_addr_t pa =ALIGN_DOWN (virt_to_phys (pcie),SZ_4K ); ret =xilinx_allocate_msi_domains (pcie); -if (ret) +if (ret) { +irq_domain_remove (pcie->leg_domain);return ret; + }pcie_write (pcie,upper_32_bits (pa),XILINX_PCIE_REG_MSIBASE1 );pcie_write (pcie,lower_32_bits (pa),XILINX_PCIE_REG_MSIBASE2 );
@@ -600,7 +603,7 @@ static int xilinx_pcie_probe(struct platform_device *pdev) err =pci_host_probe (bridge);if (err) -xilinx_free_msi_domains (pcie); +xilinx_free_irq_domains (pcie);return err; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 318/781 Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baruch Siach <[email protected]>
[ Upstream commit ad0c6da5be901f5c181490f683d22b416059bccb ]
Fix copy & paste errors by changing the references from 'ntb' to 'vntb'.
--- Documentation/PCI/endpoint/pci-vntb-howto.rst | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
Documentation/PCI/endpoint/pci-vntb-howto.rst +7 -7
@@ -52,14 +52,14 @@ pci-epf-vntb device, the following commands can be used:: # cd /sys/kernel/config/pci_ep/ # mkdir functions/pci_epf_vntb/func1 -The "mkdir func1" above creates the pci-epf-ntb function device that will +The "mkdir func1" above creates the pci-epf-vntb function device that will be probed by pci_epf_vntb driver. The PCI endpoint framework populates the directory with the following configurable fields:: - # ls functions/pci_epf_ntb/func1 - baseclass_code deviceid msi_interrupts pci-epf-ntb.0 + # ls functions/pci_epf_vntb/func1 + baseclass_code deviceid msi_interrupts pci-epf-vntb.0 progif_code secondary subsys_id vendorid cache_line_size interrupt_pin msix_interrupts primary revid subclass_code subsys_vendor_id
@@ -111,13 +111,13 @@ A sample configuration for virtual NTB driver for virtual PCI bus:: # echo 0x080A > functions/pci_epf_vntb/func1/pci_epf_vntb.0/vntb_pid # echo 0x10 > functions/pci_epf_vntb/func1/pci_epf_vntb.0/vbus_number -Binding pci-epf-ntb Device to EP Controller +Binding pci-epf-vntb Device to EP Controller -------------------------------------------- NTB function device should be attached to PCI endpoint controllers connected to the host. - # ln -s controllers/5f010000.pcie_ep functions/pci-epf-ntb/func1/primary + # ln -s controllers/5f010000.pcie_ep functions/pci_epf_vntb/func1/primary Once the above step is completed, the PCI endpoint controllers are ready to establish a link with the host.
@@ -139,7 +139,7 @@ lspci Output at Host side ------------------------- Note that the devices listed here correspond to the values populated in -"Creating pci-epf-ntb Device" section above:: +"Creating pci-epf-vntb Device" section above:: # lspci 00:00.0 PCI bridge: Freescale Semiconductor Inc Device 0000 (rev 01)
@@ -152,7 +152,7 @@ lspci Output at EP Side / Virtual PCI bus ----------------------------------------- Note that the devices listed here correspond to the values populated in -"Creating pci-epf-ntb Device" section above:: +"Creating pci-epf-vntb Device" section above:: # lspci 10:00.0 Unassigned class [ffff]: Dawicontrol Computersysteme GmbH Device 1234 (rev ff)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 319/781 PCI: Add WQ_PERCPU to alloc_workqueue() users
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Crivellari <[email protected]>
[ Upstream commit 78f5d0d5a23dd81106cbe999d9dcd522964a8f1a ]
Currently work items enqueued by schedule_delayed_work() use "system_wq" (a per-CPU wq), while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a CPU is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API.
alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND.
This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they're needed and reducing noise when CPUs are isolated.
This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue() flag in:
128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")
Add WQ_PERCPU to explicitly request alloc_workqueue() to be per-CPU when WQ_UNBOUND has not been specified.
With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn't explicitly specify WQ_UNBOUND must now use WQ_PERCPU.
Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default.
Stable-dep-of: 03f336a869b3 ("PCI: endpoint: Add missing NULL check for alloc_workqueue()")
--- drivers/pci/endpoint/functions/pci-epf-mhi.c | 2 +- drivers/pci/endpoint/functions/pci-epf-ntb.c | 4 ++-- drivers/pci/endpoint/functions/pci-epf-test.c | 2 +- drivers/pci/endpoint/functions/pci-epf-vntb.c | 4 ++-- drivers/pci/hotplug/pnv_php.c | 2 +- drivers/pci/hotplug/shpchp_core.c | 3 ++- 6 files changed, 9 insertions(+), 8 deletions(-)
drivers/pci/endpoint/functions/pci-epf-mhi.c +1 -1
@@ -686,7 +686,7 @@ static int pci_epf_mhi_dma_init(struct pci_epf_mhi *epf_mhi) goto err_release_tx; } - epf_mhi->dma_wq =alloc_workqueue ("pci_epf_mhi_dma_wq" ,0 ,0 ); + epf_mhi->dma_wq =alloc_workqueue ("pci_epf_mhi_dma_wq" ,WQ_PERCPU ,0 );if (!epf_mhi->dma_wq) { ret = -ENOMEM ; goto err_release_rx;
drivers/pci/endpoint/functions/pci-epf-ntb.c +2 -2
@@ -2124,8 +2124,8 @@ static int __init epf_ntb_init(void) {int ret; - kpcintb_workqueue =alloc_workqueue ("kpcintb" ,WQ_MEM_RECLAIM | -WQ_HIGHPRI ,0 ); + kpcintb_workqueue =alloc_workqueue ("kpcintb" , +WQ_MEM_RECLAIM |WQ_HIGHPRI |WQ_PERCPU ,0 ); ret =pci_epf_register_driver (&epf_ntb_driver);if (ret) {destroy_workqueue (kpcintb_workqueue);
drivers/pci/endpoint/functions/pci-epf-test.c +1 -1
@@ -1188,7 +1188,7 @@ static int __init pci_epf_test_init(void)int ret; kpcitest_workqueue =alloc_workqueue ("kpcitest" , -WQ_MEM_RECLAIM |WQ_HIGHPRI ,0 ); +WQ_MEM_RECLAIM |WQ_HIGHPRI |WQ_PERCPU ,0 );if (!kpcitest_workqueue) {pr_err ("Failed to allocate the kpcitest work queue\n" );return -ENOMEM ;
drivers/pci/endpoint/functions/pci-epf-vntb.c +2 -2
@@ -1651,8 +1651,8 @@ static int __init epf_ntb_init(void) {int ret; - kpcintb_workqueue =alloc_workqueue ("kpcintb" ,WQ_MEM_RECLAIM | -WQ_HIGHPRI ,0 ); + kpcintb_workqueue =alloc_workqueue ("kpcintb" , +WQ_MEM_RECLAIM |WQ_HIGHPRI |WQ_PERCPU ,0 ); ret =pci_epf_register_driver (&epf_ntb_driver);if (ret) {destroy_workqueue (kpcintb_workqueue);
drivers/pci/hotplug/pnv_php.c +1 -1
@@ -802,7 +802,7 @@ static struct pnv_php_slot *pnv_php_alloc_slot(struct device_node *dn) }/* Allocate workqueue for this slot's interrupt handling */ - php_slot->wq =alloc_workqueue ("pciehp-%s" ,0 ,0 , php_slot->name); + php_slot->wq =alloc_workqueue ("pciehp-%s" ,WQ_PERCPU ,0 , php_slot->name);if (!php_slot->wq) {SLOT_WARN (php_slot,"Cannot alloc workqueue\n" );kfree (php_slot->name);
drivers/pci/hotplug/shpchp_core.c +2 -1
@@ -80,7 +80,8 @@ static int init_slots(struct controller *ctrl) slot->device = ctrl->slot_device_offset + i; slot->number = ctrl->first_slot + (ctrl->slot_num_inc * i); - slot->wq =alloc_workqueue ("shpchp-%d" ,0 ,0 , slot->number); + slot->wq =alloc_workqueue ("shpchp-%d" ,WQ_PERCPU ,0 , + slot->number);if (!slot->wq) { retval = -ENOMEM ; goto error_slot;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 320/781 PCI: endpoint: Add missing NULL check for alloc_workqueue()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <[email protected]>
[ Upstream commit 03f336a869b3a3f119d3ae52ac9723739c7fb7b6 ]
alloc_workqueue() can return NULL on memory allocation failure. Without proper error checking, this may lead to a NULL pointer dereference when queue_work() is later called with the NULL workqueue pointer in epf_ntb_epc_init().
Add a NULL check immediately after alloc_workqueue() and return -ENOMEM on failure to prevent the driver from loading with an invalid workqueue pointer.
--- drivers/pci/endpoint/functions/pci-epf-ntb.c | 5 +++++ drivers/pci/endpoint/functions/pci-epf-vntb.c | 5 +++++ 2 files changed, 10 insertions(+)
drivers/pci/endpoint/functions/pci-epf-ntb.c +5 -0
@@ -2126,6 +2126,11 @@ static int __init epf_ntb_init(void) kpcintb_workqueue =alloc_workqueue ("kpcintb" ,WQ_MEM_RECLAIM |WQ_HIGHPRI |WQ_PERCPU ,0 ); +if (!kpcintb_workqueue) { +pr_err ("Failed to allocate kpcintb workqueue\n" ); +return -ENOMEM ; + } + ret =pci_epf_register_driver (&epf_ntb_driver);if (ret) {destroy_workqueue (kpcintb_workqueue);
drivers/pci/endpoint/functions/pci-epf-vntb.c +5 -0
@@ -1653,6 +1653,11 @@ static int __init epf_ntb_init(void) kpcintb_workqueue =alloc_workqueue ("kpcintb" ,WQ_MEM_RECLAIM |WQ_HIGHPRI |WQ_PERCPU ,0 ); +if (!kpcintb_workqueue) { +pr_err ("Failed to allocate kpcintb workqueue\n" ); +return -ENOMEM ; + } + ret =pci_epf_register_driver (&epf_ntb_driver);if (ret) {destroy_workqueue (kpcintb_workqueue);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 321/781 PCI: rzg3s-host: Use pci_generic_config_write() for the root bus
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <[email protected]>
[ Upstream commit 4b86eff47e205819eb862097493ec20e25ac8f56 ]
The Renesas RZ/G3S host controller allows writing to read-only PCIe configuration registers when the RZG3S_PCI_PERM_CFG_HWINIT_EN bit is set in the RZG3S_PCI_PERM register. However, callers of struct pci_ops::write expect the semantics defined by the PCIe specification, meaning that writes to read-only registers must not be allowed.
The previous custom struct pci_ops::write implementation for the root bus temporarily enabled write access before calling pci_generic_config_write(). This breaks the expected semantics.
Remove the custom implementation and simply use pci_generic_config_write().
Along with this change, the updates of the PCI_PRIMARY_BUS, PCI_SECONDARY_BUS, and PCI_SUBORDINATE_BUS registers were moved so that they no longer depends on the RZG3S_PCI_PERM_CFG_HWINIT_EN bit in the RZG3S_PCI_PERM_CFG register, since these registers are R/W.
--- drivers/pci/controller/pcie-rzg3s-host.c | 27 ++++-------------------- 1 file changed, 4 insertions(+), 23 deletions(-)
drivers/pci/controller/pcie-rzg3s-host.c +4 -23
@@ -439,28 +439,9 @@ static void __iomem *rzg3s_pcie_root_map_bus(struct pci_bus *bus,return host->pcie + where; } -/* Serialized by 'pci_lock' */ -static int rzg3s_pcie_root_write (struct pci_bus *bus,unsigned int devfn, -int where,int size,u32 val) -{ -struct rzg3s_pcie_host *host = bus->sysdata; -int ret; - -/* Enable access control to the CFGU */ -writel_relaxed (RZG3S_PCI_PERM_CFG_HWINIT_EN , - host->axi +RZG3S_PCI_PERM ); - - ret =pci_generic_config_write (bus, devfn, where, size, val); - -/* Disable access control to the CFGU */ -writel_relaxed (0 , host->axi +RZG3S_PCI_PERM ); - -return ret; -} -static struct pci_ops rzg3s_pcie_root_ops = { .read = pci_generic_config_read, - .write = rzg3s_pcie_root_write, + .write = pci_generic_config_write, .map_bus = rzg3s_pcie_root_map_bus, };
@@ -1065,14 +1046,14 @@ static int rzg3s_pcie_config_init(struct rzg3s_pcie_host *host)writel_relaxed (0xffffffff , host->pcie +RZG3S_PCI_CFG_BARMSK00L );writel_relaxed (0xffffffff , host->pcie +RZG3S_PCI_CFG_BARMSK00U ); +/* Disable access control to the CFGU */ +writel_relaxed (0 , host->axi +RZG3S_PCI_PERM ); +/* Update bus info */ writeb_relaxed (primary_bus, host->pcie +PCI_PRIMARY_BUS );writeb_relaxed (secondary_bus, host->pcie +PCI_SECONDARY_BUS );writeb_relaxed (subordinate_bus, host->pcie +PCI_SUBORDINATE_BUS ); -/* Disable access control to the CFGU */ -writel_relaxed (0 , host->axi +RZG3S_PCI_PERM ); -return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 322/781 PCI/PM: Avoid redundant delays on D3hot->D3cold
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
[ Upstream commit 4d982084507d663df160546c4c48066a8887ed89 ]
When transitioning to D3cold, __pci_set_power_state() first transitions to D3hot. If the device was already in D3hot, this adds excess work:
(a) read/modify/write PMCSR; and
(b) excess delay (pci_dev_d3_sleep()).
For (b), we already performed the necessary delay on the previous D3hot entry; this was extra noticeable when evaluating runtime PM transition latency.
Check whether we're already in the target state before continuing.
Note that __pci_set_power_state() already does this same check for other state transitions, but D3cold is special because __pci_set_power_state() converts it to D3hot for the purposes of PMCSR.
This seems to be an oversight in commit 0aacdc957401 ("PCI/PM: Clean up pci_set_low_power_state()").
--- drivers/pci/pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pci/pci.c +3 -0
@@ -1488,6 +1488,9 @@ static int pci_set_low_power_state(struct pci_dev *dev, pci_power_t state, bool || (state == PCI_D2 && !dev->d2_support))return -EIO ; +if (dev->current_state == state) +return 0 ; +pci_read_config_word (dev, dev->pm_cap +PCI_PM_CTRL , &pmcsr);if (PCI_POSSIBLE_ERROR (pmcsr)) { pci_err(dev, "Unable to change power state from %s to %s, device inaccessible\n",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 323/781 wifi: cfg80211: Fix use_for flag update on BSS refresh
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huang Chenming <[email protected]>
[ Upstream commit 4073ea516106e5f98ed0476f89cdede8baa98d37 ]
Userspace may fail to connect to certain BSS that were initially marked as unusable due to regulatory restrictions (use_for = 0, e.g., 6 GHz power type mismatch). Even after these restrictions are removed and the BSS becomes usable, connection attempts still fail.
The issue occurs in cfg80211_update_known_bss() where the use_for flag is updated using bitwise AND (&=) instead of direct assignment. Once a BSS is marked with use_for = 0, the AND operation masks out any subsequent non-zero values, permanently keeping the flag at 0. This causes __cfg80211_get_bss(), invoked by nl80211_assoc_bss(), to fail the check "(bss->pub.use_for & use_for) != use_for", thereby blocking association.
Replace the bitwise AND operation with direct assignment so the use_for flag accurately reflects the current BSS state.
--- net/wireless/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/scan.c +1 -1
@@ -1959,7 +1959,7 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,ether_addr_copy (known->parent_bssid, new->parent_bssid); known->pub.max_bssid_indicator = new->pub.max_bssid_indicator; known->pub.bssid_index = new->pub.bssid_index; - known->pub.use_for &= new->pub.use_for; + known->pub.use_for = new->pub.use_for; known->pub.cannot_use_reasons = new->pub.cannot_use_reasons; known->bss_source = new->bss_source;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 324/781 PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit 6220694c52a5a04102b48109e4f24e958b559bd3 ]
When vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap() doesn't invoke percpu_ref_put() to free the per-CPU ref of pgmap acquired after gen_pool_alloc_owner(), and memunmap_pages() will hang forever when trying to remove the PCI device.
Fix it by adding the missed percpu_ref_put().
--- drivers/pci/p2pdma.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/p2pdma.c +1 -0
@@ -152,6 +152,7 @@ static int p2pmem_alloc_mmap(struct file *filp, struct kobject *kobj, ret =vm_insert_page (vma, vaddr, page);if (ret) {gen_pool_free (p2pdma->pool, (uintptr_t )kaddr, len); +percpu_ref_put (ref);return ret; }percpu_ref_get (ref);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 325/781 PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit cb500023a75246f60b79af9f7321d6e75330c5b5 ]
Commit b7e282378773 has already changed the initial page refcount of p2pdma page from one to zero, however, in p2pmem_alloc_mmap() it uses "VM_WARN_ON_ONCE_PAGE(!page_ref_count(page))" to assert the initial page refcount should not be zero and the following will be reported when CONFIG_DEBUG_VM is enabled:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x380400000 flags: 0x20000000002000(reserved|node=0|zone=4) raw: 0020000000002000 ff1100015e3ab440 0000000000000000 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_WARN_ON_ONCE_PAGE(!page_ref_count(page)) ------------[ cut here ]------------ WARNING: CPU: 5 PID: 449 at drivers/pci/p2pdma.c:240 p2pmem_alloc_mmap+0x83a/0xa60
Fix by using "page_ref_count(page)" as the assertion condition.
--- drivers/pci/p2pdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/p2pdma.c +1 -1
@@ -147,7 +147,7 @@ static int p2pmem_alloc_mmap(struct file *filp, struct kobject *kobj,* we have just allocated the page no one else should be * using it. */ -VM_WARN_ON_ONCE_PAGE (!page_ref_count (page), page); +VM_WARN_ON_ONCE_PAGE (page_ref_count (page), page);set_page_count (page,1 ); ret =vm_insert_page (vma, vaddr, page);if (ret) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 326/781 Documentation: tracing: Add PCI tracepoint documentation
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit 8236fc613d44e59f6736d6c3e9efffaf26ab7f00 ]
The PCI tracing system provides tracepoints to monitor critical hardware events that can impact system performance and reliability. Add documentation about it.
[bhelgaas: squash fixes:
https://lore.kernel.org/r/[email protected]
https://lore.kernel.org/r/[email protected]]
--- Documentation/trace/events-pci.rst | 74 ++++++++++++++++++++++++++++++ Documentation/trace/index.rst | 1 + 2 files changed, 75 insertions(+) create mode 100644 Documentation/trace/events-pci.rst
Documentation/trace/events-pci.rst new file +74 -0
@@ -0,0 +1,74 @@ +.. SPDX-License-Identifier: GPL-2.0 + +=========================== +Subsystem Trace Points: PCI +=========================== + +Overview +======== +The PCI tracing system provides tracepoints to monitor critical hardware events +that can impact system performance and reliability. These events normally show +up here: + + /sys/kernel/tracing/events/pci + +Cf. include/trace/events/pci.h for the events definitions. + +Available Tracepoints +===================== + +pci_hp_event +------------ + +Monitors PCI hotplug events including card insertion/removal and link +state changes. +:: + + pci_hp_event "%s slot:%s, event:%s\n" + +**Event Types**: + +* ``LINK_UP`` - PCIe link established +* ``LINK_DOWN`` - PCIe link lost +* ``CARD_PRESENT`` - Card detected in slot +* ``CARD_NOT_PRESENT`` - Card removed from slot + +**Example Usage**:: + + # Enable the tracepoint + echo 1 > /sys/kernel/debug/tracing/events/pci/pci_hp_event/enable + + # Monitor events (the following output is generated when a device is hotplugged) + cat /sys/kernel/debug/tracing/trace_pipe + irq/51-pciehp-88 [001] ..... 1311.177459: pci_hp_event: 0000:00:02.0 slot:10, event:CARD_PRESENT + + irq/51-pciehp-88 [001] ..... 1311.177566: pci_hp_event: 0000:00:02.0 slot:10, event:LINK_UP + +pcie_link_event +--------------- + +Monitors PCIe link speed changes and provides detailed link status information. +:: + + pcie_link_event "%s type:%d, reason:%d, cur_bus_speed:%d, max_bus_speed:%d, width:%u, flit_mode:%u, status:%s\n" + +**Parameters**: + +* ``type`` - PCIe device type (4=Root Port, etc.) +* ``reason`` - Reason for link change: + + - ``0`` - Link retrain + - ``1`` - Bus enumeration + - ``2`` - Bandwidth notification enable + - ``3`` - Bandwidth notification IRQ + - ``4`` - Hotplug event + + +**Example Usage**:: + + # Enable the tracepoint + echo 1 > /sys/kernel/debug/tracing/events/pci/pcie_link_event/enable + + # Monitor events (the following output is generated when a device is hotplugged) + cat /sys/kernel/debug/tracing/trace_pipe + irq/51-pciehp-88 [001] ..... 381.545386: pcie_link_event: 0000:00:02.0 type:4, reason:4, cur_bus_speed:20, max_bus_speed:23, width:1, flit_mode:0, status:DLLLA
Documentation/trace/index.rst +1 -0
@@ -54,6 +54,7 @@ applications. events-power events-nmi events-msr + events-pci boottime-trace histogram histogram-design
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 327/781 PCI: Do not attempt to set ExtTag for VFs
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Håkon Bugge <[email protected]>
[ Upstream commit 73711730a1128d91ebca1a6994ceeb18f36cb0cd ]
The bit for enabling extended tags is Reserved and Preserved (RsvdP) for VFs, according to PCIe r7.0 section 7.5.3.4 table 7.21. Hence, bail out early from pci_configure_extended_tags() if the device is a VF.
Otherwise, we may see incorrect log messages such as:
kernel: pci 0000:af:00.2: enabling Extended Tags
(af:00.2 is a VF)
--- drivers/pci/probe.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/probe.c +2 -1
@@ -2270,7 +2270,8 @@ int pci_configure_extended_tags(struct pci_dev *dev, void *ign)u16 ctl;int ret; -if (!pci_is_pcie (dev)) +/* PCI_EXP_DEVCTL_EXT_TAG is RsvdP in VFs */ +if (!pci_is_pcie (dev) || dev->is_virtfn)return 0 ; ret =pcie_capability_read_dword (dev,PCI_EXP_DEVCAP , &cap);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 328/781 PCI: sophgo: Disable L0s and L1 on Sophgo 2044 PCIe Root Ports
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <[email protected]>
[ Upstream commit 613f3255a35a95f52575dd8c60b7ac9d711639ce ]
Sophgo 2044 Root Ports advertise L0 and L1 capabilities without supporting them. Since commit f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") force enabled ASPM on all device tree platforms, the issue became evident and the SG2044 Root Port started breaking.
Hence, disable the L0s and L1 capabilities in the LINKCAP register for the SG2044 Root Ports, so that these states won't get enabled.
--- drivers/pci/controller/dwc/pcie-sophgo.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/pci/controller/dwc/pcie-sophgo.c +18 -0
@@ -161,6 +161,22 @@ static void sophgo_pcie_msi_enable(struct dw_pcie_rp *pp)raw_spin_unlock_irqrestore (&pp->lock, flags); } +static void sophgo_pcie_disable_l0s_l1 (struct dw_pcie_rp *pp) +{ +struct dw_pcie *pci =to_dw_pcie_from_pp (pp); +u32 offset, val; + + offset =dw_pcie_find_capability (pci,PCI_CAP_ID_EXP ); + +dw_pcie_dbi_ro_wr_en (pci); + + val =dw_pcie_readl_dbi (pci,PCI_EXP_LNKCAP + offset); + val &= ~(PCI_EXP_LNKCAP_ASPM_L0S |PCI_EXP_LNKCAP_ASPM_L1 ); +dw_pcie_writel_dbi (pci,PCI_EXP_LNKCAP + offset, val); + +dw_pcie_dbi_ro_wr_dis (pci); +} +static int sophgo_pcie_host_init (struct dw_pcie_rp *pp) {int irq;
@@ -171,6 +187,8 @@ static int sophgo_pcie_host_init(struct dw_pcie_rp *pp)irq_set_chained_handler_and_data (irq, sophgo_pcie_intx_handler, pp); +sophgo_pcie_disable_l0s_l1 (pp); +sophgo_pcie_msi_enable (pp);return 0 ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 329/781 PCI/portdrv: Fix potential resource leak
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 01464a3fdf91c041a381d93a1b6fefbdb819a46f ]
pcie_port_probe_service() unconditionally calls get_device() (unless it fails). So drop that reference also unconditionally as it's fine for a PCIe driver to not have a remove callback.
--- drivers/pci/pcie/portdrv.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pci/pcie/portdrv.c +3 -3
@@ -557,10 +557,10 @@ static int pcie_port_remove_service(struct device *dev) pciedev =to_pcie_device (dev); driver =to_service_driver (dev->driver); -if (driver && driver->remove) { +if (driver && driver->remove) driver->remove (pciedev); -put_device (dev); - } + +put_device (dev);return 0 ; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 330/781 dm: fix unlocked test for dm_suspended_md
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 24c405fdbe215c45e57bba672cc42859038491ee ]
The function dm_blk_report_zones tests if the device is suspended with the "dm_suspended_md" call. However, this function is called without holding any locks, so the device may be suspended just after it.
Move the call to dm_suspended_md after dm_get_live_table, so that the device can't be suspended after the suspended state was tested.
--- drivers/md/dm-zone.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/md/dm-zone.c +6 -3
@@ -60,11 +60,13 @@ int dm_blk_report_zones(struct gendisk *disk, sector_t sector,* Zone revalidation during __bind() is in progress, but this * call is from a different process */ -if (dm_suspended_md (md)) -return -EAGAIN ; - map =dm_get_live_table (md, &srcu_idx); put_table = true; + +if (dm_suspended_md (md)) { + ret = -EAGAIN ; + goto do_put_table; + } }else {/* Zone revalidation during __bind() */ map = zone_revalidate_map;
@@ -79,6 +81,7 @@ int dm_blk_report_zones(struct gendisk *disk, sector_t sector, ret =dm_blk_do_report_zones (md, map, nr_zones, &dm_args); } +do_put_table:if (put_table)dm_put_live_table (md, srcu_idx);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 331/781 dm: use READ_ONCE in dm_blk_report_zones
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit e9f5a55b70ae6187ab64ef2d1232ae2738e31d1f ]
The functon dm_blk_report_zones reads md->zone_revalidate_map, however it may change while the function is running. Use READ_ONCE.
--- drivers/md/dm-zone.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-zone.c +1 -1
@@ -50,7 +50,7 @@ int dm_blk_report_zones(struct gendisk *disk, sector_t sector, {struct mapped_device *md = disk->private_data;struct dm_table *map; -struct dm_table *zone_revalidate_map = md->zone_revalidate_map; +struct dm_table *zone_revalidate_map =READ_ONCE (md->zone_revalidate_map);int srcu_idx, ret = -EIO ;bool put_table = false;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 332/781 PCI/PTM: Fix pcie_ptm_create_debugfs() memory leak
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aadityarangan Shridhar Iyengar <[email protected]>
[ Upstream commit 62171369cf17794ddd88f602c2c84d008ecafcff ]
In pcie_ptm_create_debugfs(), if devm_kasprintf() fails after successfully allocating ptm_debugfs with kzalloc(), the function returns without freeing the allocated memory, resulting in a memory leak.
Free ptm_debugfs before returning in the devm_kasprintf() error path and in pcie_ptm_destroy_debugfs().
[bhelgaas: squash additional fix from Mani:
https://lore.kernel.org/r/pdp4xc4d5ee3e547mmdro5riui3mclduqdl7j6iclfbozo2a4c@7m3qdm6yrhuv]
--- drivers/pci/pcie/ptm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/pci/pcie/ptm.c +4 -1
@@ -542,8 +542,10 @@ struct pci_ptm_debugfs *pcie_ptm_create_debugfs(struct device *dev, void *pdata,return NULL ; dirname =devm_kasprintf (dev,GFP_KERNEL ,"pcie_ptm_%s" ,dev_name (dev)); -if (!dirname) +if (!dirname) { +kfree (ptm_debugfs);return NULL ; + } ptm_debugfs->debugfs =debugfs_create_dir (dirname,NULL ); ptm_debugfs->pdata = pdata;
@@ -574,6 +576,7 @@ void pcie_ptm_destroy_debugfs(struct pci_ptm_debugfs *ptm_debugfs)mutex_destroy (&ptm_debugfs->lock);debugfs_remove_recursive (ptm_debugfs->debugfs); + kfree(ptm_debugfs); }EXPORT_SYMBOL_GPL (pcie_ptm_destroy_debugfs);#endif
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 333/781 PCI/P2PDMA: Reset page reference count when page mapping fails
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Popple <[email protected]>
[ Upstream commit 83014d82a1100abc89f7712ad67c3e5accaddc43 ]
When mapping a p2pdma page the page reference count is initialised to 1 prior to calling vm_insert_page(). This is to avoid vm_insert_page() warning if the page refcount is zero. Prior to setting the page count there is a check to ensure the page is currently free (ie. has a zero reference count).
However vm_insert_page() can fail. In this case the pages are freed back to the genalloc pool, but that does not reset the page refcount. So a future allocation of the same page will see the elevated page refcount from the previous set_page_count() call triggering the VM_WARN_ON_ONCE_PAGE checking that the page is free.
Fix this by resetting the page refcount to zero using set_page_count(). Note that put_page() is not used because that would result in freeing the page twice due to implicitly calling p2pdma_folio_free().
--- drivers/pci/p2pdma.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/pci/p2pdma.c +7 -0
@@ -152,6 +152,13 @@ static int p2pmem_alloc_mmap(struct file *filp, struct kobject *kobj, ret =vm_insert_page (vma, vaddr, page);if (ret) {gen_pool_free (p2pdma->pool, (uintptr_t )kaddr, len); + +/* +* Reset the page count. We don't use put_page() +* because we don't want to trigger the +* p2pdma_folio_free() path. +*/ +set_page_count (page,0 );percpu_ref_put (ref);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 334/781 wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit c6131765a2c0052b2c5a2310ff92191ff33aec8b ]
Repair "bad line" warnings by starting each line with " *". Add or correct kernel-doc entries for missing struct members in struct ath_tx_stats.
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:144 bad line:
may have had errors.
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:146 bad line:
may have had errors.
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:156 bad line:
Valid only for:
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:157 bad line:
- non-aggregate condition.
Warning: ../drivers/net/wireless/ath/ath9k/debug.h:158 bad line:
- first packet of aggregate.
Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
'xretries' not described in 'ath_tx_stats'
Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
'data_underrun' not described in 'ath_tx_stats'
Warning: drivers/net/wireless/ath/ath9k/debug.h:191 struct member
'delim_underrun' not described in 'ath_tx_stats'
--- drivers/net/wireless/ath/ath9k/debug.h | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/net/wireless/ath/ath9k/debug.h +8 -7
@@ -142,11 +142,12 @@ struct ath_interrupt_stats {/** * struct ath_tx_stats - Statistics about TX * @tx_pkts_all: No. of total frames transmitted, including ones that -may have had errors. +* may have had errors. * @tx_bytes_all: No. of total bytes transmitted, including ones that -may have had errors. +* may have had errors. * @queued: Total MPDUs (non-aggr) queued * @completed: Total MPDUs (non-aggr) completed +* @xretries: Total MPDUs with xretries * @a_aggr: Total no. of aggregates queued * @a_queued_hw: Total AMPDUs queued to hardware * @a_completed: Total AMPDUs completed
@@ -154,14 +155,14 @@ struct ath_interrupt_stats {* @a_xretries: No. of AMPDUs dropped due to xretries * @txerr_filtered: No. of frames with TXERR_FILT flag set. * @fifo_underrun: FIFO underrun occurrences -Valid only for: -- non-aggregate condition. -- first packet of aggregate. +* Valid only for: +* - non-aggregate condition. +* - first packet of aggregate. * @xtxop: No. of frames filtered because of TXOP limit * @timer_exp: Transmit timer expiry * @desc_cfg_err: Descriptor configuration errors -* @data_urn: TX data underrun errors -* @delim_urn: TX delimiter underrun errors +* @data_underrun: TX data underrun errors +* @delim_underrun: TX delimiter underrun errors * @puttxbuf: Number of times hardware was given txbuf to write. * @txstart: Number of times hardware was told to start tx. * @txprocdesc: Number of times tx descriptor was processed
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 335/781 wifi: ath9k: fix kernel-doc warnings in common-debug.h
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit b9909c19965dc9e5a3a898fef09b437fcc3a9494 ]
Modify kernel-doc comments in common-debug.h to avoid warnings:
Warning: drivers/net/wireless/ath/ath9k/common-debug.h:21 bad line:
may have had errors.
Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:23 bad line:
may have had errors.
Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:26 bad line:
decryption process completed
Warning: ../drivers/net/wireless/ath/ath9k/common-debug.h:28 bad line:
encountered an error
--- drivers/net/wireless/ath/ath9k/common-debug.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/common-debug.h +4 -4
@@ -19,14 +19,14 @@/** * struct ath_rx_stats - RX Statistics * @rx_pkts_all: No. of total frames received, including ones that -may have had errors. +* may have had errors. * @rx_bytes_all: No. of total bytes received, including ones that -may have had errors. +* may have had errors. * @crc_err: No. of frames with incorrect CRC value * @decrypt_crc_err: No. of frames whose CRC check failed after -decryption process completed +* decryption process completed * @phy_err: No. of frames whose reception failed because the PHY -encountered an error +* encountered an error * @mic_err: No. of frames with incorrect TKIP MIC verification failure * @pre_delim_crc_err: Pre-Frame delimiter CRC error detections * @post_delim_crc_err: Post-Frame delimiter CRC error detections
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 336/781 wifi: ath9k: add OF dependency to AHB
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit 125e7b31f041cc0a4ede1e42bef69915f0a63a35 ]
The conversion to OF missed adding a Kconfig dependency.
--- drivers/net/wireless/ath/ath9k/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/Kconfig +1 -1
@@ -47,7 +47,7 @@ config ATH9K_PCI config ATH9K_AHB bool "Atheros ath9k AHB bus support" - depends on ATH9K + depends on ATH9K && OF default n help This option enables the AHB bus support in ath9k.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 337/781 wifi: ath12k: do WoW offloads only on primary link
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit e62102ac9b773bdb08475aa9ca24dea61ae98708 ]
In case of multi-link connection, WCN7850 firmware crashes due to WoW offloads enabled on both primary and secondary links.
Change to do it only on primary link to fix it.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/wow.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/net/wireless/ath/ath12k/wow.c +16 -0
@@ -135,6 +135,9 @@ static int ath12k_wow_cleanup(struct ath12k *ar)lockdep_assert_wiphy (ath12k_ar_to_hw (ar)->wiphy);list_for_each_entry (arvif, &ar->arvifs, list) { +if (arvif != &arvif->ahvif->deflink) +continue ; + ret =ath12k_wow_vif_cleanup (arvif);if (ret) { ath12k_warn(ar->ab, "failed to clean wow wakeups on vdev %i: %d\n",
@@ -479,8 +482,12 @@ static int ath12k_wow_set_wakeups(struct ath12k *ar,lockdep_assert_wiphy (ath12k_ar_to_hw (ar)->wiphy);list_for_each_entry (arvif, &ar->arvifs, list) { +if (arvif != &arvif->ahvif->deflink) +continue ; +if (ath12k_wow_is_p2p_vdev (arvif->ahvif))continue ; + ret =ath12k_wow_vif_set_wakeups (arvif, wowlan);if (ret) { ath12k_warn(ar->ab, "failed to set wow wakeups on vdev %i: %d\n",
@@ -538,6 +545,9 @@ static int ath12k_wow_nlo_cleanup(struct ath12k *ar)lockdep_assert_wiphy (ath12k_ar_to_hw (ar)->wiphy);list_for_each_entry (arvif, &ar->arvifs, list) { +if (arvif != &arvif->ahvif->deflink) +continue ; +if (ath12k_wow_is_p2p_vdev (arvif->ahvif))continue ;
@@ -745,6 +755,9 @@ static int ath12k_wow_arp_ns_offload(struct ath12k *ar, bool enable)list_for_each_entry (arvif, &ar->arvifs, list) { ahvif = arvif->ahvif; +if (arvif != &ahvif->deflink) +continue ; +if (ahvif->vdev_type !=WMI_VDEV_TYPE_STA )continue ;
@@ -776,6 +789,9 @@ static int ath12k_gtk_rekey_offload(struct ath12k *ar, bool enable)lockdep_assert_wiphy (ath12k_ar_to_hw (ar)->wiphy);list_for_each_entry (arvif, &ar->arvifs, list) { +if (arvif != &arvif->ahvif->deflink) +continue ; +if (arvif->ahvif->vdev_type !=WMI_VDEV_TYPE_STA || !arvif->is_up || !arvif->rekey_data.enable_offload)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 338/781 quota: fix livelock between quotactl and freeze_super
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Bapat <[email protected]>
[ Upstream commit 77449e453dfc006ad738dec55374c4cbc056fd39 ]
When a filesystem is frozen, quotactl_block() enters a retry loop waiting for the filesystem to thaw. It acquires s_umount, checks the freeze state, drops s_umount and uses sb_start_write() - sb_end_write() pair to wait for the unfreeze.
However, this retry loop can trigger a livelock issue, specifically on kernels with preemption disabled.
The mechanism is as follows:
1. freeze_super() sets SB_FREEZE_WRITE and calls sb_wait_write().
2. sb_wait_write() calls percpu_down_write(), which initiates synchronize_rcu().
3. Simultaneously, quotactl_block() spins in its retry loop, immediately executing the sb_start_write() - sb_end_write() pair.
4. Because the kernel is non-preemptible and the loop contains no scheduling points, quotactl_block() never yields the CPU. This prevents that CPU from reaching an RCU quiescent state.
5. synchronize_rcu() in the freezer thread waits indefinitely for the quotactl_block() CPU to report a quiescent state.
6. quotactl_block() spins indefinitely waiting for the freezer to advance, which it cannot do as it is blocked on the RCU sync.
This results in a hang of the freezer process and 100% CPU usage by the quota process.
While this can occur intermittently on multi-core systems, it is reliably reproducing on a node with the following script, running both the freezer and the quota toggle on the same CPU:
# mkfs.ext4 -O quota /dev/sda 2g && mkdir a_mount
# mount /dev/sda -o quota,usrquota,grpquota a_mount
# taskset -c 3 bash -c "while true; do xfs_freeze -f a_mount; \
xfs_freeze -u a_mount; done" &
# taskset -c 3 bash -c "while true; do quotaon a_mount; \
quotaoff a_mount; done" &Adding cond_resched() to the retry loop fixes the issue. It acts as an RCU quiescent state, allowing synchronize_rcu() in percpu_down_write() to complete.
--- fs/quota/quota.c | 1 + 1 file changed, 1 insertion(+)
fs/quota/quota.c +1 -0
@@ -899,6 +899,7 @@ static struct super_block *quotactl_block(const char __user *special, int cmd)sb_start_write (sb);sb_end_write (sb);put_super (sb); +cond_resched (); goto retry; }return sb;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 339/781 PCI/pwrctrl: tc9563: Use put_device() instead of i2c_put_adapter()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 99ee5837c63d1000f9ce7508591486a7bd8bdedb ]
The API comment for of_find_i2c_adapter_by_node() recommends using put_device() to drop the reference count of I2C adapter instead of using i2c_put_adapter(). So replace i2c_put_adapter() with put_device().
--- drivers/pci/pwrctrl/pci-pwrctrl-tc9563.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pci/pwrctrl/pci-pwrctrl-tc9563.c +3 -3
@@ -533,7 +533,7 @@ static int tc9563_pwrctrl_probe(struct platform_device *pdev) ctx->client =i2c_new_dummy_device (ctx->adapter, addr);if (IS_ERR (ctx->client)) {dev_err (dev,"Failed to create I2C client\n" ); -i2c_put_adapter (ctx->adapter); +put_device (&ctx->adapter->dev);return PTR_ERR (ctx->client); }
@@ -613,7 +613,7 @@ static int tc9563_pwrctrl_probe(struct platform_device *pdev)tc9563_pwrctrl_power_off (ctx); remove_i2c:i2c_unregister_device (ctx->client); -i2c_put_adapter (ctx->adapter); +put_device (&ctx->adapter->dev);return ret; }
@@ -623,7 +623,7 @@ static void tc9563_pwrctrl_remove(struct platform_device *pdev)tc9563_pwrctrl_power_off (ctx);i2c_unregister_device (ctx->client); -i2c_put_adapter (ctx->adapter); +put_device (&ctx->adapter->dev); }static const struct of_device_id tc9563_pwrctrl_of_match[] = {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 340/781 net: mctp-i2c: fix duplicate reception of old data
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Zhang <[email protected]>
[ Upstream commit ae4744e173fadd092c43eda4ca92dcb74645225a ]
The MCTP I2C slave callback did not handle I2C_SLAVE_READ_REQUESTED events. As a result, i2c read event will trigger repeated reception of old data, reset rx_pos when a read request is received.
Stable-dep-of: 2a14e91b6d76 ("mctp i2c: initialise event handler read bytes")
--- drivers/net/mctp/mctp-i2c.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/mctp/mctp-i2c.c +6 -0
@@ -242,6 +242,9 @@ static int mctp_i2c_slave_cb(struct i2c_client *client,return 0 ;switch (event) { +case I2C_SLAVE_READ_REQUESTED : + midev->rx_pos =0 ; +break ;case I2C_SLAVE_WRITE_RECEIVED :if (midev->rx_pos <MCTP_I2C_BUFSZ ) { midev->rx_buffer[midev->rx_pos] = *val;
@@ -279,6 +282,9 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev)size_t recvlen;int status; +if (midev->rx_pos ==0 ) +return 0 ; +/* + 1 for the PEC */ if (midev->rx_pos <MCTP_I2C_MINLEN +1 ) { ndev->stats.rx_length_errors++;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 341/781 mctp i2c: initialise event handler read bytes
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Johnston <[email protected]>
[ Upstream commit 2a14e91b6d76639dac70ea170f4384c1ee3cb48d ]
Set a 0xff value for i2c reads of an mctp-i2c device. Otherwise reads will return "val" from the i2c bus driver. For i2c-aspeed and i2c-npcm7xx that is a stack uninitialised u8.
Tested with "i2ctransfer -y 1 r10@0x34" where 0x34 is a mctp-i2c instance, now it returns all 0xff.
--- drivers/net/mctp/mctp-i2c.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/mctp/mctp-i2c.c +3 -0
@@ -243,7 +243,10 @@ static int mctp_i2c_slave_cb(struct i2c_client *client,switch (event) {case I2C_SLAVE_READ_REQUESTED : +case I2C_SLAVE_READ_PROCESSED : +/* MCTP I2C transport only uses writes */ midev->rx_pos =0 ; + *val =0xff ;break ;case I2C_SLAVE_WRITE_RECEIVED :if (midev->rx_pos <MCTP_I2C_BUFSZ ) {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 342/781 wifi: cfg80211: stop NAN and P2P in cfg80211_leave
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit e1696c8bd0056bc1a5f7766f58ac333adc203e8a ]
Seems that there is an assumption that this function should be called only for netdev interfaces, but it can also be called in suspend, or from nl80211_netlink_notify (indirectly).
Note that the documentation of NL80211_ATTR_SOCKET_OWNER explicitly says that NAN interfaces would be destroyed as well in the nl80211_netlink_notify case.
Fix this by also stopping P2P and NAN.
--- net/wireless/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/wireless/core.c +3 -1
@@ -1415,8 +1415,10 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,cfg80211_leave_ocb (rdev, dev);break ;case NL80211_IFTYPE_P2P_DEVICE : +cfg80211_stop_p2p_device (rdev, wdev); +break ;case NL80211_IFTYPE_NAN : -/* cannot happen, has no netdev */ +cfg80211_stop_nan (rdev, wdev);break ;case NL80211_IFTYPE_AP_VLAN :case NL80211_IFTYPE_MONITOR :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 343/781 iommupt: Do not set C-bit on MMIO backed PTEs
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <[email protected]>
[ Upstream commit e2692c4eeaa4bd945b7bae156b4cac55d6a0c730 ]
AMD Secure Memory Encryption (SME) marks individual memory pages as encrypted by setting the C-bit in page table entries. According to the AMD APM,any pages corresponding to MMIO addresses must be configured with the C-bit clear.
The current *_iommu_set_prot() implementation sets the C-bit on all PTEs in the IOMMU page tables. This is incorrect for PTEs backed by MMIO, and can break PCIe peer-to-peer communication when IOVA is used. Fix this by avoiding the C-bit for MMIO-backed mappings.
For amdv2 IOMMU page tables, there is a usage scenario for GVA->GPA mappings, and for the trusted MMIO in the TEE-IO case, the C-bit will need to be added to GPA. However, SNP guests do not yet support vIOMMU, and the trusted MMIO support is not ready in upstream. Adding the C-bit for trusted MMIO can be considered once those features land.
--- drivers/iommu/generic_pt/fmt/amdv1.h | 3 ++- drivers/iommu/generic_pt/fmt/x86_64.h | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/iommu/generic_pt/fmt/amdv1.h +2 -1
@@ -354,7 +354,8 @@ static inline int amdv1pt_iommu_set_prot(struct pt_common *common,* Ideally we'd have an IOMMU_ENCRYPTED flag set by higher levels to * control this. For now if the tables use sme_set then so do the ptes. */ -if (pt_feature (common,PT_FEAT_AMDV1_ENCRYPT_TABLES )) +if (pt_feature (common,PT_FEAT_AMDV1_ENCRYPT_TABLES ) && + !(iommu_prot &IOMMU_MMIO )) pte =__sme_set (pte); attrs->descriptor_bits = pte;
drivers/iommu/generic_pt/fmt/x86_64.h +2 -1
@@ -227,7 +227,8 @@ static inline int x86_64_pt_iommu_set_prot(struct pt_common *common,* Ideally we'd have an IOMMU_ENCRYPTED flag set by higher levels to * control this. For now if the tables use sme_set then so do the ptes. */ -if (pt_feature (common,PT_FEAT_X86_64_AMD_ENCRYPT_TABLES )) +if (pt_feature (common,PT_FEAT_X86_64_AMD_ENCRYPT_TABLES ) && + !(iommu_prot &IOMMU_MMIO )) pte =__sme_set (pte); attrs->descriptor_bits = pte;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 344/781 ext4: fast commit: make s_fc_lock reclaim-safe
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Chen <[email protected]>
[ Upstream commit 491f2927ae097e2d405afe0b3fe841931ab8aad2 ]
s_fc_lock can be acquired from inode eviction and thus is reclaim unsafe. Since the fast commit path holds s_fc_lock while writing the commit log, allocations under the lock can enter reclaim and invert the lock order with fs_reclaim. Add ext4_fc_lock()/ext4_fc_unlock() helpers which acquire s_fc_lock under memalloc_nofs_save()/restore() context and use them everywhere so allocations under the lock cannot recurse into filesystem reclaim.
--- fs/ext4/ext4.h | 16 ++++++++++++++ fs/ext4/fast_commit.c | 51 ++++++++++++++++++++++++------------------- 2 files changed, 44 insertions(+), 23 deletions(-)
fs/ext4/ext4.h +16 -0
@@ -1795,6 +1795,10 @@ struct ext4_sb_info {* Main fast commit lock. This lock protects accesses to the * following fields: * ei->i_fc_list, s_fc_dentry_q, s_fc_q, s_fc_bytes, s_fc_bh. +* +* s_fc_lock can be taken from reclaim context (inode eviction) and is +* thus reclaim unsafe. Use ext4_fc_lock()/ext4_fc_unlock() helpers +* when acquiring / releasing the lock. */ struct mutex s_fc_lock;struct buffer_head *s_fc_bh;
@@ -1839,6 +1843,18 @@ static inline void ext4_writepages_up_write(struct super_block *sb, int ctx)percpu_up_write (&EXT4_SB (sb)->s_writepages_rwsem); } +static inline int ext4_fc_lock (struct super_block *sb) +{ +mutex_lock (&EXT4_SB (sb)->s_fc_lock); +return memalloc_nofs_save (); +} + +static inline void ext4_fc_unlock (struct super_block *sb,int ctx) +{ +memalloc_nofs_restore (ctx); +mutex_unlock (&EXT4_SB (sb)->s_fc_lock); +} +static inline int ext4_valid_inum (struct super_block *sb,unsigned long ino) { return ino == EXT4_ROOT_INO ||
fs/ext4/fast_commit.c +28 -23
209 lines not on this page · raw message
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 345/781 netfilter: nf_tables: reset table validation state on abort
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 6f93616a7323d646d18db9c09f147e453b40fdd7 ]
If a transaction fails the final validation in the commit hook, the table validation state is changed to NFT_VALIDATE_DO and a replay of the batch is performed. Every rule insert will then do a graph validation.
This is much slower, but provides better error reporting to the user because we can point at the rule that introduces the validation issue.
Without this reset the affected table(s) remain in full validation mode, i.e. on next transaction we start with slow-mode.
This makes the next transaction after a failed incremental update very slow:
# time iptables-restore < /tmp/ruleset real 0m0.496s [..] # time iptables -A CALLEE -j CALLER iptables v1.8.11 (nf_tables): RULE_APPEND failed (Too many links): rule in chain CALLEE real 0m0.022s [..] # time iptables-restore < /tmp/ruleset real 1m22.355s [..]
After this patch, 2nd iptables-restore is back to ~0.5s.
--- net/netfilter/nf_tables_api.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/netfilter/nf_tables_api.c +7 -0
@@ -11536,6 +11536,13 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb, ret =__nf_tables_abort (net, action);nft_gc_seq_end (nft_net, gc_seq); +if (action ==NFNL_ABORT_NONE ) { +struct nft_table *table; + +list_for_each_entry (table, &nft_net->tables, list) + table->validate_state =NFT_VALIDATE_SKIP ; + } +WARN_ON_ONCE (!list_empty (&nft_net->commit_list));/* module autoload needs to happen after GC sequence update because it
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 346/781 netfilter: nf_conncount: increase the connection clean up limit to 64
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit 21d033e472735ecec677f1ae46d6740b5e47a4f3 ]
After the optimization to only perform one GC per jiffy, a new problem was introduced. If more than 8 new connections are tracked per jiffy the list won't be cleaned up fast enough possibly reaching the limit wrongly.
In order to prevent this issue, only skip the GC if it was already triggered during the same jiffy and the increment is lower than the clean up limit. In addition, increase the clean up limit to 64 connections to avoid triggering GC too often and do more effective GCs.
This has been tested using a HTTP server and several performance tools while having nft_connlimit/xt_connlimit or OVS limit configured.
Output of slowhttptest + OVS limit at 52000 connections:
slow HTTP test status on 340th second:
initializing: 0 pending: 432 connected: 51998 error: 0 closed: 0 service available: YES
--- include/net/netfilter/nf_conntrack_count.h | 1 + net/netfilter/nf_conncount.c | 15 ++++++++++----- 2 files changed, 11 insertions(+), 5 deletions(-)
include/net/netfilter/nf_conntrack_count.h +1 -0
@@ -13,6 +13,7 @@ struct nf_conncount_list {u32 last_gc;/* jiffies at most recent gc */ struct list_head head;/* connections with the same filtering key */ unsigned int count;/* length of list */ +unsigned int last_gc_count;/* length of list at most recent gc */ };struct nf_conncount_data *nf_conncount_init (struct net *net,unsigned int keylen);
net/netfilter/nf_conncount.c +10 -5
@@ -34,8 +34,9 @@#define CONNCOUNT_SLOTS 256U -#define CONNCOUNT_GC_MAX_NODES 8 -#define MAX_KEYLEN 5 +#define CONNCOUNT_GC_MAX_NODES 8 +#define CONNCOUNT_GC_MAX_COLLECT 64 +#define MAX_KEYLEN 5/* we will save the tuples of all connections we care about */ struct nf_conncount_tuple {
@@ -182,12 +183,13 @@ static int __nf_conncount_add(struct net *net, goto out_put; } -if ((u32 )jiffies == list->last_gc) +if ((u32 )jiffies == list->last_gc && + (list->count - list->last_gc_count) <CONNCOUNT_GC_MAX_COLLECT ) goto add_new_node;/* check the saved connections */ list_for_each_entry_safe (conn, conn_n, &list->head, node) { -if (collect >CONNCOUNT_GC_MAX_NODES ) +if (collect >CONNCOUNT_GC_MAX_COLLECT )break ; found =find_or_evict (net, list, conn);
@@ -230,6 +232,7 @@ static int __nf_conncount_add(struct net *net,nf_ct_put (found_ct); } list->last_gc = (u32 )jiffies; + list->last_gc_count = list->count; add_new_node:if (WARN_ON_ONCE (list->count >INT_MAX )) {
@@ -277,6 +280,7 @@ void nf_conncount_list_init(struct nf_conncount_list *list)spin_lock_init (&list->list_lock);INIT_LIST_HEAD (&list->head); list->count =0 ; + list->last_gc_count =0 ; list->last_gc = (u32 )jiffies; }EXPORT_SYMBOL_GPL (nf_conncount_list_init);
@@ -316,13 +320,14 @@ static bool __nf_conncount_gc_list(struct net *net, }nf_ct_put (found_ct); -if (collected >CONNCOUNT_GC_MAX_NODES ) +if (collected >CONNCOUNT_GC_MAX_COLLECT )break ; }if (!list->count) ret = true; list->last_gc = (u32 )jiffies; + list->last_gc_count = list->count;return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 347/781 netfilter: nft_compat: add more restrictions on netlink attributes
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit cda26c645946b08f070f20c166d4736767e4a805 ]
As far as I can see nothing bad can happen when NFTA_TARGET/MATCH_NAME are too large because this calls x_tables helpers which check for the length, but it seems better to already reject it during netlink parsing.
Rest of the changes avoid silent u8/u16 truncations.
For _TYPE, its expected to be only 1 or 0. In x_tables world, this variable is set by kernel, for IPT_SO_GET_REVISION_TARGET its 1, for all others its set to 0.
As older versions of nf_tables permitted any value except 1 to mean 'match', keep this as-is but sanitize the value for consistency.
--- net/netfilter/nft_compat.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
net/netfilter/nft_compat.c +10 -3
@@ -134,7 +134,8 @@ static void nft_target_eval_bridge(const struct nft_expr *expr, }static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX +1 ] = { - [NFTA_TARGET_NAME ] = { .type =NLA_NUL_STRING }, + [NFTA_TARGET_NAME ] = { .type =NLA_NUL_STRING , + .len =XT_EXTENSION_MAXNAMELEN , }, [NFTA_TARGET_REV ] =NLA_POLICY_MAX (NLA_BE32 ,255 ), [NFTA_TARGET_INFO ] = { .type =NLA_BINARY }, };
@@ -434,7 +435,8 @@ static void nft_match_eval(const struct nft_expr *expr, }static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX +1 ] = { - [NFTA_MATCH_NAME ] = { .type =NLA_NUL_STRING }, + [NFTA_MATCH_NAME ] = { .type =NLA_NUL_STRING , + .len =XT_EXTENSION_MAXNAMELEN }, [NFTA_MATCH_REV ] =NLA_POLICY_MAX (NLA_BE32 ,255 ), [NFTA_MATCH_INFO ] = { .type =NLA_BINARY }, };
@@ -693,7 +695,12 @@ static int nfnl_compat_get_rcu(struct sk_buff *skb, name =nla_data (tb[NFTA_COMPAT_NAME ]); rev =ntohl (nla_get_be32 (tb[NFTA_COMPAT_REV ])); - target =ntohl (nla_get_be32 (tb[NFTA_COMPAT_TYPE ])); +/* x_tables api checks for 'target == 1' to mean target, +* everything else means 'match'. +* In x_tables world, the number is set by kernel, not +* userspace. +*/ + target =nla_get_be32 (tb[NFTA_COMPAT_TYPE ]) ==htonl (1 );switch (family) {case AF_INET :
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 348/781 netfilter: nf_conncount: fix tracking of connections from localhost
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <[email protected]>
[ Upstream commit de8a70cefcb26cdceaafdc5ac144712681419c29 ]
Since commit be102eb6a0e7 ("netfilter: nf_conncount: rework API to use sk_buff directly"), we skip the adding and trigger a GC when the ct is confirmed. For connections originated from local to local it doesn't work because the connection is confirmed on POSTROUTING, therefore tracking on the INPUT hook is always skipped.
In order to fix this, we check whether skb input ifindex is set to loopback ifindex. If it is then we fallback on a GC plus track operation skipping the optimization. This fallback is necessary to avoid duplicated tracking of a packet train e.g 10 UDP datagrams sent on a burst when initiating the connection.
Tested with xt_connlimit/nft_connlimit and OVS limit and with a HTTP server and iperf3 on UDP mode.
--- net/netfilter/nf_conncount.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
net/netfilter/nf_conncount.c +13 -2
@@ -179,14 +179,25 @@ static int __nf_conncount_add(struct net *net,return -ENOENT ;if (ct &&nf_ct_is_confirmed (ct)) { - err = -EEXIST ; - goto out_put; +/* local connections are confirmed in postrouting so confirmation +* might have happened before hitting connlimit +*/ +if (skb->skb_iif !=LOOPBACK_IFINDEX ) { + err = -EEXIST ; + goto out_put; + } + +/* this is likely a local connection, skip optimization to avoid +* adding duplicates from a 'packet train' +*/ + goto check_connections; }if ((u32 )jiffies == list->last_gc && (list->count - list->last_gc_count) <CONNCOUNT_GC_MAX_COLLECT ) goto add_new_node; +check_connections:/* check the saved connections */ list_for_each_entry_safe (conn, conn_n, &list->head, node) {if (collect >CONNCOUNT_GC_MAX_COLLECT )
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 349/781 kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Mladek <[email protected]>
[ Upstream commit cd6735896d0343942cf3dafb48ce32eb79341990 ]
bpf_address_lookup() has been used only in kallsyms_lookup_buildid(). It was supposed to set @modname and @modbuildid when the symbol was in a module.
But it always just cleared @modname because BPF symbols were never in a module. And it did not clear @modbuildid because the pointer was not passed.
The wrapper is no longer needed. Both @modname and @modbuildid are now always initialized to NULL in kallsyms_lookup_buildid().
Remove the wrapper and rename __bpf_address_lookup() to bpf_address_lookup() because this variant is used everywhere.
--- arch/arm64/net/bpf_jit_comp.c | 2 +- arch/loongarch/net/bpf_jit.c | 2 +- arch/powerpc/net/bpf_jit_comp.c | 2 +- include/linux/filter.h | 26 ++++---------------------- kernel/bpf/core.c | 4 ++-- kernel/kallsyms.c | 5 ++--- 6 files changed, 11 insertions(+), 30 deletions(-)
arch/arm64/net/bpf_jit_comp.c +1 -1
@@ -2951,7 +2951,7 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,u64 plt_target =0ULL ;bool poking_bpf_entry; -if (!__bpf_address_lookup ((unsigned long )ip, &size, &offset, namebuf)) +if (!bpf_address_lookup ((unsigned long )ip, &size, &offset, namebuf))/* Only poking bpf text is supported. Since kernel function * entry is set up by ftrace, we reply on ftrace to poke kernel * functions.
arch/loongarch/net/bpf_jit.c +1 -1
@@ -1319,7 +1319,7 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,/* Only poking bpf text is supported. Since kernel function entry * is set up by ftrace, we rely on ftrace to poke kernel functions. */ -if (!__bpf_address_lookup ((unsigned long )ip, &size, &offset, namebuf)) +if (!bpf_address_lookup ((unsigned long )ip, &size, &offset, namebuf))return -ENOTSUPP ; image = ip - offset;
arch/powerpc/net/bpf_jit_comp.c +1 -1
@@ -1122,7 +1122,7 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t, bpf_func = (unsigned long )ip;/* We currently only support poking bpf programs */ -if (!__bpf_address_lookup (bpf_func, &size, &offset, name)) { +if (!bpf_address_lookup (bpf_func, &size, &offset, name)) {pr_err ("%s (0x%lx): kernel/modules are not supported\n" , __func__, bpf_func);return -EOPNOTSUPP ; }
include/linux/filter.h +4 -22
@@ -1375,24 +1375,13 @@ static inline bool bpf_jit_kallsyms_enabled(void)return false; } -int __bpf_address_lookup (unsigned long addr,unsigned long *size, -unsigned long *off,char *sym); +int bpf_address_lookup (unsigned long addr,unsigned long *size, +unsigned long *off,char *sym);bool is_bpf_text_address (unsigned long addr);int bpf_get_kallsym (unsigned int symnum,unsigned long *value,char *type,char *sym);struct bpf_prog *bpf_prog_ksym_find (unsigned long addr); -static inline int -bpf_address_lookup (unsigned long addr,unsigned long *size, -unsigned long *off,char **modname,char *sym) -{ -int ret =__bpf_address_lookup (addr, size, off, sym); - -if (ret && modname) - *modname =NULL ; -return ret; -} -void bpf_prog_kallsyms_add (struct bpf_prog *fp);void bpf_prog_kallsyms_del (struct bpf_prog *fp);
@@ -1431,8 +1420,8 @@ static inline bool bpf_jit_kallsyms_enabled(void) }static inline int -__bpf_address_lookup (unsigned long addr,unsigned long *size, -unsigned long *off,char *sym) +bpf_address_lookup (unsigned long addr,unsigned long *size, +unsigned long *off,char *sym) {return 0 ; }
@@ -1453,13 +1442,6 @@ static inline struct bpf_prog *bpf_prog_ksym_find(unsigned long addr)return NULL ; } -static inline int -bpf_address_lookup (unsigned long addr,unsigned long *size, -unsigned long *off,char **modname,char *sym) -{ -return 0 ; -} -static inline void bpf_prog_kallsyms_add (struct bpf_prog *fp) { }
kernel/bpf/core.c +2 -2
@@ -713,8 +713,8 @@ static struct bpf_ksym *bpf_ksym_find(unsigned long addr) return n ? container_of(n, struct bpf_ksym, tnode) : NULL; } -int __bpf_address_lookup (unsigned long addr,unsigned long *size, -unsigned long *off,char *sym) +int bpf_address_lookup (unsigned long addr,unsigned long *size, +unsigned long *off,char *sym) {struct bpf_ksym *ksym;int ret =0 ;
kernel/kallsyms.c +2 -3
@@ -345,7 +345,7 @@ int kallsyms_lookup_size_offset(unsigned long addr, unsigned long *symbolsize,return 1 ; }return !!module_address_lookup (addr, symbolsize, offset,NULL ,NULL , namebuf) || - !!__bpf_address_lookup (addr, symbolsize, offset, namebuf); + !!bpf_address_lookup (addr, symbolsize, offset, namebuf); } static int kallsyms_lookup_buildid(unsigned long addr,
@@ -377,8 +377,7 @@ static int kallsyms_lookup_buildid(unsigned long addr, ret =module_address_lookup (addr, symbolsize, offset, modname, modbuildid, namebuf);if (!ret) - ret =bpf_address_lookup (addr, symbolsize, - offset, modname, namebuf); + ret =bpf_address_lookup (addr, symbolsize, offset, namebuf);if (!ret) ret = ftrace_mod_address_lookup(addr, symbolsize,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 350/781 module: add helper function for reading module_buildid()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Mladek <[email protected]>
[ Upstream commit acfdbb4ab2910ff6f03becb569c23ac7b2223913 ]
Add a helper function for reading the optional "build_id" member of struct module. It is going to be used also in ftrace_mod_address_lookup().
Use "#ifdef" instead of "#if IS_ENABLED()" to match the declaration of the optional field in struct module.
Stable-dep-of: e8a1e7eaa19d ("kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()")
--- include/linux/module.h | 9 +++++++++ kernel/module/kallsyms.c | 9 ++------- 2 files changed, 11 insertions(+), 7 deletions(-)
include/linux/module.h +9 -0
@@ -748,6 +748,15 @@ static inline void __module_get(struct module *module) __mod ? __mod->name :"kernel" ; \ }) +static inline const unsigned char *module_buildid (struct module *mod) +{ +#ifdef CONFIG_STACKTRACE_BUILD_ID +return mod->build_id; +#else +return NULL ; +#endif +} +/* Dereference module function descriptor */ void *dereference_module_function_descriptor (struct module *mod,void *ptr);
kernel/module/kallsyms.c +2 -7
@@ -334,13 +334,8 @@ int module_address_lookup(unsigned long addr,if (mod) {if (modname) *modname = mod->name; -if (modbuildid) { -#if IS_ENABLED (CONFIG_STACKTRACE_BUILD_ID ) - *modbuildid = mod->build_id; -#else - *modbuildid =NULL ; -#endif - } +if (modbuildid) + *modbuildid =module_buildid (mod); sym =find_kallsyms_symbol (mod, addr, size, offset);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 351/781 kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Mladek <[email protected]>
[ Upstream commit e8a1e7eaa19d0b757b06a2f913e3eeb4b1c002c6 ]
__sprint_symbol() might access an invalid pointer when kallsyms_lookup_buildid() returns a symbol found by ftrace_mod_address_lookup().
The ftrace lookup function must set both @modname and @modbuildid the same way as module_address_lookup().
--- include/linux/ftrace.h | 6 ++++-- kernel/kallsyms.c | 4 ++-- kernel/trace/ftrace.c | 5 ++++- 3 files changed, 10 insertions(+), 5 deletions(-)
include/linux/ftrace.h +4 -2
@@ -87,11 +87,13 @@ struct ftrace_hash;defined (CONFIG_DYNAMIC_FTRACE) intftrace_mod_address_lookup (unsigned long addr,unsigned long *size, -unsigned long *off,char **modname,char *sym); +unsigned long *off,char **modname, +const unsigned char **modbuildid,char *sym);#else static inline int ftrace_mod_address_lookup (unsigned long addr,unsigned long *size, -unsigned long *off,char **modname,char *sym) +unsigned long *off,char **modname, +const unsigned char **modbuildid,char *sym) {return 0 ; }
kernel/kallsyms.c +2 -2
@@ -380,8 +380,8 @@ static int kallsyms_lookup_buildid(unsigned long addr, ret =bpf_address_lookup (addr, symbolsize, offset, namebuf);if (!ret) - ret =ftrace_mod_address_lookup (addr, symbolsize, - offset, modname, namebuf); + ret =ftrace_mod_address_lookup (addr, symbolsize, offset, + modname, modbuildid, namebuf);return ret; }
kernel/trace/ftrace.c +4 -1
@@ -7739,7 +7739,8 @@ ftrace_func_address_lookup(struct ftrace_mod_map *mod_map,int ftrace_mod_address_lookup (unsigned long addr,unsigned long *size, -unsigned long *off,char **modname,char *sym) +unsigned long *off,char **modname, +const unsigned char **modbuildid,char *sym) {struct ftrace_mod_map *mod_map;int ret =0 ;
@@ -7751,6 +7752,8 @@ ftrace_mod_address_lookup(unsigned long addr, unsigned long *size,if (ret) {if (modname) *modname = mod_map->mod->name; +if (modbuildid) + *modbuildid =module_buildid (mod_map->mod);break ; } }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 352/781 PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jörg Wedekind <[email protected]>
[ Upstream commit 959ac08a2c2811305be8c2779779e8b0932e5a99 ]
Per PCIe r7.0, sec 2.2.6.2.1 and 7.5.3.4, a Requester may not use 8-bit Tags unless its Extended Tag Field Enable is set, but all Receivers/Completers must handle 8-bit Tags correctly regardless of their Extended Tag Field Enable.
Some devices do not handle 8-bit Tags as Completers, so add a quirk for them. If we find such a device, we disable Extended Tags for the entire hierarchy to make peer-to-peer DMA possible.
The 3ware 9650SA seems to have issues with handling 8-bit tags. Mark it as broken.
This fixes PCI Parity Errors like :
3w-9xxx: scsi0: ERROR: (0x06:0x000C): PCI Parity Error: clearing. 3w-9xxx: scsi0: ERROR: (0x06:0x000D): PCI Abort: clearing. 3w-9xxx: scsi0: ERROR: (0x06:0x000E): Controller Queue Error: clearing. 3w-9xxx: scsi0: ERROR: (0x06:0x0010): Microcontroller Error: clearing.
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -5581,6 +5581,7 @@ static void quirk_no_ext_tags(struct pci_dev *pdev)pci_walk_bus (bridge->bus, pci_configure_extended_tags,NULL ); }DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_3WARE ,0x1004 , quirk_no_ext_tags); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_3WARE ,0x1005 , quirk_no_ext_tags);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SERVERWORKS ,0x0132 , quirk_no_ext_tags);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SERVERWORKS ,0x0140 , quirk_no_ext_tags);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SERVERWORKS ,0x0141 , quirk_no_ext_tags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 353/781 wifi: rtw89: debug: Fix memory leak in __print_txpwr_map()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <[email protected]>
[ Upstream commit 6070a44051b1c35714fa130de7726cfe91ca5559 ]
In __print_txpwr_map(), memory is allocated to bufp via vzalloc(). If max_valid_addr is 0, the function returns -EOPNOTSUPP immediately without freeing bufp, leading to a memory leak.
Since the validation of max_valid_addr does not depend on the allocated memory, fix this by moving the vzalloc() call after the check.
Compile tested only. Issue found using a prototype static analysis tool and code review.
--- drivers/net/wireless/realtek/rtw89/debug.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/realtek/rtw89/debug.c +4 -4
@@ -825,10 +825,6 @@ static ssize_t __print_txpwr_map(struct rtw89_dev *rtwdev, char *buf, size_t bufs8 *bufp, tmp;int ret; - bufp =vzalloc (map->addr_to - map->addr_from +4 ); -if (!bufp) -return -ENOMEM ; -if (path_num ==1 ) max_valid_addr = map->addr_to_1ss;else
@@ -837,6 +833,10 @@ static ssize_t __print_txpwr_map(struct rtw89_dev *rtwdev, char *buf, size_t bufif (max_valid_addr ==0 )return -EOPNOTSUPP ; + bufp =vzalloc (map->addr_to - map->addr_from +4 ); +if (!bufp) +return -ENOMEM ; +for (addr = map->addr_from; addr <= max_valid_addr; addr +=4 ) { ret =rtw89_mac_txpwr_read32 (rtwdev,RTW89_PHY_0 , addr, &val);if (ret)
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 354/781 iommu/vt-d: Flush cache for PASID table before using it
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmytro Maluka <[email protected]>
[ Upstream commit 22d169bdd2849fe6bd18c2643742e1c02be6451c ]
When writing the address of a freshly allocated zero-initialized PASID table to a PASID directory entry, do that after the CPU cache flush for this PASID table, not before it, to avoid the time window when this PASID table may be already used by non-coherent IOMMU hardware while its contents in RAM is still some random old data, not zero-initialized.
--- drivers/iommu/intel/pasid.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/iommu/intel/pasid.c +4 -3
@@ -153,6 +153,9 @@ static struct pasid_entry *intel_pasid_get_entry(struct device *dev, u32 pasid)if (!entries)return NULL ; +if (!ecap_coherent (info->iommu->ecap)) +clflush_cache_range (entries,VTD_PAGE_SIZE ); +/* * The pasid directory table entry won't be freed after * allocation. No worry about the race with free and
@@ -165,10 +168,8 @@ static struct pasid_entry *intel_pasid_get_entry(struct device *dev, u32 pasid)iommu_free_pages (entries); goto retry; } -if (!ecap_coherent (info->iommu->ecap)) { -clflush_cache_range (entries,VTD_PAGE_SIZE ); +if (!ecap_coherent (info->iommu->ecap))clflush_cache_range (&dir[dir_index].val,sizeof (*dir)); - } }return &entries[index];
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 355/781 iommu/vt-d: Clear Present bit before tearing down PASID entry
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
[ Upstream commit 75ed00055c059dedc47b5daaaa2f8a7a019138ff ]
The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implementation zeros the entire 64-byte structure immediately using multiple 64-bit writes.
Since the IOMMU hardware may fetch these 64 bytes using multiple internal transactions (e.g., four 128-bit bursts), updating or zeroing the entire entry while it is active (P=1) risks a "torn" read. If a hardware fetch occurs simultaneously with the CPU zeroing the entry, the hardware could observe an inconsistent state, leading to unpredictable behavior or spurious faults.
Follow the "Guidance to Software for Invalidations" in the VT-d spec (Section 6.5.3.3) by implementing the recommended ownership handshake:
1. Clear only the 'Present' (P) bit of the PASID entry.
2. Use a dma_wmb() to ensure the cleared bit is visible to hardware before proceeding.
3. Execute the required invalidation sequence (PASID cache, IOTLB, and Device-TLB flush) to ensure the hardware has released all cached references.
4. Only after the flushes are complete, zero out the remaining fields of the PASID entry.
Also, add a dma_wmb() in pasid_set_present() to ensure that all other fields of the PASID entry are visible to the hardware before the Present bit is set.
--- drivers/iommu/intel/pasid.c | 6 +++++- drivers/iommu/intel/pasid.h | 14 ++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-)
drivers/iommu/intel/pasid.c +5 -1
@@ -273,7 +273,7 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev, did =pasid_get_domain_id (pte); pgtt =pasid_pte_get_pgtt (pte); -intel_pasid_clear_entry (dev, pasid, fault_ignore); +pasid_clear_present (pte);spin_unlock (&iommu->lock);if (!ecap_coherent (iommu->ecap))
@@ -287,6 +287,10 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev, iommu->flush.flush_iotlb (iommu, did,0 ,0 ,DMA_TLB_DSI_FLUSH );devtlb_invalidation_with_pasid (iommu, dev, pasid); +intel_pasid_clear_entry (dev, pasid, fault_ignore); +if (!ecap_coherent (iommu->ecap)) +clflush_cache_range (pte,sizeof (*pte)); +if (!fault_ignore)intel_iommu_drain_pasid_prq (dev, pasid); }
drivers/iommu/intel/pasid.h +14 -0
@@ -234,9 +234,23 @@ static inline void pasid_set_wpe(struct pasid_entry *pe)*/ static inline void pasid_set_present (struct pasid_entry *pe) { +dma_wmb ();pasid_set_bits (&pe->val[0 ],1 <<0 ,1 ); } +/* +* Clear the Present (P) bit (bit 0) of a scalable-mode PASID table entry. +* This initiates the transition of the entry's ownership from hardware +* to software. The caller is responsible for fulfilling the invalidation +* handshake recommended by the VT-d spec, Section 6.5.3.3 (Guidance to +* Software for Invalidations). +*/ +static inline void pasid_clear_present (struct pasid_entry *pe) +{ +pasid_set_bits (&pe->val[0 ],1 <<0 ,0 ); +dma_wmb (); +} +/* * Setup Page Walk Snoop bit (Bit 87) of a scalable mode PASID * entry.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 356/781 iommu/vt-d: Clear Present bit before tearing down context entry
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
[ Upstream commit c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2 ]
When tearing down a context entry, the current implementation zeros the entire 128-bit entry using multiple 64-bit writes. This creates a window where the hardware can fetch a "torn" entry — where some fields are already zeroed while the 'Present' bit is still set — leading to unpredictable behavior or spurious faults.
While x86 provides strong write ordering, the compiler may reorder writes to the two 64-bit halves of the context entry. Even without compiler reordering, the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes.
Align with the "Guidance to Software for Invalidations" in the VT-d spec (Section 6.5.3.3) by implementing the recommended ownership handshake:
1. Clear only the 'Present' (P) bit of the context entry first to signal the transition of ownership from hardware to software.
2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.
3. Perform the required cache and context-cache invalidation to ensure hardware no longer has cached references to the entry.
4. Fully zero out the entry only after the invalidation is complete.
Also, add a dma_wmb() to context_set_present() to ensure the entry is fully initialized before the 'Present' bit becomes visible.
--- drivers/iommu/intel/iommu.c | 4 +++- drivers/iommu/intel/iommu.h | 21 ++++++++++++++++++++- drivers/iommu/intel/pasid.c | 5 ++++- 3 files changed, 27 insertions(+), 3 deletions(-)
drivers/iommu/intel/iommu.c +3 -1
@@ -1240,10 +1240,12 @@ static void domain_context_clear_one(struct device_domain_info *info, u8 bus, u8 } did =context_domain_id (context); -context_clear_entry (context); +context_clear_present (context);__iommu_flush_cache (iommu, context,sizeof (*context));spin_unlock (&iommu->lock);intel_context_flush_no_pasid (info, context, did); +context_clear_entry (context); +__iommu_flush_cache (iommu, context,sizeof (*context)); } int __domain_setup_first_level(struct intel_iommu *iommu, struct device *dev,
drivers/iommu/intel/iommu.h +20 -1
@@ -900,7 +900,26 @@ static inline int pfn_level_offset(u64 pfn, int level)static inline void context_set_present (struct context_entry *context) { - context->lo |=1 ; +u64 val; + +dma_wmb (); + val =READ_ONCE (context->lo) |1 ; +WRITE_ONCE (context->lo, val); +} + +/* +* Clear the Present (P) bit (bit 0) of a context table entry. This initiates +* the transition of the entry's ownership from hardware to software. The +* caller is responsible for fulfilling the invalidation handshake recommended +* by the VT-d spec, Section 6.5.3.3 (Guidance to Software for Invalidations). +*/ +static inline void context_clear_present (struct context_entry *context) +{ +u64 val; + + val =READ_ONCE (context->lo) &GENMASK_ULL (63 ,1 ); +WRITE_ONCE (context->lo, val); +dma_wmb (); }static inline void context_set_fault_enable (struct context_entry *context)
drivers/iommu/intel/pasid.c +4 -1
@@ -1024,7 +1024,7 @@ static int device_pasid_table_setup(struct device *dev, u8 bus, u8 devfn) }if (context_copied (iommu, bus, devfn)) { -context_clear_entry (context); +context_clear_present (context);__iommu_flush_cache (iommu, context,sizeof (*context));/*
@@ -1044,6 +1044,9 @@ static int device_pasid_table_setup(struct device *dev, u8 bus, u8 devfn) iommu->flush.flush_iotlb (iommu,0 ,0 ,0 ,DMA_TLB_GLOBAL_FLUSH );devtlb_invalidation_with_pasid (iommu, dev,IOMMU_NO_PASID ); +context_clear_entry (context); +__iommu_flush_cache (iommu, context,sizeof (*context)); +/* * At this point, the device is supposed to finish reset at * its driver probe stage, so no in-flight DMA will exist,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 357/781 iommu/vt-d: Fix race condition during PASID entry replacement
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
[ Upstream commit c3b1edea3791fa91ab7032faa90355913ad9451b ]
The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing an active PASID entry (e.g., during domain replacement), the current implementation calculates a new entry on the stack and copies it to the table using a single structure assignment.
struct pasid_entry *pte, new_pte;
pte = intel_pasid_get_entry(dev, pasid);
pasid_pte_config_first_level(iommu, &new_pte, ...);
*pte = new_pte;Because the hardware may fetch the 512-bit PASID entry in multiple 128-bit chunks, updating the entire entry while it is active (Present bit set) risks a "torn" read. In this scenario, the IOMMU hardware could observe an inconsistent state — partially new data and partially old data — leading to unpredictable behavior or spurious faults.
Fix this by removing the unsafe "replace" helpers and following the "clear-then-update" flow, which ensures the Present bit is cleared and the required invalidation handshake is completed before the new configuration is applied.
--- drivers/iommu/intel/iommu.c | 29 +++--- drivers/iommu/intel/nested.c | 9 +- drivers/iommu/intel/pasid.c | 184 ----------------------------------- drivers/iommu/intel/pasid.h | 14 --- 4 files changed, 16 insertions(+), 220 deletions(-)
drivers/iommu/intel/iommu.c +12 -17
@@ -1252,12 +1252,10 @@ int __domain_setup_first_level(struct intel_iommu *iommu, struct device *dev, ioasid_t pasid, u16 did, phys_addr_t fsptptr, int flags, struct iommu_domain *old) { - if (!old) - return intel_pasid_setup_first_level(iommu, dev, fsptptr, pasid, - did, flags); - return intel_pasid_replace_first_level(iommu, dev, fsptptr, pasid, did, -iommu_domain_did (old ,iommu ), -flags ); + if (old) + intel_pasid_tear_down_entry(iommu, dev, pasid, false); + +return intel_pasid_setup_first_level (iommu, dev, fsptptr, pasid, did, flags); } static int domain_setup_second_level(struct intel_iommu *iommu,
@@ -1265,23 +1263,20 @@ static int domain_setup_second_level(struct intel_iommu *iommu, struct device *dev, ioasid_t pasid, struct iommu_domain *old) { - if (!old) - return intel_pasid_setup_second_level(iommu, domain, - dev, pasid); -return intel_pasid_replace_second_level (iommu, domain, dev, -iommu_domain_did (old, iommu), - pasid); + if (old) + intel_pasid_tear_down_entry(iommu, dev, pasid, false); + +return intel_pasid_setup_second_level (iommu, domain, dev, pasid); }static int domain_setup_passthrough (struct intel_iommu *iommu,struct device *dev,ioasid_t pasid,struct iommu_domain *old) { -if (!old) -return intel_pasid_setup_pass_through (iommu, dev, pasid); -return intel_pasid_replace_pass_through (iommu, dev, -iommu_domain_did (old, iommu), - pasid); +if (old) +intel_pasid_tear_down_entry (iommu, dev, pasid, false); + +return intel_pasid_setup_pass_through (iommu, dev, pasid); } static int domain_setup_first_level(struct intel_iommu *iommu,
drivers/iommu/intel/nested.c +4 -5
@@ -136,11 +136,10 @@ static int domain_setup_nested(struct intel_iommu *iommu, struct device *dev, ioasid_t pasid, struct iommu_domain *old) { - if (!old) - return intel_pasid_setup_nested(iommu, dev, pasid, domain); -return intel_pasid_replace_nested (iommu, dev, pasid, -iommu_domain_did (old, iommu), - domain); + if (old) + intel_pasid_tear_down_entry(iommu, dev, pasid, false); + +return intel_pasid_setup_nested (iommu, dev, pasid, domain); } static int intel_nested_set_dev_pasid(struct iommu_domain *domain,
drivers/iommu/intel/pasid.c +0 -184
208 lines not on this page · raw message
drivers/iommu/intel/pasid.h +0 -14
@@ -316,20 +316,6 @@ int intel_pasid_setup_pass_through(struct intel_iommu *iommu, struct device *dev, u32 pasid);int intel_pasid_setup_nested (struct intel_iommu *iommu,struct device *dev,u32 pasid,struct dmar_domain *domain); -int intel_pasid_replace_first_level (struct intel_iommu *iommu, -struct device *dev,phys_addr_t fsptptr, -u32 pasid,u16 did,u16 old_did,int flags); -int intel_pasid_replace_second_level (struct intel_iommu *iommu, -struct dmar_domain *domain, -struct device *dev,u16 old_did, -u32 pasid); -int intel_pasid_replace_pass_through (struct intel_iommu *iommu, -struct device *dev,u16 old_did, -u32 pasid); -int intel_pasid_replace_nested (struct intel_iommu *iommu, -struct device *dev,u32 pasid, -u16 old_did,struct dmar_domain *domain); -void intel_pasid_tear_down_entry (struct intel_iommu *iommu,struct device *dev,u32 pasid,bool fault_ignore);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 358/781 dm: use bio_clone_blkg_association
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 2df8b310bcfe76827fd71092f58a2493ee6590b0 ]
The origin bio carries blk-cgroup information which could be set from foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone"). The synchronous io is still under control by blkcg, because 'bio->bi_blkg' is set by io submitting task which has been added into 'cgroup.procs'.
Fix it by using bio_clone_blkg_association when submitting a cloned bio.
--- drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm.c +2 -0
@@ -1364,6 +1364,8 @@ void dm_submit_bio_remap(struct bio *clone, struct bio *tgt_clone)if (!tgt_clone) tgt_clone = clone; +bio_clone_blkg_association (tgt_clone, io->orig_bio); +/* * Account io->origin_bio to DM dev on behalf of target * that took ownership of IO with DM_MAPIO_SUBMITTED.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 359/781 xdrgen: Fix struct prefix for typedef types in program wrappers
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit bf0fe9ad3d597d8e1378dc9953ca96dfc3addb2b ]
The program templates for decoder/argument.j2 and encoder/result.j2 unconditionally add 'struct' prefix to all types. This is incorrect when an RPC protocol specification lists a typedef'd basic type or an enum as a procedure argument or result (e.g., NFSv2's fhandle or stat), resulting in compiler errors when building generated C code.
--- tools/net/sunrpc/xdrgen/generators/__init__.py | 3 ++- .../sunrpc/xdrgen/templates/C/program/decoder/argument.j2 | 4 ++++ .../net/sunrpc/xdrgen/templates/C/program/encoder/result.j2 | 6 ++++++ 3 files changed, 12 insertions(+), 1 deletion(-)
tools/net/sunrpc/xdrgen/generators/__init__.py +2 -1
@@ -6,7 +6,7 @@ from pathlib import Path from jinja2 import Environment, FileSystemLoader, Template from xdr_ast import _XdrAst, Specification, _RpcProgram, _XdrTypeSpecifier -from xdr_ast import public_apis, pass_by_reference, get_header_name +from xdr_ast import public_apis, pass_by_reference, structs, get_header_name from xdr_parse import get_xdr_annotate
@@ -25,6 +25,7 @@ def create_jinja2_environment(language: str, xdr_type: str) -> Environment: environment.globals["annotate"] = get_xdr_annotate() environment.globals["public_apis"] = public_apis environment.globals["pass_by_reference"] = pass_by_reference + environment.globals["structs"] = structs return environment case _: raise NotImplementedError("Language not supported")
tools/net/sunrpc/xdrgen/templates/C/program/decoder/argument.j2 +4 -0
@@ -14,7 +14,11 @@ bool {{ program }}_svc_decode_{{ argument }}(struct svc_rqst *rqstp, struct xdr_ {% if argument == 'void' %} return xdrgen_decode_void(xdr); {% else %} +{% if argument in structs %} struct {{ argument }} *argp = rqstp->rq_argp; +{% else %} + {{ argument }} *argp = rqstp->rq_argp; +{% endif %} return xdrgen_decode_{{ argument }}(xdr, argp); {% endif %}
tools/net/sunrpc/xdrgen/templates/C/program/encoder/result.j2 +6 -0
@@ -14,8 +14,14 @@ bool {{ program }}_svc_encode_{{ result }}(struct svc_rqst *rqstp, struct xdr_st {% if result == 'void' %} return xdrgen_encode_void(xdr); {% else %} +{% if result in structs %} struct {{ result }} *resp = rqstp->rq_resp; return xdrgen_encode_{{ result }}(xdr, resp); +{% else %} + {{ result }} *resp = rqstp->rq_resp; + + return xdrgen_encode_{{ result }}(xdr, *resp); +{% endif %} {% endif %} }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 360/781 NFS: NFSERR_INVAL is not defined by NFSv2
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 0ac903d1bfdce8ff40657c2b7d996947b72b6645 ]
A documenting comment in include/uapi/linux/nfs.h claims incorrectly that NFSv2 defines NFSERR_INVAL. There is no such definition in either RFC 1094 or https://pubs.opengroup.org/onlinepubs/9629799/chap7.htm
NFS3ERR_INVAL is introduced in RFC 1813.
NFSD returns NFSERR_INVAL for PROC_GETACL, which has no specification (yet).
However, nfsd_map_status() maps nfserr_symlink and nfserr_wrong_type to nfserr_inval, which does not align with RFC 1094. This logic was introduced only recently by commit 438f81e0e92a ("nfsd: move error choice for incorrect object types to version-specific code."). Given that we have no INVAL or SERVERFAULT status in NFSv2, probably the only choice is NFSERR_IO.
--- fs/nfsd/nfs2acl.c | 2 +- fs/nfsd/nfsproc.c | 2 +- include/uapi/linux/nfs.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
fs/nfsd/nfs2acl.c +1 -1
@@ -45,7 +45,7 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst *rqstp) inode =d_inode (fh->fh_dentry);if (argp->mask & ~NFS_ACL_MASK ) { - resp->status = nfserr_inval; + resp->status = nfserr_io; goto out; } resp->mask = argp->mask;
fs/nfsd/nfsproc.c +1 -1
@@ -33,7 +33,7 @@ static __be32 nfsd_map_status(__be32 status)break ;case nfserr_symlink:case nfserr_wrong_type: - status = nfserr_inval; + status = nfserr_io;break ; }return status;
include/uapi/linux/nfs.h +1 -1
@@ -55,7 +55,7 @@NFSERR_NODEV =19 ,/* v2 v3 v4 */ NFSERR_NOTDIR =20 ,/* v2 v3 v4 */ NFSERR_ISDIR =21 ,/* v2 v3 v4 */ -NFSERR_INVAL =22 ,/* v2 v3 v4 */ +NFSERR_INVAL =22 ,/* v3 v4 */ NFSERR_FBIG =27 ,/* v2 v3 v4 */ NFSERR_NOSPC =28 ,/* v2 v3 v4 */ NFSERR_ROFS = 30, /* v2 v3 v4 */
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 361/781 xdrgen: Initialize data pointer for zero-length items
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 27b0fcae8f535fb882b1876227a935dcfdf576aa ]
The xdrgen decoders for strings and opaque data had an optimization that skipped calling xdr_inline_decode() when the item length was zero. This left the data pointer uninitialized, which could lead to unpredictable behavior when callers access it.
Remove the zero-length check and always call xdr_inline_decode(). When passed a length of zero, xdr_inline_decode() returns the current buffer position, which is valid and matches the behavior of hand-coded XDR decoders throughout the kernel.
--- include/linux/sunrpc/xdrgen/_builtins.h | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
include/linux/sunrpc/xdrgen/_builtins.h +8 -12
@@ -188,12 +188,10 @@ xdrgen_decode_string(struct xdr_stream *xdr, string *ptr, u32 maxlen)return false;if (unlikely (maxlen && len > maxlen))return false; -if (len !=0 ) { - p =xdr_inline_decode (xdr, len); -if (unlikely (!p)) -return false; - ptr->data = (unsigned char *)p; - } + p =xdr_inline_decode (xdr, len); +if (unlikely (!p)) +return false; + ptr->data = (unsigned char *)p; ptr->len = len;return true; }
@@ -219,12 +217,10 @@ xdrgen_decode_opaque(struct xdr_stream *xdr, opaque *ptr, u32 maxlen)return false;if (unlikely (maxlen && len > maxlen))return false; -if (len !=0 ) { - p =xdr_inline_decode (xdr, len); -if (unlikely (!p)) -return false; - ptr->data = (u8 *)p; - } + p =xdr_inline_decode (xdr, len); +if (unlikely (!p)) +return false; + ptr->data = (u8 *)p; ptr->len = len;return true; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 362/781 xdrgen: Remove inclusion of nlm4.h header
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit eb1f3b55ac6202a013daf14ed508066947cdafa8 ]
The client-side source code template mistakenly includes the nlm4.h header file, which is specific to the NLM protocol and should not be present in the generic template that generates client stubs for all XDR-based protocols.
--- tools/net/sunrpc/xdrgen/templates/C/source_top/client.j2 | 1 - 1 file changed, 1 deletion(-)
tools/net/sunrpc/xdrgen/templates/C/source_top/client.j2 +0 -1
@@ -8,6 +8,5 @@ #include <linux/sunrpc/xdr.h> #include <linux/sunrpc/xdrgen/_defs.h> #include <linux/sunrpc/xdrgen/_builtins.h> -#include <linux/sunrpc/xdrgen/nlm4.h> #include <linux/sunrpc/clnt.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 363/781 nfsd: never defer requests during idmap lookup
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <[email protected]>
[ Upstream commit f9c206cdc4266caad6a9a7f46341420a10f03ccb ]
During v4 request compound arg decoding, some ops (e.g. SETATTR) can trigger idmap lookup upcalls. When those upcall responses get delayed beyond the allowed time limit, cache_check() will mark the request for deferral and cause it to be dropped.
This prevents nfs4svc_encode_compoundres from being executed, and thus the session slot flag NFSD4_SLOT_INUSE never gets cleared. Subsequent client requests will fail with NFSERR_JUKEBOX, given that the slot will be marked as in-use, making the SEQUENCE op fail.
Fix this by making sure that the RQ_USEDEFERRAL flag is always clear during nfs4svc_decode_compoundargs(), since no v4 request should ever be deferred.
--- fs/nfsd/nfs4idmap.c | 48 +++++++++++++++++++++++++++++++++++++++------ fs/nfsd/nfs4proc.c | 2 -- fs/nfsd/nfs4xdr.c | 16 +++++++++++++++ 3 files changed, 58 insertions(+), 8 deletions(-)
fs/nfsd/nfs4idmap.c +42 -6
@@ -643,13 +643,31 @@ static __be32 encode_name_from_id(struct xdr_stream *xdr,return idmap_id_to_name (xdr, rqstp, type, id); } -__be32 -nfsd_map_name_to_uid (struct svc_rqst *rqstp,const char *name,size_t namelen, -kuid_t *uid) +/** +* nfsd_map_name_to_uid - Map user@domain to local UID +* @rqstp: RPC execution context +* @name: user@domain name to be mapped +* @namelen: length of name, in bytes +* @uid: OUT: mapped local UID value +* +* Returns nfs_ok on success or an NFSv4 status code on failure. +*/ +__be32 nfsd_map_name_to_uid (struct svc_rqst *rqstp,const char *name, +size_t namelen,kuid_t *uid) {__be32 status;u32 id =-1 ; +/* +* The idmap lookup below triggers an upcall that invokes +* cache_check(). RQ_USEDEFERRAL must be clear to prevent +* cache_check() from setting RQ_DROPME via svc_defer(). +* NFSv4 servers are not permitted to drop requests. Also +* RQ_DROPME will force NFSv4.1 session slot processing to +* be skipped. +*/ +WARN_ON_ONCE (test_bit (RQ_USEDEFERRAL , &rqstp->rq_flags)); +if (name ==NULL || namelen ==0 )return nfserr_inval;
@@ -660,13 +678,31 @@ nfsd_map_name_to_uid(struct svc_rqst *rqstp, const char *name, size_t namelen,return status; } -__be32 -nfsd_map_name_to_gid (struct svc_rqst *rqstp,const char *name,size_t namelen, -kgid_t *gid) +/** +* nfsd_map_name_to_gid - Map user@domain to local GID +* @rqstp: RPC execution context +* @name: user@domain name to be mapped +* @namelen: length of name, in bytes +* @gid: OUT: mapped local GID value +* +* Returns nfs_ok on success or an NFSv4 status code on failure. +*/ +__be32 nfsd_map_name_to_gid (struct svc_rqst *rqstp,const char *name, +size_t namelen,kgid_t *gid) {__be32 status;u32 id =-1 ; +/* +* The idmap lookup below triggers an upcall that invokes +* cache_check(). RQ_USEDEFERRAL must be clear to prevent +* cache_check() from setting RQ_DROPME via svc_defer(). +* NFSv4 servers are not permitted to drop requests. Also +* RQ_DROPME will force NFSv4.1 session slot processing to +* be skipped. +*/ +WARN_ON_ONCE (test_bit (RQ_USEDEFERRAL , &rqstp->rq_flags)); +if (name ==NULL || namelen ==0 )return nfserr_inval;
fs/nfsd/nfs4proc.c +0 -2
@@ -3011,8 +3011,6 @@ nfsd4_proc_compound(struct svc_rqst *rqstp)BUG_ON (cstate->replay_owner); out: cstate->status = status; -/* Reset deferral mechanism for RPC deferrals */ -set_bit (RQ_USEDEFERRAL , &rqstp->rq_flags);return rpc_success; }
fs/nfsd/nfs4xdr.c +16 -0
@@ -6013,6 +6013,22 @@ nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, struct xdr_stream *xdr) args->ops = args->iops; args->rqstp = rqstp; +/* +* NFSv4 operation decoders can invoke svc cache lookups +* that trigger svc_defer() when RQ_USEDEFERRAL is set, +* setting RQ_DROPME. This creates two problems: +* +* 1. Non-idempotency: Compounds make it too hard to avoid +* problems if a request is deferred and replayed. +* +* 2. Session slot leakage (NFSv4.1+): If RQ_DROPME is set +* during decode but SEQUENCE executes successfully, the +* session slot will be marked INUSE. The request is then +* dropped before encoding, so the slot is never released, +* rendering it permanently unusable by the client. +*/ +clear_bit (RQ_USEDEFERRAL , &rqstp->rq_flags); +return nfsd4_decode_compound (args); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 364/781 lib/kstrtox: fix kstrtobool() docstring to mention enabled/disabled
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaitanya Mishra <[email protected]>
[ Upstream commit 1921044eebf1d6861a6de1a76e3f63729a45e712 ]
Commit ae5b3500856f ("kstrtox: add support for enabled and disabled in kstrtobool()") added support for 'e'/'E' (enabled) and 'd'/'D' (disabled) inputs, but did not update the docstring accordingly.
Update the docstring to include 'Ee' (for true) and 'Dd' (for false) in the list of accepted first characters.
--- lib/kstrtox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
lib/kstrtox.c +2 -2
@@ -340,8 +340,8 @@ EXPORT_SYMBOL(kstrtos8);* @s: input string * @res: result * -* This routine returns 0 iff the first character is one of 'YyTt1NnFf0', or -* [oO][NnFf] for "on" and "off". Otherwise it will return -EINVAL. Value +* This routine returns 0 iff the first character is one of 'EeYyTt1DdNnFf0', +* or [oO][NnFf] for "on" and "off". Otherwise it will return -EINVAL. Value * pointed to by res is updated upon finding a match. */ noinline
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 365/781 lib/Kconfig.debug: fix BOOTPARAM_HUNG_TASK_PANIC comment
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit dbac35bee8fc844c2d8d6417af874a170a44d41f ]
The comment for CONFIG_BOOTPARAM_HUNG_TASK_PANIC says:
Say N if unsure.
but since commit 9544f9e6947f ("hung_task: panic when there are more than N hung tasks at the same time"), N is not a valid value for the option, leading to a warning at build time:
.config:11736:warning: symbol value 'n' invalid for BOOTPARAM_HUNG_TASK_PANIC
as well as an error when given to menuconfig.
Fix the comment to say '0' instead of 'N'.
--- lib/Kconfig.debug | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/Kconfig.debug +1 -1
@@ -1273,7 +1273,7 @@ config BOOTPARAM_HUNG_TASK_PANIC high-availability systems that have uptime guarantees and where a hung tasks must be resolved ASAP. - Say N if unsure. + Say 0 if unsure. config DETECT_HUNG_TASK_BLOCKER bool "Dump Hung Tasks Blocker"
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 366/781 rust: task: restrict Task::group_leader() to current
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
[ Upstream commit 105ddfb2d2b3acec7a7d9695463df48733d91e6c ]
The Task::group_leader() method currently allows you to access the group_leader() of any task, for example one you hold a refcount to. But this is not safe in general since the group leader could change when a task exits. See for example commit a15f37a40145c ("kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths").
All existing users of Task::group_leader() call this method on current, which is guaranteed running, so there's not an actual issue in Rust code today. But to prevent code in the future from making this mistake, restrict Task::group_leader() so that it can only be called on current.
There are some other cases where accessing task->group_leader is okay. For example it can be safe if you hold tasklist_lock or rcu_read_lock(). However, only supporting current->group_leader is sufficient for all in-tree Rust users of group_leader right now. Safe Rust functionality for accessing it under rcu or while holding tasklist_lock may be added in the future if required by any future Rust module.
This patch is a bugfix in that it prevents users of this API from writing incorrect code. It doesn't change behavior of correct code.
--- rust/kernel/task.rs | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
rust/kernel/task.rs +12 -12
@@ -204,18 +204,6 @@ pub fn as_ptr(&self) -> *mut bindings::task_struct { self.0 .get () } -/// Returns the group leader of the given task. -pub fn group_leader (&self) -> &Task { -// SAFETY: The group leader of a task never changes after initialization, so reading this -// field is not a data race. -let ptr =unsafe { *ptr::addr_of!((*self.as_ptr ()).group_leader) }; - -// SAFETY: The lifetime of the returned task reference is tied to the lifetime of `self`, -// and given that a task has a reference to its group leader, we know it must be valid for -// the lifetime of the returned task reference. -unsafe { &*ptr.cast () } - } -/// Returns the PID of the given task. pub fn pid (&self) ->Pid {// SAFETY: The pid of a task never changes after initialization, so reading this field is
@@ -345,6 +333,18 @@ pub fn active_pid_ns(&self) -> Option<&PidNamespace> {// `release_task()` call. Some (unsafe {PidNamespace ::from_ptr (active_ns) }) } + +/// Returns the group leader of the current task. +pub fn group_leader (&self) -> &Task { +// SAFETY: The group leader of a task never changes while the task is running, and `self` +// is the current task, which is guaranteed running. +let ptr =unsafe { (*self.as_ptr ()).group_leader }; + +// SAFETY: `current->group_leader` stays valid for at least the duration in which `current` +// is running, and the signature of this function ensures that the returned `&Task` can +// only be used while `current` is still valid, thus still running. +unsafe { &*ptr.cast () } + } }// SAFETY: The type invariants guarantee that `Task` is always refcounted.
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 367/781 fat: avoid parent link count underflow in rmdir
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiyu Zhang <[email protected]>
[ Upstream commit 8cafcb881364af5ef3a8b9fed4db254054033d8a ]
Corrupted FAT images can leave a directory inode with an incorrect i_nlink (e.g. 2 even though subdirectories exist). rmdir then unconditionally calls drop_nlink(dir) and can drive i_nlink to 0, triggering the WARN_ON in drop_nlink().
Add a sanity check in vfat_rmdir() and msdos_rmdir(): only drop the parent link count when it is at least 3, otherwise report a filesystem error.
--- fs/fat/namei_msdos.c | 7 ++++++- fs/fat/namei_vfat.c | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-)
fs/fat/namei_msdos.c +6 -1
@@ -325,7 +325,12 @@ static int msdos_rmdir(struct inode *dir, struct dentry *dentry) err =fat_remove_entries (dir, &sinfo);/* and releases bh */ if (err) goto out; -drop_nlink (dir); +if (dir->i_nlink >=3 ) +drop_nlink (dir); +else { +fat_fs_error (sb,"parent dir link count too low (%u)" , + dir->i_nlink); + }clear_nlink (inode);fat_truncate_time (inode,NULL ,S_CTIME );
fs/fat/namei_vfat.c +6 -1
@@ -803,7 +803,12 @@ static int vfat_rmdir(struct inode *dir, struct dentry *dentry) err =fat_remove_entries (dir, &sinfo);/* and releases bh */ if (err) goto out; -drop_nlink (dir); +if (dir->i_nlink >=3 ) +drop_nlink (dir); +else { +fat_fs_error (sb,"parent dir link count too low (%u)" , + dir->i_nlink); + }clear_nlink (inode);fat_truncate_time (inode,NULL ,S_ATIME |S_MTIME );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 368/781 PCI: Rewrite bridge window head alignment function
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit bc75c8e5071120e919beb39e69f0979cccfdf219 ]
The calculation of bridge window head alignment is done by calculate_mem_align() [*]. With the default bridge window alignment, it is used for both head and tail alignment.
The selected head alignment does not always result in tight-fitting resources (gap at d4f00000-d4ffffff):
d4800000-dbffffff : PCI Bus 0000:06
d4800000-d48fffff : PCI Bus 0000:07
d4800000-d4803fff : 0000:07:00.0
d4800000-d4803fff : nvme
d4900000-d49fffff : PCI Bus 0000:0a
d4900000-d490ffff : 0000:0a:00.0
d4900000-d490ffff : r8169
d4910000-d4913fff : 0000:0a:00.0
d4a00000-d4cfffff : PCI Bus 0000:0b
d4a00000-d4bfffff : 0000:0b:00.0
d4a00000-d4bfffff : 0000:0b:00.0
d4c00000-d4c07fff : 0000:0b:00.0
d4d00000-d4dfffff : PCI Bus 0000:15
d4d00000-d4d07fff : 0000:15:00.0
d4d00000-d4d07fff : xhci-hcd
d4e00000-d4efffff : PCI Bus 0000:16
d4e00000-d4e7ffff : 0000:16:00.0
d4e80000-d4e803ff : 0000:16:00.0
d4e80000-d4e803ff : ahci
d5000000-dbffffff : PCI Bus 0000:0cThis has not caused problems (for years) with the default bridge window tail alignment that grossly over-estimates the required tail alignment leaving more tail room than necessary. With the introduction of relaxed tail alignment that leaves no extra tail room whatsoever, any gaps will immediately turn into assignment failures.
Introduce head alignment calculation that ensures no gaps are left and apply the new approach when using relaxed alignment. We may want to consider using it for the normal alignment eventually, but as the first step, solve only the problem with the relaxed tail alignment.
([*] I don't understand the algorithm in calculate_mem_align().)
Stable-dep-of: f909e3ee3ed1 ("PCI: Remove old_size limit from bridge window sizing")
--- drivers/pci/setup-bus.c | 53 ++++++++++++++++++++++++++++++++++------- 1 file changed, 44 insertions(+), 9 deletions(-)
drivers/pci/setup-bus.c +44 -9
@@ -1227,6 +1227,45 @@ static inline resource_size_t calculate_mem_align(resource_size_t *aligns,return min_align; } +/* +* Calculate bridge window head alignment that leaves no gaps in between +* resources. +*/ +static resource_size_t calculate_head_align (resource_size_t *aligns, +int max_order) +{ +resource_size_t head_align =1 ; +resource_size_t remainder =0 ; +int order; + +/* Take the largest alignment as the starting point. */ + head_align <<= max_order +__ffs (SZ_1M ); + +for (order = max_order -1 ; order >=0 ; order--) { +resource_size_t align1 =1 ; + + align1 <<= order +__ffs (SZ_1M ); + +/* +* Account smaller resources with alignment < max_order that +* could be used to fill head room if alignment less than +* max_order is used. +*/ + remainder += aligns[order]; + +/* +* Test if head fill is enough to satisfy the alignment of +* the larger resources after reducing the alignment. +*/ +while ((head_align > align1) && (remainder >= head_align /2 )) { + head_align /=2 ; + remainder -= head_align; + } + } + +return head_align; +} +/** * pbus_upstream_space_available - Check no upstream resource limits allocation * @bus: The bus
@@ -1314,13 +1353,13 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type, {struct pci_dev *dev;resource_size_t min_align, win_align, align, size, size0, size1 =0 ; -resource_size_t aligns[28 ];/* Alignments from 1MB to 128TB */ +resource_size_t aligns[28 ] = {};/* Alignments from 1MB to 128TB */ +resource_size_t aligns2[28 ] = {};/* Alignments from 1MB to 128TB */ int order, max_order;struct resource *b_res =pbus_select_window_for_type (bus, type);resource_size_t children_add_size =0 ;resource_size_t children_add_align =0 ;resource_size_t add_align =0 ; -resource_size_t relaxed_align;resource_size_t old_size;if (!b_res)
@@ -1330,7 +1369,6 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type,if (b_res->parent)return ; -memset (aligns,0 ,sizeof (aligns)); max_order =0 ; size =0 ;
@@ -1381,6 +1419,7 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type,*/ if (r_size <= align) aligns[order] += align; + aligns2[order] += align;if (order > max_order) max_order = order;
@@ -1405,9 +1444,7 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type,if (bus->self && size0 && !pbus_upstream_space_available (bus, b_res, size0, min_align)) { - relaxed_align =1ULL << (max_order +__ffs (SZ_1M )); - relaxed_align =max (relaxed_align, win_align); - min_align =min (min_align, relaxed_align); + min_align =calculate_head_align (aligns2, max_order); size0 =calculate_memsize (size, min_size,0 ,0 , old_size, win_align);resource_set_range (b_res, min_align, size0); pci_info(bus->self, "bridge window %pR to %pR requires relaxed alignment rules\n",
@@ -1421,9 +1458,7 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type,if (bus->self && size1 && !pbus_upstream_space_available (bus, b_res, size1, add_align)) { - relaxed_align =1ULL << (max_order +__ffs (SZ_1M )); - relaxed_align =max (relaxed_align, win_align); - min_align =min (min_align, relaxed_align); + min_align =calculate_head_align (aligns2, max_order); size1 =calculate_memsize (size, min_size, add_size, children_add_size, old_size, win_align); pci_info(bus->self,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 369/781 PCI: Stop over-estimating bridge window size
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 3958bf16e2fe1b1c95467e58694102122c951a31 ]
New way to calculate the bridge window head alignment produces tight-fit, that is, it does not leave any gaps between the resources. Similarly, relaxed tail alignment does not leave extra tail room.
Start to use bridge window calculation that does not over-estimate the size of the required window.
pbus_upstream_space_available() can be removed.
Stable-dep-of: f909e3ee3ed1 ("PCI: Remove old_size limit from bridge window sizing")
--- drivers/pci/setup-bus.c | 97 +++-------------------------------------- 1 file changed, 5 insertions(+), 92 deletions(-)
drivers/pci/setup-bus.c +5 -92
@@ -1266,68 +1266,6 @@ static resource_size_t calculate_head_align(resource_size_t *aligns,return head_align; } -/** -* pbus_upstream_space_available - Check no upstream resource limits allocation -* @bus: The bus -* @res: The resource to help select the correct bridge window -* @size: The size required from the bridge window -* @align: Required alignment for the resource -* -* Check that @size can fit inside the upstream bridge resources that are -* already assigned. Select the upstream bridge window based on the type of -* @res. -* -* Return: %true if enough space is available on all assigned upstream -* resources. -*/ -static bool pbus_upstream_space_available (struct pci_bus *bus, -struct resource *res, -resource_size_t size, -resource_size_t align) -{ -struct resource_constraint constraint = { - .max =RESOURCE_SIZE_MAX , - .align = align, - }; -struct pci_bus *downstream = bus; - -while ((bus = bus->parent)) { -if (pci_is_root_bus (bus)) -break ; - - res =pbus_select_window (bus, res); -if (!res) -return false; -if (!res->parent) -continue ; - -if (resource_size (res) >= size) { -struct resource gap = {}; - -if (find_resource_space (res, &gap, size, &constraint) ==0 ) { - gap.flags = res->flags; -pci_dbg (bus->self, -"Assigned bridge window %pR to %pR free space at %pR\n" , - res, &bus->busn_res, &gap); -return true; - } - } - -if (bus->self) { -pci_info (bus->self, -"Assigned bridge window %pR to %pR cannot fit 0x%llx required for %s bridging to %pR\n" , - res, &bus->busn_res, - (unsigned long long )size, -pci_name (downstream->self), - &downstream->busn_res); - } - -return false; - } - -return true; -} -/** * pbus_size_mem() - Size the memory window of a given bus *
@@ -1354,7 +1292,6 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type,struct pci_dev *dev;resource_size_t min_align, win_align, align, size, size0, size1 =0 ;resource_size_t aligns[28 ] = {};/* Alignments from 1MB to 128TB */ -resource_size_t aligns2[28 ] = {};/* Alignments from 1MB to 128TB */ int order, max_order;struct resource *b_res =pbus_select_window_for_type (bus, type);resource_size_t children_add_size =0 ;
@@ -1413,13 +1350,8 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type,continue ; } size +=max (r_size, align); -/* -* Exclude ranges with size > align from calculation of -* the alignment. -*/ -if (r_size <= align) - aligns[order] += align; - aligns2[order] += align; + + aligns[order] += align;if (order > max_order) max_order = order;
@@ -1433,38 +1365,19 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type, old_size =resource_size (b_res); win_align =window_alignment (bus, b_res->flags); - min_align =calculate_mem_align (aligns, max_order); + min_align =calculate_head_align (aligns, max_order); min_align =max (min_align, win_align); - size0 =calculate_memsize (size, min_size,0 ,0 , old_size, min_align); + size0 =calculate_memsize (size, min_size,0 ,0 , old_size, win_align);if (size0) {resource_set_range (b_res, min_align, size0); b_res->flags &= ~IORESOURCE_DISABLED ; } -if (bus->self && size0 && - !pbus_upstream_space_available (bus, b_res, size0, min_align)) { - min_align =calculate_head_align (aligns2, max_order); - size0 =calculate_memsize (size, min_size,0 ,0 , old_size, win_align); -resource_set_range (b_res, min_align, size0); -pci_info (bus->self,"bridge window %pR to %pR requires relaxed alignment rules\n" , - b_res, &bus->busn_res); - } -if (realloc_head && (add_size >0 || children_add_size >0 )) { add_align =max (min_align, add_align); size1 =calculate_memsize (size, min_size, add_size, children_add_size, - old_size, add_align); - -if (bus->self && size1 && - !pbus_upstream_space_available (bus, b_res, size1, add_align)) { - min_align =calculate_head_align (aligns2, max_order); - size1 =calculate_memsize (size, min_size, add_size, children_add_size, - old_size, win_align); -pci_info (bus->self, -"bridge window %pR to %pR requires relaxed alignment rules\n" , - b_res, &bus->busn_res); - } + old_size, win_align); }if (!size0 && !size1) {
Signature · 1 line
2.51.0