7.1.10-rc1 review
Greg Kroah-Hartman
maintainerPATCH 151/228 drm/amd/display: Fix type mismatches in DML and normalize loop bounds
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaghik Khachatrian <[email protected]>
[ Upstream commit faaeeecef94ad312b051dbe628d6e3f016ba5263 ]
[Why]
Address signed/unsigned comparison warnings across DML paths to keep builds warning-clean and improve type safety at comparison boundaries. Most warnings came from signed loop/index temporaries compared against unsigned counters (for example pipe_count, num_states, and candidate/state counts), plus a small number of mixed signed/unsigned clock and geometry checks.
[How]
Aligned iterator and temporary variable types with the semantic type of the compared bounds. Used unsigned indices for loops bounded by unsigned counters, and retained signed types where values are semantically signed (for example plane_count math, timing/micro-schedule arithmetic, and reverse/sentinel-style iteration). Where mixed signed/unsigned comparisons are intentional, applied explicit boundary casts instead of broad type changes (for example dispclk minimum clamp and selected timing/height comparisons).
As a side effect of converting count parameters such as NumberOfActivePlanes to unsigned, normalized equivalent loop forms from:
for (i = 0; i <= NumberOfActivePlanes - 1; i++)
into the normalized form:
for (i = 0; i < NumberOfActivePlanes; i++)
to keep bound style coherent and avoid avoidable mismatch patterns.
No functional behavior changes are intended; this is a warning-resolution and type-alignment cleanup.
Stable-dep-of: 93c8fe6d5603 ("drm/amd/display: guard against overflow in HDCP message dump")
--- drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c | 9 drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 34 +- drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c | 36 +- drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 36 +- drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c | 36 +- drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c | 14 - drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c | 83 +++--- drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c | 5 drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 2 drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 2 drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 15 - drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c | 121 +++++---- drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c | 5 drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c | 129 +++++----- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 75 +++-- drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c | 21 - drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c | 2 drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 46 +-- drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 5 drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c | 5 drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c | 4 21 files changed, 366 insertions(+), 319 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c +5 -4
@@ -759,7 +759,8 @@ bool dcn_validate_bandwidth(const struct resource_pool *pool = dc->res_pool;struct dcn_bw_internal_vars *v = &context->dcn_bw_vars; -int i, input_idx, k; +unsigned int i; +int input_idx, k;int vesa_sync_start, asic_blank_end, asic_blank_start;bool bw_limit_pass;float bw_limit;
@@ -1168,9 +1169,9 @@ bool dcn_validate_bandwidth( context->bw_ctx.bw.dcn.clk.dispclk_khz = (int )(dc->dcn_soc->max_dispclk_vmax0p9 *1000 );if (context->bw_ctx.bw.dcn.clk.dispclk_khz < - dc->debug.min_disp_clk_khz) { + (int )dc->debug.min_disp_clk_khz) { context->bw_ctx.bw.dcn.clk.dispclk_khz = - dc->debug.min_disp_clk_khz; + (int )dc->debug.min_disp_clk_khz; } context->bw_ctx.bw.dcn.clk.dppclk_khz = context->bw_ctx.bw.dcn.clk.dispclk_khz /
@@ -1307,7 +1308,7 @@ bool dcn_validate_bandwidth(PERFORMANCE_TRACE_END ();BW_VAL_TRACE_FINISH (); -if (bw_limit_pass && v->voltage_level <=get_highest_allowed_voltage_level (dc->config.is_vmin_only_asic)) +if (bw_limit_pass && v->voltage_level <= (int )get_highest_allowed_voltage_level (dc->config.is_vmin_only_asic))return true;else return false;
drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c +20 -14
@@ -990,7 +990,8 @@ void dcn20_populate_dml_writeback_from_cstruct resource_context *res_ctx, display_e2e_pipe_params_st *pipes) { - int pipe_cnt, i; + unsigned int i; +int pipe_cnt;dc_assert_fp_enabled ();
@@ -1044,7 +1045,7 @@ void dcn20_fpu_set_wb_arb_params(structstatic bool is_dtbclk_required (struct dc *dc,struct dc_state *context) { -int i; +unsigned int i;for (i =0 ; i < dc->res_pool->pipe_count; i++) {if (!context->res_ctx.pipe_ctx[i].stream)continue ;
@@ -1134,7 +1135,7 @@ static void dcn20_adjust_freesync_v_star/* The newVStartUp is 1 line before vsync point */ newVstartup = asic_blank_end +1 ; - *vstartup_start = ((newVstartup > *vstartup_start) ? newVstartup : *vstartup_start); + *vstartup_start = (((int )newVstartup > *vstartup_start) ? (int )newVstartup : *vstartup_start); } void dcn20_calculate_dlg_params(struct dc *dc,
@@ -1143,7 +1144,8 @@ void dcn20_calculate_dlg_params(struct dint pipe_cnt, int vlevel) { - int i, pipe_idx, active_hubp_count = 0; + int pipe_idx, active_hubp_count = 0; +unsigned int i;dc_assert_fp_enabled ();
@@ -1155,7 +1157,7 @@ void dcn20_calculate_dlg_params(struct d context->bw_ctx.bw.dcn.clk.socclk_khz = context->bw_ctx.dml.vba.SOCCLK *1000 ; context->bw_ctx.bw.dcn.clk.dramclk_khz = context->bw_ctx.dml.vba.DRAMSpeed *1000 /16 ; -if (dc->debug.min_dram_clk_khz > context->bw_ctx.bw.dcn.clk.dramclk_khz) +if ((int )dc->debug.min_dram_clk_khz > context->bw_ctx.bw.dcn.clk.dramclk_khz) context->bw_ctx.bw.dcn.clk.dramclk_khz = dc->debug.min_dram_clk_khz; context->bw_ctx.bw.dcn.clk.dcfclk_deep_sleep_khz = context->bw_ctx.dml.vba.DCFCLKDeepSleep *1000 ;
@@ -1173,8 +1175,8 @@ void dcn20_calculate_dlg_params(struct d context->bw_ctx.bw.dcn.clk.dtbclk_en =is_dtbclk_required (dc, context); -if (context->bw_ctx.bw.dcn.clk.dispclk_khz < dc->debug.min_disp_clk_khz) - context->bw_ctx.bw.dcn.clk.dispclk_khz = dc->debug.min_disp_clk_khz; +if ((unsigned int )context->bw_ctx.bw.dcn.clk.dispclk_khz < dc->debug.min_disp_clk_khz) + context->bw_ctx.bw.dcn.clk.dispclk_khz = (int )dc->debug.min_disp_clk_khz;for (i =0 , pipe_idx =0 ; i < dc->res_pool->pipe_count; i++) {if (!context->res_ctx.pipe_ctx[i].stream)
@@ -1317,7 +1319,8 @@ int dcn20_populate_dml_pipes_from_contex enum dc_validate_mode validate_mode) { (void )validate_mode; -int pipe_cnt, i; +int pipe_cnt; +unsigned int i;bool synchronized_vblank = true;struct resource_context *res_ctx = &context->res_ctx;
@@ -1735,7 +1738,8 @@ void dcn20_calculate_wm(struct dc *dc, sint vlevel, enum dc_validate_mode validate_mode) { - int pipe_cnt, i, pipe_idx; + int pipe_cnt, pipe_idx; +unsigned int i;dc_assert_fp_enabled ();
@@ -1853,7 +1857,7 @@ void dcn20_update_bounding_box(struct dc {int num_calculated_states =0 ;int min_dcfclk =0 ; -int i; +unsigned int i;dc_assert_fp_enabled ();
@@ -1914,7 +1918,7 @@ void dcn20_update_bounding_box(struct dcvoid dcn20_cap_soc_clocks (struct _vcs_dpi_soc_bounding_box_st *bb,struct pp_smu_nv_clock_table max_clocks) { -int i; +unsigned int i;dc_assert_fp_enabled ();
@@ -2158,7 +2162,7 @@ int dcn21_populate_dml_pipes_from_contex enum dc_validate_mode validate_mode) {uint32_t pipe_cnt; -int i; +unsigned int i;dc_assert_fp_enabled ();
@@ -2240,7 +2244,8 @@ static void dcn21_calculate_wm(struct dcint vlevel_req, enum dc_validate_mode validate_mode) { - int pipe_cnt, i, pipe_idx; + int pipe_cnt, pipe_idx; +unsigned int i;int vlevel, vlevel_max;struct wm_range_table_entry *table_entry;struct clk_bw_params *bw_params = dc->clk_mgr->bw_params;
@@ -2476,7 +2481,8 @@ void dcn201_populate_dml_writeback_from_struct resource_context *res_ctx, display_e2e_pipe_params_st *pipes) { - int pipe_cnt, i, j; + int pipe_cnt; +unsigned int i, j;double max_calc_writeback_dispclk;double writeback_dispclk;struct writeback_st dout_wb = {0 };
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +18 -18
@@ -3288,8 +3288,8 @@ void dml20_ModeSupportAndSystemConfigura {struct vba_vars_st *locals = &mode_lib->vba; -int i; -unsigned int j, k, m; +int idx; +unsigned int i, j, k, m;/*MODE SUPPORT, VOLTAGE STATE AND SOC CONFIGURATION*/
@@ -5018,7 +5018,7 @@ void dml20_ModeSupportAndSystemConfigura }/*Mode Support, Voltage State and SOC Configuration*/ -for (i = mode_lib->vba.soc.num_states; i >=0 ; i--) { +for (idx = mode_lib->vba.soc.num_states; idx >=0 ; idx--) {for (j =0 ; j <2 ; j++) {enum dm_validation_status status =DML_VALIDATION_OK ;
@@ -5026,21 +5026,21 @@ void dml20_ModeSupportAndSystemConfigura status =DML_FAIL_SCALE_RATIO_TAP ; }else if (mode_lib->vba.SourceFormatPixelAndScanSupport != true) { status =DML_FAIL_SOURCE_PIXEL_FORMAT ; - }else if (locals->ViewportSizeSupport[i][0 ] != true) { + }else if (locals->ViewportSizeSupport[idx][0 ] != true) { status =DML_FAIL_VIEWPORT_SIZE ; - }else if (locals->DIOSupport[i] != true) { + }else if (locals->DIOSupport[idx] != true) { status =DML_FAIL_DIO_SUPPORT ; - }else if (locals->NotEnoughDSCUnits[i] != false) { + }else if (locals->NotEnoughDSCUnits[idx] != false) { status =DML_FAIL_NOT_ENOUGH_DSC ; - }else if (locals->DSCCLKRequiredMoreThanSupported[i] != false) { + }else if (locals->DSCCLKRequiredMoreThanSupported[idx] != false) { status =DML_FAIL_DSC_CLK_REQUIRED ; - }else if (locals->UrgentLatencySupport[i][j] != true) { + }else if (locals->UrgentLatencySupport[idx][j] != true) { status =DML_FAIL_URGENT_LATENCY ; - }else if (locals->ROBSupport[i][0 ] != true) { + }else if (locals->ROBSupport[idx][0 ] != true) { status =DML_FAIL_REORDERING_BUFFER ; - }else if (locals->DISPCLK_DPPCLK_Support[i][j] != true) { + }else if (locals->DISPCLK_DPPCLK_Support[idx][j] != true) { status =DML_FAIL_DISPCLK_DPPCLK ; - }else if (locals->TotalAvailablePipesSupport[i][j] != true) { + }else if (locals->TotalAvailablePipesSupport[idx][j] != true) { status =DML_FAIL_TOTAL_AVAILABLE_PIPES ; }else if (mode_lib->vba.NumberOfOTGSupport != true) { status =DML_FAIL_NUM_OTG ;
@@ -5054,24 +5054,24 @@ void dml20_ModeSupportAndSystemConfigura status =DML_FAIL_CURSOR_SUPPORT ; }else if (mode_lib->vba.PitchSupport != true) { status =DML_FAIL_PITCH_SUPPORT ; - }else if (locals->PrefetchSupported[i][j] != true) { + }else if (locals->PrefetchSupported[idx][j] != true) { status =DML_FAIL_PREFETCH_SUPPORT ; - }else if (locals->TotalVerticalActiveBandwidthSupport[i][0 ] != true) { + }else if (locals->TotalVerticalActiveBandwidthSupport[idx][0 ] != true) { status =DML_FAIL_TOTAL_V_ACTIVE_BW ; - }else if (locals->VRatioInPrefetchSupported[i][j] != true) { + }else if (locals->VRatioInPrefetchSupported[idx][j] != true) { status =DML_FAIL_V_RATIO_PREFETCH ; - }else if (locals->PTEBufferSizeNotExceeded[i][j] != true) { + }else if (locals->PTEBufferSizeNotExceeded[idx][j] != true) { status =DML_FAIL_PTE_BUFFER_SIZE ; }else if (mode_lib->vba.NonsupportedDSCInputBPC != false) { status =DML_FAIL_DSC_INPUT_BPC ; }if (status ==DML_VALIDATION_OK ) { - locals->ModeSupport[i][j] = true; + locals->ModeSupport[idx][j] = true; }else { - locals->ModeSupport[i][j] = false; + locals->ModeSupport[idx][j] = false; } - locals->ValidationStatus[i] = status; + locals->ValidationStatus[idx] = status; } } {
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +18 -18
@@ -3396,8 +3396,8 @@ void dml20v2_ModeSupportAndSystemConfigu {struct vba_vars_st *locals = &mode_lib->vba; -int i; -unsigned int j, k, m; +int idx; +unsigned int i, j, k, m;/*MODE SUPPORT, VOLTAGE STATE AND SOC CONFIGURATION*/
@@ -5135,7 +5135,7 @@ void dml20v2_ModeSupportAndSystemConfigu }/*Mode Support, Voltage State and SOC Configuration*/ -for (i = mode_lib->vba.soc.num_states; i >=0 ; i--) { +for (idx = mode_lib->vba.soc.num_states; idx >=0 ; idx--) {for (j =0 ; j <2 ; j++) {enum dm_validation_status status =DML_VALIDATION_OK ;
@@ -5143,21 +5143,21 @@ void dml20v2_ModeSupportAndSystemConfigu status =DML_FAIL_SCALE_RATIO_TAP ; }else if (mode_lib->vba.SourceFormatPixelAndScanSupport != true) { status =DML_FAIL_SOURCE_PIXEL_FORMAT ; - }else if (locals->ViewportSizeSupport[i][0 ] != true) { + }else if (locals->ViewportSizeSupport[idx][0 ] != true) { status =DML_FAIL_VIEWPORT_SIZE ; - }else if (locals->DIOSupport[i] != true) { + }else if (locals->DIOSupport[idx] != true) { status =DML_FAIL_DIO_SUPPORT ; - }else if (locals->NotEnoughDSCUnits[i] != false) { + }else if (locals->NotEnoughDSCUnits[idx] != false) { status =DML_FAIL_NOT_ENOUGH_DSC ; - }else if (locals->DSCCLKRequiredMoreThanSupported[i] != false) { + }else if (locals->DSCCLKRequiredMoreThanSupported[idx] != false) { status =DML_FAIL_DSC_CLK_REQUIRED ; - }else if (locals->UrgentLatencySupport[i][j] != true) { + }else if (locals->UrgentLatencySupport[idx][j] != true) { status =DML_FAIL_URGENT_LATENCY ; - }else if (locals->ROBSupport[i][0 ] != true) { + }else if (locals->ROBSupport[idx][0 ] != true) { status =DML_FAIL_REORDERING_BUFFER ; - }else if (locals->DISPCLK_DPPCLK_Support[i][j] != true) { + }else if (locals->DISPCLK_DPPCLK_Support[idx][j] != true) { status =DML_FAIL_DISPCLK_DPPCLK ; - }else if (locals->TotalAvailablePipesSupport[i][j] != true) { + }else if (locals->TotalAvailablePipesSupport[idx][j] != true) { status =DML_FAIL_TOTAL_AVAILABLE_PIPES ; }else if (mode_lib->vba.NumberOfOTGSupport != true) { status =DML_FAIL_NUM_OTG ;
@@ -5171,24 +5171,24 @@ void dml20v2_ModeSupportAndSystemConfigu status =DML_FAIL_CURSOR_SUPPORT ; }else if (mode_lib->vba.PitchSupport != true) { status =DML_FAIL_PITCH_SUPPORT ; - }else if (locals->PrefetchSupported[i][j] != true) { + }else if (locals->PrefetchSupported[idx][j] != true) { status =DML_FAIL_PREFETCH_SUPPORT ; - }else if (locals->TotalVerticalActiveBandwidthSupport[i][0 ] != true) { + }else if (locals->TotalVerticalActiveBandwidthSupport[idx][0 ] != true) { status =DML_FAIL_TOTAL_V_ACTIVE_BW ; - }else if (locals->VRatioInPrefetchSupported[i][j] != true) { + }else if (locals->VRatioInPrefetchSupported[idx][j] != true) { status =DML_FAIL_V_RATIO_PREFETCH ; - }else if (locals->PTEBufferSizeNotExceeded[i][j] != true) { + }else if (locals->PTEBufferSizeNotExceeded[idx][j] != true) { status =DML_FAIL_PTE_BUFFER_SIZE ; }else if (mode_lib->vba.NonsupportedDSCInputBPC != false) { status =DML_FAIL_DSC_INPUT_BPC ; }if (status ==DML_VALIDATION_OK ) { - locals->ModeSupport[i][j] = true; + locals->ModeSupport[idx][j] = true; }else { - locals->ModeSupport[i][j] = false; + locals->ModeSupport[idx][j] = false; } - locals->ValidationStatus[i] = status; + locals->ValidationStatus[idx] = status; } } {
drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +18 -18
@@ -3525,8 +3525,8 @@ void dml21_ModeSupportAndSystemConfigura {struct vba_vars_st *locals = &mode_lib->vba; -int i; -unsigned int j, k, m; +int idx; +unsigned int i, j, k, m;/*MODE SUPPORT, VOLTAGE STATE AND SOC CONFIGURATION*/
@@ -5138,7 +5138,7 @@ void dml21_ModeSupportAndSystemConfigura }/*Mode Support, Voltage State and SOC Configuration*/ -for (i = mode_lib->vba.soc.num_states; i >=0 ; i--) { +for (idx = mode_lib->vba.soc.num_states; idx >=0 ; idx--) {for (j =0 ; j <2 ; j++) {enum dm_validation_status status =DML_VALIDATION_OK ;
@@ -5146,19 +5146,19 @@ void dml21_ModeSupportAndSystemConfigura status =DML_FAIL_SCALE_RATIO_TAP ; }else if (!mode_lib->vba.SourceFormatPixelAndScanSupport) { status =DML_FAIL_SOURCE_PIXEL_FORMAT ; - }else if (!locals->ViewportSizeSupport[i][0 ]) { + }else if (!locals->ViewportSizeSupport[idx][0 ]) { status =DML_FAIL_VIEWPORT_SIZE ; - }else if (!locals->DIOSupport[i]) { + }else if (!locals->DIOSupport[idx]) { status =DML_FAIL_DIO_SUPPORT ; - }else if (locals->NotEnoughDSCUnits[i]) { + }else if (locals->NotEnoughDSCUnits[idx]) { status =DML_FAIL_NOT_ENOUGH_DSC ; - }else if (locals->DSCCLKRequiredMoreThanSupported[i]) { + }else if (locals->DSCCLKRequiredMoreThanSupported[idx]) { status =DML_FAIL_DSC_CLK_REQUIRED ; - }else if (!locals->ROBSupport[i][0 ]) { + }else if (!locals->ROBSupport[idx][0 ]) { status =DML_FAIL_REORDERING_BUFFER ; - }else if (!locals->DISPCLK_DPPCLK_Support[i][j]) { + }else if (!locals->DISPCLK_DPPCLK_Support[idx][j]) { status =DML_FAIL_DISPCLK_DPPCLK ; - }else if (!locals->TotalAvailablePipesSupport[i][j]) { + }else if (!locals->TotalAvailablePipesSupport[idx][j]) { status =DML_FAIL_TOTAL_AVAILABLE_PIPES ; }else if (!mode_lib->vba.NumberOfOTGSupport) { status =DML_FAIL_NUM_OTG ;
@@ -5172,27 +5172,27 @@ void dml21_ModeSupportAndSystemConfigura status =DML_FAIL_CURSOR_SUPPORT ; }else if (!mode_lib->vba.PitchSupport) { status =DML_FAIL_PITCH_SUPPORT ; - }else if (!locals->TotalVerticalActiveBandwidthSupport[i][0 ]) { + }else if (!locals->TotalVerticalActiveBandwidthSupport[idx][0 ]) { status =DML_FAIL_TOTAL_V_ACTIVE_BW ; - }else if (!locals->PTEBufferSizeNotExceeded[i][j]) { + }else if (!locals->PTEBufferSizeNotExceeded[idx][j]) { status =DML_FAIL_PTE_BUFFER_SIZE ; }else if (mode_lib->vba.NonsupportedDSCInputBPC) { status =DML_FAIL_DSC_INPUT_BPC ; }else if ((mode_lib->vba.HostVMEnable - && !locals->ImmediateFlipSupportedForState[i][j])) { + && !locals->ImmediateFlipSupportedForState[idx][j])) { status =DML_FAIL_HOST_VM_IMMEDIATE_FLIP ; - }else if (!locals->PrefetchSupported[i][j]) { + }else if (!locals->PrefetchSupported[idx][j]) { status =DML_FAIL_PREFETCH_SUPPORT ; - }else if (!locals->VRatioInPrefetchSupported[i][j]) { + }else if (!locals->VRatioInPrefetchSupported[idx][j]) { status =DML_FAIL_V_RATIO_PREFETCH ; }if (status ==DML_VALIDATION_OK ) { - locals->ModeSupport[i][j] = true; + locals->ModeSupport[idx][j] = true; }else { - locals->ModeSupport[i][j] = false; + locals->ModeSupport[idx][j] = false; } - locals->ValidationStatus[i] = status; + locals->ValidationStatus[idx] = status; } } {
drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c +8 -6
@@ -181,7 +181,8 @@ struct _vcs_dpi_soc_bounding_box_st dcn3void dcn30_fpu_populate_dml_writeback_from_context (struct dc *dc,struct resource_context *res_ctx,display_e2e_pipe_params_st *pipes) { -int pipe_cnt, i, j; +int pipe_cnt; +unsigned int i, j;double max_calc_writeback_dispclk;double writeback_dispclk;struct writeback_st dout_wb = {0 };
@@ -308,6 +309,7 @@ void dcn30_fpu_calculate_wm_and_dlg( {int maxMpcComb = context->bw_ctx.dml.vba.maxMpcComb;int i, pipe_idx; +unsigned int pipe_i, state_i;double dcfclk = context->bw_ctx.dml.vba.DCFCLKState[vlevel][maxMpcComb];bool pstate_en = context->bw_ctx.dml.vba.DRAMClockChangeSupport[vlevel][maxMpcComb] != dm_dram_clock_change_unsupported;unsigned int dummy_latency_index =0 ;
@@ -475,8 +477,8 @@ void dcn30_fpu_calculate_wm_and_dlg(/* Make set D = set A until set D is enabled */ context->bw_ctx.bw.dcn.watermarks.d = context->bw_ctx.bw.dcn.watermarks.a; -for (i =0 , pipe_idx =0 ; i < dc->res_pool->pipe_count; i++) { -if (!context->res_ctx.pipe_ctx[i].stream) +for (pipe_i =0 , pipe_idx =0 ; pipe_i < dc->res_pool->pipe_count; pipe_i++) { +if (!context->res_ctx.pipe_ctx[pipe_i].stream)continue ; pipes[pipe_idx].clks_cfg.dispclk_mhz =get_dispclk_calculated (&context->bw_ctx.dml, pipes, pipe_cnt);
@@ -500,9 +502,9 @@ void dcn30_fpu_calculate_wm_and_dlg( context->bw_ctx.dml.vba.DRAMSpeed <= 1700 && context->bw_ctx.dml.vba.DRAMSpeed >= 1500) { -for (i =0 ; i < dc->dml.soc.num_states; i++) { -if (dc->dml.soc.clock_limits[i].dram_speed_mts >1700 ) { - context->bw_ctx.dml.vba.DRAMSpeed = dc->dml.soc.clock_limits[i].dram_speed_mts; +for (state_i =0 ; state_i < dc->dml.soc.num_states; state_i++) { +if (dc->dml.soc.clock_limits[state_i].dram_speed_mts >1700 ) { + context->bw_ctx.dml.vba.DRAMSpeed = dc->dml.soc.clock_limits[state_i].dram_speed_mts;break ; } }
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +45 -38
202 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c +3 -2
@@ -326,7 +326,8 @@ void dcn301_fpu_update_bw_bounding_box(sstruct dcn301_resource_pool *pool =TO_DCN301_RES_POOL (dc->res_pool);struct clk_limit_table *clk_table = &bw_params->clk_table;unsigned int i, closest_clk_lvl; -int j =0 , max_dispclk_mhz =0 , max_dppclk_mhz =0 ; +int j =0 ; +unsigned int max_dispclk_mhz =0 , max_dppclk_mhz =0 ;dc_assert_fp_enabled ();
@@ -429,7 +430,7 @@ void dcn301_fpu_calculate_wm_and_dlg(str int pipe_cnt, int vlevel_req) { - int i, pipe_idx; +unsigned int i, pipe_idx;int vlevel, vlevel_max;struct wm_range_table_entry *table_entry;struct clk_bw_params *bw_params = dc->clk_mgr->bw_params;
drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c +1 -1
@@ -218,7 +218,7 @@ void dcn302_fpu_update_bw_bounding_box(s dc->dml.soc.dispclk_dppclk_vco_speed_mhz = dc->clk_mgr->dentist_vco_freq_khz /1000.0 ;if (bw_params->clk_table.entries[0 ].memclk_mhz) { -int max_dcfclk_mhz =0 , max_dispclk_mhz =0 , max_dppclk_mhz =0 , max_phyclk_mhz =0 ; +unsigned int max_dcfclk_mhz =0 , max_dispclk_mhz =0 , max_dppclk_mhz =0 , max_phyclk_mhz =0 ;for (i =0 ; i <MAX_NUM_DPM_LVL ; i++) {if (bw_params->clk_table.entries[i].dcfclk_mhz > max_dcfclk_mhz)
drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c +1 -1
@@ -214,7 +214,7 @@ void dcn303_fpu_update_bw_bounding_box(s dc->dml.soc.dispclk_dppclk_vco_speed_mhz = dc->clk_mgr->dentist_vco_freq_khz /1000.0 ;if (bw_params->clk_table.entries[0 ].memclk_mhz) { -int max_dcfclk_mhz =0 , max_dispclk_mhz =0 , max_dppclk_mhz =0 , max_phyclk_mhz =0 ; +unsigned int max_dcfclk_mhz =0 , max_dispclk_mhz =0 , max_dppclk_mhz =0 , max_phyclk_mhz =0 ;for (i =0 ; i <MAX_NUM_DPM_LVL ; i++) {if (bw_params->clk_table.entries[i].dcfclk_mhz > max_dcfclk_mhz)
drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c +9 -6
@@ -485,9 +485,12 @@ void dcn31_calculate_wm_and_dlg_fp(int pipe_cnt, int vlevel) { - int i, pipe_idx, total_det = 0, active_hubp_count = 0; + int total_det = 0, active_hubp_count = 0; +unsigned int i, pipe_idx;double dcfclk = context->bw_ctx.dml.vba.DCFCLKState[vlevel][context->bw_ctx.dml.vba.maxMpcComb];uint32_t cstate_enter_plus_exit_z8_ns; +uint32_t minimum_z8_residency_time_ns = + (uint32_t )dc->debug.minimum_z8_residency_time *1000U ;dc_assert_fp_enabled ();
@@ -511,8 +514,8 @@ void dcn31_calculate_wm_and_dlg_fp(get_wm_z8_stutter_enter_exit (&context->bw_ctx.dml, pipes, pipe_cnt) *1000 ;if (get_stutter_period (&context->bw_ctx.dml, pipes, pipe_cnt) < dc->debug.minimum_z8_residency_time && - cstate_enter_plus_exit_z8_ns < dc->debug.minimum_z8_residency_time *1000 ) - cstate_enter_plus_exit_z8_ns = dc->debug.minimum_z8_residency_time *1000 ; + cstate_enter_plus_exit_z8_ns < minimum_z8_residency_time_ns) + cstate_enter_plus_exit_z8_ns = minimum_z8_residency_time_ns;/* Set A: * All clocks min required
@@ -592,7 +595,7 @@ void dcn31_update_bw_bounding_box_fpu(ststruct _vcs_dpi_voltage_scaling_st *s = dc->scratch.update_bw_bounding_box.clock_limits;struct clk_limit_table *clk_table = &bw_params->clk_table;unsigned int i, closest_clk_lvl; -int max_dispclk_mhz =0 , max_dppclk_mhz =0 ; +unsigned int max_dispclk_mhz =0 , max_dppclk_mhz =0 ;int j;dc_assert_fp_enabled ();
@@ -668,7 +671,7 @@ void dcn31_update_bw_bounding_box_fpu(stvoid dcn315_update_bw_bounding_box_fpu (struct dc *dc,struct clk_bw_params *bw_params) {struct clk_limit_table *clk_table = &bw_params->clk_table; -int i, max_dispclk_mhz =0 , max_dppclk_mhz =0 ; +unsigned int i, max_dispclk_mhz =0 , max_dppclk_mhz =0 ;dc_assert_fp_enabled ();
@@ -731,7 +734,7 @@ void dcn316_update_bw_bounding_box_fpu(sstruct _vcs_dpi_voltage_scaling_st *s = dc->scratch.update_bw_bounding_box.clock_limits;struct clk_limit_table *clk_table = &bw_params->clk_table;unsigned int i, closest_clk_lvl; -int max_dispclk_mhz =0 , max_dppclk_mhz =0 ; +unsigned int max_dispclk_mhz =0 , max_dppclk_mhz =0 ;int j;dc_assert_fp_enabled ();
drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c +65 -56
240 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c +3 -2
@@ -185,7 +185,7 @@ void dcn314_update_bw_bounding_box_fpu(sstruct _vcs_dpi_voltage_scaling_st *clock_limits = dcn3_14_soc.clock_limits;unsigned int i, closest_clk_lvl; -int max_dispclk_mhz =0 , max_dppclk_mhz =0 ; +unsigned int max_dispclk_mhz =0 , max_dppclk_mhz =0 ;int j;dc_assert_fp_enabled ();
@@ -308,7 +308,8 @@ int dcn314_populate_dml_pipes_from_contedisplay_e2e_pipe_params_st *pipes, enum dc_validate_mode validate_mode) { - int i, pipe_cnt; + int pipe_cnt; +unsigned int i;struct resource_context *res_ctx = &context->res_ctx;struct pipe_ctx *pipe =0 ;bool upscaled = false;
drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c +69 -60
267 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +40 -35
240 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +11 -10
@@ -1724,7 +1724,8 @@ static void mode_support_configuration(svoid dml32_ModeSupportAndSystemConfigurationFull (struct display_mode_lib *mode_lib) {struct vba_vars_st *v = &mode_lib->vba; -int i, j, start_state; +int i, start_state; +unsigned int j;unsigned int k, m;unsigned int MaximumMPCCombine;unsigned int NumberOfNonCombinedSurfaceOfMaximumBandwidth;
@@ -2030,7 +2031,7 @@ void dml32_ModeSupportAndSystemConfigura mode_lib->vba.MPCCombineMethodIncompatible = v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.MPCCombineMethodAsNeededForPStateChangeAndVoltage && v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.MPCCombineMethodAsPossible; -for (i = start_state; i < v->soc.num_states; i++) { +for (i = start_state; i < (int )v->soc.num_states; i++) {for (j =0 ; j <2 ; j++) { mode_lib->vba.TotalNumberOfActiveDPP[i][j] =0 ; mode_lib->vba.TotalAvailablePipesSupport[i][j] = true;
@@ -2307,7 +2308,7 @@ void dml32_ModeSupportAndSystemConfigura } } -for (i = start_state; i < v->soc.num_states; ++i) { +for (i = start_state; i < (int )v->soc.num_states; ++i) { mode_lib->vba.ExceededMultistreamSlots[i] = false;for (k =0 ; k < mode_lib->vba.NumberOfActiveSurfaces; ++k) {if (mode_lib->vba.OutputMultistreamEn[k] == true && mode_lib->vba.OutputMultistreamId[k] == k) {
@@ -2410,7 +2411,7 @@ void dml32_ModeSupportAndSystemConfigura } } -for (i = start_state; i < v->soc.num_states; ++i) { +for (i = start_state; i < (int )v->soc.num_states; ++i) { mode_lib->vba.DTBCLKRequiredMoreThanSupported[i] = false;for (k =0 ; k < mode_lib->vba.NumberOfActiveSurfaces; ++k) { if (mode_lib->vba.BlendingAndTiming[k] == k
@@ -2427,7 +2428,7 @@ void dml32_ModeSupportAndSystemConfigura } } -for (i = start_state; i < v->soc.num_states; ++i) { +for (i = start_state; i < (int )v->soc.num_states; ++i) { mode_lib->vba.ODMCombine2To1SupportCheckOK[i] = true; mode_lib->vba.ODMCombine4To1SupportCheckOK[i] = true;for (k =0 ; k < mode_lib->vba.NumberOfActiveSurfaces; ++k) {
@@ -2445,7 +2446,7 @@ void dml32_ModeSupportAndSystemConfigura } } -for (i = start_state; i < v->soc.num_states; i++) { +for (i = start_state; i < (int )v->soc.num_states; i++) { mode_lib->vba.DSCCLKRequiredMoreThanSupported[i] = false;for (k =0 ; k <= mode_lib->vba.NumberOfActiveSurfaces -1 ; k++) {if (mode_lib->vba.BlendingAndTiming[k] == k) {
@@ -2482,7 +2483,7 @@ void dml32_ModeSupportAndSystemConfigura/* Check DSC Unit and Slices Support */ v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.TotalDSCUnitsRequired =0 ; -for (i = start_state; i < v->soc.num_states; ++i) { +for (i = start_state; i < (int )v->soc.num_states; ++i) { mode_lib->vba.NotEnoughDSCUnits[i] = false; mode_lib->vba.NotEnoughDSCSlices[i] = false; v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.TotalDSCUnitsRequired =0 ;
@@ -2517,7 +2518,7 @@ void dml32_ModeSupportAndSystemConfigura }/*DSC Delay per state*/ -for (i = start_state; i < v->soc.num_states; ++i) { +for (i = start_state; i < (int )v->soc.num_states; ++i) {for (k =0 ; k < mode_lib->vba.NumberOfActiveSurfaces; ++k) { mode_lib->vba.DSCDelayPerState[i][k] = dml32_DSCDelayRequirement( mode_lib->vba.RequiresDSC[i][k], mode_lib->vba.ODMCombineEnablePerState[i][k],
@@ -2531,7 +2532,7 @@ void dml32_ModeSupportAndSystemConfigurafor (k =0 ; k <= mode_lib->vba.NumberOfActiveSurfaces -1 ; k++) {for (m =0 ; m <= mode_lib->vba.NumberOfActiveSurfaces -1 ; m++) { -for (j =0 ; j <= mode_lib->vba.NumberOfActiveSurfaces -1 ; j++) { +for (j =0 ; j < mode_lib->vba.NumberOfActiveSurfaces; j++) {if (mode_lib->vba.BlendingAndTiming[k] == m && mode_lib->vba.RequiresDSC[i][m] == true) { mode_lib->vba.DSCDelayPerState[i][k] =
@@ -2682,7 +2683,7 @@ void dml32_ModeSupportAndSystemConfigura mode_lib->vba.SurfaceSizeInMALL, &mode_lib->vba.ExceededMALLSize); -for (i = start_state; i < v->soc.num_states; i++) { +for (i = start_state; i < (int )v->soc.num_states; i++) {for (j =0 ; j <2 ; j++) {for (k =0 ; k <= mode_lib->vba.NumberOfActiveSurfaces -1 ; k++) { mode_lib->vba.swath_width_luma_ub_this_state[k] =
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +1 -1
@@ -6318,7 +6318,7 @@ bool dml32_CalculateDETSwathFillLatencyHenum dm_use_mall_for_pstate_change_mode UsesMALLForPStateChange[], enum unbounded_requesting_policy UseUnboundedRequesting) { - int k; + unsigned int k;double SwathSizeAllSurfaces =0 ;double SwathSizeAllSurfacesInFetchTimeUs;double DETSwathLatencyHidingUs;
drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +23 -23
149 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c +3 -2
@@ -233,7 +233,7 @@ void dcn35_update_bw_bounding_box_fpu(ststruct clk_limit_table *clk_table = &bw_params->clk_table;struct _vcs_dpi_voltage_scaling_st *clock_limits = dc->scratch.update_bw_bounding_box.clock_limits; -int max_dispclk_mhz =0 , max_dppclk_mhz =0 ; +unsigned int max_dispclk_mhz =0 , max_dppclk_mhz =0 ;dc_assert_fp_enabled ();
@@ -440,7 +440,8 @@ int dcn35_populate_dml_pipes_from_contexdisplay_e2e_pipe_params_st *pipes, enum dc_validate_mode validate_mode) { - int i, pipe_cnt; + unsigned int i; +int pipe_cnt;struct resource_context *res_ctx = &context->res_ctx;struct pipe_ctx *pipe =0 ;bool upscaled = false;
drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c +3 -2
@@ -266,7 +266,7 @@ void dcn351_update_bw_bounding_box_fpu(sstruct clk_limit_table *clk_table = &bw_params->clk_table;struct _vcs_dpi_voltage_scaling_st *clock_limits = dc->scratch.update_bw_bounding_box.clock_limits; -int max_dispclk_mhz =0 , max_dppclk_mhz =0 ; +unsigned int max_dispclk_mhz =0 , max_dppclk_mhz =0 ;dc_assert_fp_enabled ();
@@ -472,7 +472,8 @@ int dcn351_populate_dml_pipes_from_contedisplay_e2e_pipe_params_st *pipes, enum dc_validate_mode validate_mode) { - int i, pipe_cnt; + int pipe_cnt; +unsigned int i;struct resource_context *res_ctx = &context->res_ctx;struct pipe_ctx *pipe =0 ;bool upscaled = false;
drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c +2 -2
@@ -304,7 +304,7 @@ bool get_is_phantom_pipe(struct display_static void fetch_socbb_params (struct display_mode_lib *mode_lib) {soc_bounding_box_st *soc = &mode_lib->vba.soc; -int i; +unsigned int i;// SOC Bounding Box Parameters mode_lib->vba.ReturnBusWidth = soc->return_bus_width_bytes;
@@ -946,7 +946,7 @@ static void fetch_pipe_params(struct dis*/ static void cache_debug_params (struct display_mode_lib *mode_lib) { -int k =0 ; +unsigned int k =0 ;for (k =0 ; k < mode_lib->vba.NumberOfActivePlanes; k++) mode_lib->vba.CachedActiveDRAMClockChangeLatencyMargin[k] = mode_lib->vba.ActiveDRAMClockChangeLatencyMargin[k];
Greg Kroah-Hartman
maintainerPATCH 152/228 drm/amd/display: Fix warnings
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clay King <[email protected]>
[ Upstream commit c3fb1fb9e65fa6a108b4d19c61bdcb47fd4fe180 ]
[Why & How]
Fix various warnings related to unsigned/signed mismatches
- Consistently use the same signedness for a given value
- Explcitly cast between types when needed
Stable-dep-of: 93c8fe6d5603 ("drm/amd/display: guard against overflow in HDCP message dump")
--- drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c | 6 drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.h | 2 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c | 8 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c | 4 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.h | 2 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 2 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c | 2 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.h | 4 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr_smu_msg.c | 4 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr_smu_msg.h | 2 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn42/dcn42_clk_mgr.c | 2 drivers/gpu/drm/amd/display/dc/core/dc.c | 4 drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c | 2 drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 18 drivers/gpu/drm/amd/display/dc/core/dc_vm_helper.c | 4 drivers/gpu/drm/amd/display/dc/dc.h | 68 - drivers/gpu/drm/amd/display/dc/dc_dsc.h | 2 drivers/gpu/drm/amd/display/dc/dc_stream.h | 4 drivers/gpu/drm/amd/display/dc/dc_types.h | 2 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_link_encoder.c | 2 drivers/gpu/drm/amd/display/dc/dio/dcn10/dcn10_link_encoder.c | 2 drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 4 drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c | 28 drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c | 342 ++++---- drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c | 408 +++++----- drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c | 400 ++++----- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c | 8 drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h | 8 drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h | 12 drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp_cm.c | 2 drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 2 drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp_cm.c | 4 drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 2 drivers/gpu/drm/amd/display/dc/dsc/dcn20/dcn20_dsc.c | 8 drivers/gpu/drm/amd/display/dc/dsc/dcn35/dcn35_dsc.c | 8 drivers/gpu/drm/amd/display/dc/dsc/dcn401/dcn401_dsc.c | 10 drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 4 drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.h | 2 drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 6 drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 2 drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 2 drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 2 drivers/gpu/drm/amd/display/dc/inc/bw_fixed.h | 2 drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h | 2 drivers/gpu/drm/amd/display/dc/inc/hw/opp.h | 4 drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h | 8 drivers/gpu/drm/amd/display/dc/inc/link_service.h | 2 drivers/gpu/drm/amd/display/dc/inc/reg_helper.h | 72 - drivers/gpu/drm/amd/display/dc/link/link_detection.c | 2 drivers/gpu/drm/amd/display/dc/link/link_detection.h | 2 drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 8 drivers/gpu/drm/amd/display/dc/mpc/dcn10/dcn10_mpc.c | 2 drivers/gpu/drm/amd/display/dc/mpc/dcn30/dcn30_mpc.c | 6 drivers/gpu/drm/amd/display/dc/opp/dcn20/dcn20_opp.c | 2 drivers/gpu/drm/amd/display/dc/opp/dcn20/dcn20_opp.h | 2 drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.c | 2 drivers/gpu/drm/amd/display/include/fixed31_32.h | 6 drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c | 2 59 files changed, 769 insertions(+), 767 deletions(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.c +3 -3
@@ -88,7 +88,7 @@ static const struct state_dependent_cloc/* ClocksStatePerformance */ { .display_clk_khz = 625000, .pixel_clk_khz = 400000 } }; -int dentist_get_divider_from_did (int did) +unsigned int dentist_get_divider_from_did (unsigned int did) {if (did <DENTIST_BASE_DID_1 ) did =DENTIST_BASE_DID_1 ;
@@ -155,8 +155,8 @@ static int dce60_get_dp_ref_freq_khz(strint dce_get_dp_ref_freq_khz (struct clk_mgr *clk_mgr_base) {struct clk_mgr_internal *clk_mgr =TO_CLK_MGR_INTERNAL (clk_mgr_base); -int dprefclk_wdivider; -int dprefclk_src_sel; +uint32_t dprefclk_wdivider; +uint32_t dprefclk_src_sel;int dp_ref_clk_khz;int target_div;
drivers/gpu/drm/amd/display/dc/clk_mgr/dce100/dce_clk_mgr.h +1 -1
@@ -54,6 +54,6 @@ int dce_set_clock(void dce_clk_mgr_destroy (struct clk_mgr **clk_mgr); -int dentist_get_divider_from_did (int did); +unsigned int dentist_get_divider_from_did (unsigned int did);#endif /* _DCE_CLK_MGR_H_ */
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c +4 -4
@@ -427,8 +427,8 @@ void dcn2_read_clocks_from_hw_dentist(ststruct clk_mgr_internal *clk_mgr =TO_CLK_MGR_INTERNAL (clk_mgr_base);uint32_t dispclk_wdivider;uint32_t dppclk_wdivider; -int disp_divider; -int dpp_divider; +unsigned int disp_divider; +unsigned int dpp_divider;REG_GET (DENTIST_DISPCLK_CNTL ,DENTIST_DISPCLK_WDIVIDER , &dispclk_wdivider);REG_GET (DENTIST_DISPCLK_CNTL ,DENTIST_DPPCLK_WDIVIDER , &dppclk_wdivider);
@@ -531,8 +531,8 @@ void dcn20_clk_mgr_construct(struct pp_smu_funcs *pp_smu, struct dccg *dccg) { - int dprefclk_did; -int target_div; + unsigned int dprefclk_did; +unsigned int target_div;uint32_t pll_req_reg;struct fixed31_32 pll_req;
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.c +2 -2
@@ -123,12 +123,12 @@ bool dcn30_smu_test_message(struct clk_mreturn false; } -bool dcn30_smu_get_smu_version (struct clk_mgr_internal *clk_mgr,unsigned int *version) +bool dcn30_smu_get_smu_version (struct clk_mgr_internal *clk_mgr,int *version) {smu_print ("SMU Get SMU version\n" );if (dcn30_smu_send_msg_with_param (clk_mgr, - DALSMC_MSG_GetSmuVersion,0 , version)) { + DALSMC_MSG_GetSmuVersion,0 , (uint32_t *)version)) {smu_print ("SMU version: %d\n" , *version);
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr_smu_msg.h +1 -1
@@ -31,7 +31,7 @@struct clk_mgr_internal ;bool dcn30_smu_test_message (struct clk_mgr_internal *clk_mgr,uint32_t input); -bool dcn30_smu_get_smu_version (struct clk_mgr_internal *clk_mgr,unsigned int *version); +bool dcn30_smu_get_smu_version (struct clk_mgr_internal *clk_mgr,int *version);bool dcn30_smu_check_driver_if_version (struct clk_mgr_internal *clk_mgr);bool dcn30_smu_check_msg_header_version (struct clk_mgr_internal *clk_mgr);void dcn30_smu_set_dram_addr_high (struct clk_mgr_internal *clk_mgr,uint32_t addr_high);
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c +1 -1
@@ -482,7 +482,7 @@ static int dcn32_get_dispclk_from_dentis {struct clk_mgr_internal *clk_mgr =TO_CLK_MGR_INTERNAL (clk_mgr_base);uint32_t dispclk_wdivider; -int disp_divider; +unsigned int disp_divider;REG_GET (DENTIST_DISPCLK_CNTL ,DENTIST_DISPCLK_WDIVIDER , &dispclk_wdivider); disp_divider =dentist_get_divider_from_did (dispclk_wdivider);
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c +1 -1
@@ -1487,7 +1487,7 @@ static int dcn401_get_dispclk_from_denti {struct clk_mgr_internal *clk_mgr =TO_CLK_MGR_INTERNAL (clk_mgr_base);uint32_t dispclk_wdivider; -int disp_divider; +unsigned int disp_divider;REG_GET (DENTIST_DISPCLK_CNTL ,DENTIST_DISPCLK_WDIVIDER , &dispclk_wdivider); disp_divider =dentist_get_divider_from_did (dispclk_wdivider);
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.h +2 -2
@@ -17,14 +17,14 @@ union dcn401_clk_mgr_block_sequence_parauint32_t ppclk;uint16_t freq_mhz;/* outputs */ -uint32_t *response; +int *response; } update_hardmin_params;struct {/* inputs */ uint32_t ppclk;int freq_khz;/* outputs */ -uint32_t *response; +int *response; } update_hardmin_optimized_params;struct {/* inputs */
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr_smu_msg.c +2 -2
@@ -143,12 +143,12 @@ static bool dcn401_smu_send_msg_with_parreturn false; } -bool dcn401_smu_get_smu_version (struct clk_mgr_internal *clk_mgr,unsigned int *version) +bool dcn401_smu_get_smu_version (struct clk_mgr_internal *clk_mgr,int *version) {smu_print ("SMU Get SMU version\n" );if (dcn401_smu_send_msg_with_param (clk_mgr, - DALSMC_MSG_GetSmuVersion,0 , version)) { + DALSMC_MSG_GetSmuVersion,0 , (uint32_t *)version)) {smu_print ("SMU version: %d\n" , *version);
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr_smu_msg.h +1 -1
@@ -10,7 +10,7 @@struct clk_mgr_internal ; -bool dcn401_smu_get_smu_version (struct clk_mgr_internal *clk_mgr,unsigned int *version); +bool dcn401_smu_get_smu_version (struct clk_mgr_internal *clk_mgr,int *version);bool dcn401_smu_check_driver_if_version (struct clk_mgr_internal *clk_mgr);bool dcn401_smu_check_msg_header_version (struct clk_mgr_internal *clk_mgr);void dcn401_smu_send_fclk_pstate_message (struct clk_mgr_internal *clk_mgr,bool support);
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn42/dcn42_clk_mgr.c +1 -1
@@ -870,7 +870,7 @@ int dcn42_get_dispclk_from_dentist(struc (void )clk_mgr_base;struct clk_mgr_internal *clk_mgr =TO_CLK_MGR_INTERNAL (clk_mgr_base);uint32_t dispclk_wdivider; -int disp_divider; +unsigned int disp_divider;REG_GET (DENTIST_DISPCLK_CNTL ,DENTIST_DISPCLK_WDIVIDER , &dispclk_wdivider); disp_divider =dentist_get_divider_from_did (dispclk_wdivider);
drivers/gpu/drm/amd/display/dc/core/dc.c +2 -2
@@ -6710,7 +6710,7 @@ bool dc_can_clear_cursor_limit(const strreturn false; } -void dc_get_underflow_debug_data_for_otg (struct dc *dc,int primary_otg_inst, +void dc_get_underflow_debug_data_for_otg (struct dc *dc,unsigned int primary_otg_inst,struct dc_underflow_debug_data *out_data) {struct timing_generator *tg =NULL ;
@@ -6728,7 +6728,7 @@ void dc_get_underflow_debug_data_for_otg dc->hwss.get_underflow_debug_data (dc, tg, out_data); } -void dc_get_power_feature_status (struct dc *dc,int primary_otg_inst, +void dc_get_power_feature_status (struct dc *dc,unsigned int primary_otg_inst,struct power_features *out_data) { (void )primary_otg_inst;
drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c +1 -1
@@ -282,7 +282,7 @@ unsigned int dc_dp_trace_get_link_loss_cstruct dc_sink *dc_link_add_remote_sink (struct dc_link *link,const uint8_t *edid, -int len, +unsigned int len,struct dc_sink_init_data *init_data) {return link->dc->link_srv->add_remote_sink (link, edid, len, init_data);
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +9 -9
@@ -982,7 +982,7 @@ static struct rect calculate_mpc_slice_i }static void calculate_adjust_recout_for_visual_confirm (struct pipe_ctx *pipe_ctx, -int *base_offset,int *dpp_offset) +unsigned int *base_offset,unsigned int *dpp_offset) {struct dc *dc = pipe_ctx->stream->ctx->dc; *base_offset =0 ;
@@ -1004,7 +1004,7 @@ static void calculate_adjust_recout_for_static void reverse_adjust_recout_for_visual_confirm (struct rect *recout,struct pipe_ctx *pipe_ctx) { -int dpp_offset, base_offset; +unsigned int dpp_offset, base_offset;calculate_adjust_recout_for_visual_confirm (pipe_ctx, &base_offset, &dpp_offset);
@@ -1015,7 +1015,7 @@ static void reverse_adjust_recout_for_vistatic void adjust_recout_for_visual_confirm (struct rect *recout,struct pipe_ctx *pipe_ctx) { -int dpp_offset, base_offset; +unsigned int dpp_offset, base_offset;calculate_adjust_recout_for_visual_confirm (pipe_ctx, &base_offset, &dpp_offset);
@@ -1692,7 +1692,7 @@ bool resource_can_pipe_disable_cursor(ststruct pipe_ctx *test_pipe, *split_pipe;struct rect r1 = pipe_ctx->plane_res.scl_data.recout;int r1_right, r1_bottom; -int cur_layer = pipe_ctx->plane_state->layer_index; +unsigned int cur_layer = pipe_ctx->plane_state->layer_index;reverse_adjust_recout_for_visual_confirm (&r1, pipe_ctx); r1_right = r1.x + r1.width;
@@ -4102,9 +4102,9 @@ bool dc_resource_is_dsc_encoding_supportstatic bool planes_changed_for_existing_stream (struct dc_state *context,struct dc_stream_state *stream,const struct dc_validation_set set[], -int set_count) +unsigned int set_count) { -int i, j; +unsigned int i, j;struct dc_stream_status *stream_status =NULL ;for (i =0 ; i < context->stream_count; i++) {
@@ -4140,10 +4140,10 @@ static bool add_all_planes_for_stream(const struct dc *dc, struct dc_stream_state *stream, const struct dc_validation_set set[], - int set_count, + unsigned int set_count, struct dc_state *state) { - int i, j; + unsigned int i, j;for (i =0 ; i < set_count; i++)if (set[i].stream == stream)
@@ -4181,7 +4181,7 @@ static bool add_all_planes_for_stream(*/ enum dc_status dc_validate_with_context (struct dc *dc,const struct dc_validation_set set[], -int set_count, +unsigned int set_count,struct dc_state *context,enum dc_validate_mode validate_mode) {
drivers/gpu/drm/amd/display/dc/core/dc_vm_helper.c +2 -2
@@ -34,9 +34,9 @@ void vm_helper_mark_vmid_used(struct vm_ vmids.vmid_usage[1 ] =1 << pos; } -int dc_setup_system_context (struct dc *dc,struct dc_phy_addr_space_config *pa_config) +unsigned int dc_setup_system_context (struct dc *dc,struct dc_phy_addr_space_config *pa_config) { -int num_vmids =0 ; +unsigned int num_vmids =0 ;/* Call HWSS to setup HUBBUB for address config */ if (dc->hwss.init_sys_ctx) {
drivers/gpu/drm/amd/display/dc/dc.h +34 -34
157 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dc_dsc.h +1 -1
@@ -92,7 +92,7 @@ uint32_t dc_dsc_stream_bandwidth_in_kbpsuint32_t dc_dsc_stream_bandwidth_overhead_in_kbps (const struct dc_crtc_timing *timing, -const int num_slices_h, +const uint32_t num_slices_h,const bool is_dp); void dc_dsc_dump_decoder_caps(const struct display_stream_compressor *dsc,
drivers/gpu/drm/amd/display/dc/dc_stream.h +2 -2
@@ -179,8 +179,8 @@ struct luminance_data {int luminance_millinits[LUMINANCE_DATA_TABLE_SIZE ];int flicker_criteria_milli_nits_GAMING;int flicker_criteria_milli_nits_STATIC; -int nominal_refresh_rate; -int dm_max_decrease_from_nominal; +unsigned int nominal_refresh_rate; +unsigned int dm_max_decrease_from_nominal; };enum dc_drr_trigger_mode {
drivers/gpu/drm/amd/display/dc/dc_types.h +1 -1
@@ -887,7 +887,7 @@ struct dsc_dec_dpcd_caps {union dsc_slice_caps2 slice_caps2;int32_t lb_bit_depth;bool is_block_pred_supported; -int32_t edp_max_bits_per_pixel;/* Valid only in eDP */ +uint32_t edp_max_bits_per_pixel;/* Valid only in eDP */ union dsc_color_formats color_formats;union dsc_color_depth color_depth;int32_t throughput_mode_0_mps;/* In MPs */
drivers/gpu/drm/amd/display/dc/dcn21/dcn21_link_encoder.c +1 -1
@@ -205,7 +205,7 @@ static bool update_cfg_data(static bool dcn21_link_encoder_acquire_phy (struct link_encoder *enc) {struct dcn10_link_encoder *enc10 =TO_DCN10_LINK_ENC (enc); -int value; +uint32_t value;if (enc->features.flags.bits.DP_IS_USB_C) { REG_GET(RDPCSTX_PHY_CNTL6,
drivers/gpu/drm/amd/display/dc/dio/dcn10/dcn10_link_encoder.c +1 -1
@@ -450,7 +450,7 @@ static uint8_t get_frontend_source(unsigned int dcn10_get_dig_frontend (struct link_encoder *enc) {struct dcn10_link_encoder *enc10 =TO_DCN10_LINK_ENC (enc); -int32_t value; +uint32_t value;enum engine_id result;REG_GET (DIG_BE_CNTL ,DIG_FE_SOURCE_SELECT , &value);
drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c +2 -2
@@ -1105,7 +1105,7 @@ static enum dcn_zstate_support_state de }static void dcn20_adjust_freesync_v_startup ( -const struct dc_crtc_timing *dc_crtc_timing,int *vstartup_start) +const struct dc_crtc_timing *dc_crtc_timing,unsigned int *vstartup_start) {struct dc_crtc_timing patched_crtc_timing;uint32_t asic_blank_end =0 ;
@@ -1253,7 +1253,7 @@ void dcn20_calculate_dlg_params(struct dstatic void swizzle_to_dml_params (enum swizzle_mode_values swizzle, -unsigned int *sw_mode) +int *sw_mode) {switch (swizzle) {case DC_SW_LINEAR :
drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +14 -14
@@ -296,7 +296,7 @@ static void CalculateWatermarksAndDRAMSpdouble UrgentOutOfOrderReturn, double ReturnBW, bool GPUVMEnable, - int dpte_group_bytes[], + unsigned int dpte_group_bytes[], unsigned int MetaChunkSize, double UrgentLatency, double ExtraLatency,
@@ -307,7 +307,7 @@ static void CalculateWatermarksAndDRAMSpdouble SRExitTime, double SREnterPlusExitTime, double DCFCLKDeepSleep, - int DPPPerPlane[], + unsigned int DPPPerPlane[], bool DCCEnable[], double DPPCLK[], double SwathWidthSingleDPPY[],
@@ -346,7 +346,7 @@ static void CalculateDCFCLKDeepSleep(double BytePerPixelDETC[], double VRatio[], double SwathWidthY[], - int DPPPerPlane[], + unsigned int DPPPerPlane[], double HRatio[], double PixelClock[], double PSCL_THROUGHPUT[],
@@ -390,7 +390,7 @@ static void CalculatePixelDeliveryTimes(double VRatioPrefetchC[], unsigned int swath_width_luma_ub[], unsigned int swath_width_chroma_ub[], - int DPPPerPlane[], + unsigned int DPPPerPlane[], double HRatio[], double PixelClock[], double PSCL_THROUGHPUT[],
@@ -436,7 +436,7 @@ static void CalculateMetaAndPTETimes(unsigned int meta_row_height[], unsigned int meta_req_width[], unsigned int meta_req_height[], - int dpte_group_bytes[], + unsigned int dpte_group_bytes[], unsigned int PTERequestSizeY[], unsigned int PTERequestSizeC[], unsigned int PixelPTEReqWidthY[],
@@ -477,8 +477,8 @@ static double CalculateExtraLatency(bool GPUVMEnable, bool HostVMEnable, int NumberOfActivePlanes, - int NumberOfDPP[], - int dpte_group_bytes[], + unsigned int NumberOfDPP[], + unsigned int dpte_group_bytes[], double PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyPixelMixedWithVMData, double PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyVMDataOnly, int HostVMMaxPageTableLevels,
@@ -5257,7 +5257,7 @@ static void CalculateWatermarksAndDRAMSpdouble UrgentOutOfOrderReturn, double ReturnBW, bool GPUVMEnable, - int dpte_group_bytes[], + unsigned int dpte_group_bytes[], unsigned int MetaChunkSize, double UrgentLatency, double ExtraLatency,
@@ -5268,7 +5268,7 @@ static void CalculateWatermarksAndDRAMSpdouble SRExitTime, double SREnterPlusExitTime, double DCFCLKDeepSleep, - int DPPPerPlane[], + unsigned int DPPPerPlane[], bool DCCEnable[], double DPPCLK[], double SwathWidthSingleDPPY[],
@@ -5543,7 +5543,7 @@ static void CalculateDCFCLKDeepSleep(double BytePerPixelDETC[], double VRatio[], double SwathWidthY[], - int DPPPerPlane[], + unsigned int DPPPerPlane[], double HRatio[], double PixelClock[], double PSCL_THROUGHPUT[],
@@ -5749,7 +5749,7 @@ static void CalculatePixelDeliveryTimes(double VRatioPrefetchC[], unsigned int swath_width_luma_ub[], unsigned int swath_width_chroma_ub[], - int DPPPerPlane[], + unsigned int DPPPerPlane[], double HRatio[], double PixelClock[], double PSCL_THROUGHPUT[],
@@ -5870,7 +5870,7 @@ static void CalculateMetaAndPTETimes(unsigned int meta_row_height[], unsigned int meta_req_width[], unsigned int meta_req_height[], - int dpte_group_bytes[], + unsigned int dpte_group_bytes[], unsigned int PTERequestSizeY[], unsigned int PTERequestSizeC[], unsigned int PixelPTEReqWidthY[],
@@ -6128,8 +6128,8 @@ static double CalculateExtraLatency(bool GPUVMEnable, bool HostVMEnable, int NumberOfActivePlanes, - int NumberOfDPP[], - int dpte_group_bytes[], + unsigned int NumberOfDPP[], + unsigned int dpte_group_bytes[], double PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyPixelMixedWithVMData, double PercentOfIdealDRAMFabricAndSDPPortBWReceivedAfterUrgLatencyVMDataOnly, int HostVMMaxPageTableLevels,
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +171 -171
564 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c +204 -204
706 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c +200 -200
686 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +1 -1
@@ -1397,7 +1397,7 @@ static void try_odm_power_optimization_a display_e2e_pipe_params_st *pipes, int *split, bool *merge, - unsigned int *vlevel, + int *vlevel, int pipe_cnt) {int i;
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +4 -4
@@ -2954,7 +2954,7 @@ void dml32_UseMinimumDCFCLK(unsigned int VTotal[], unsigned int VActive[], unsigned int DynamicMetadataTransmittedBytes[], - unsigned int DynamicMetadataLinesBeforeActiveRequired[], + int DynamicMetadataLinesBeforeActiveRequired[], bool Interlace[], double RequiredDPPCLKPerSurface[][2][DC__NUM_DPP__MAX], double RequiredDISPCLK[][2],
@@ -5631,7 +5631,7 @@ void dml32_CalculateStutterEfficiency(bool Interlace[], double MinTTUVBlank[], unsigned int DPPPerSurface[], - unsigned int DETBufferSizeY[], + unsigned int DETBufferSizeY[], unsigned int BytePerPixelY[], double BytePerPixelDETY[], double SwathWidthY[],
@@ -5663,10 +5663,10 @@ void dml32_CalculateStutterEfficiency(/* Output */ double *StutterEfficiencyNotIncludingVBlank, double *StutterEfficiency, - unsigned int *NumberOfStutterBurstsPerFrame, + int *NumberOfStutterBurstsPerFrame, double *Z8StutterEfficiencyNotIncludingVBlank, double *Z8StutterEfficiency, - unsigned int *Z8NumberOfStutterBurstsPerFrame, + int *Z8NumberOfStutterBurstsPerFrame, double *StutterPeriod, bool *DCHUBBUB_ARB_CSTATE_MAX_CAP_MODE) {
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h +4 -4
@@ -614,7 +614,7 @@ void dml32_UseMinimumDCFCLK(unsigned int VTotal[], unsigned int VActive[], unsigned int DynamicMetadataTransmittedBytes[], - unsigned int DynamicMetadataLinesBeforeActiveRequired[], + int DynamicMetadataLinesBeforeActiveRequired[], bool Interlace[], double RequiredDPPCLKPerSurface[][2][DC__NUM_DPP__MAX], double RequiredDISPCLK[][2],
@@ -1013,7 +1013,7 @@ void dml32_CalculateStutterEfficiency(bool ProgressiveToInterlaceUnitInOPP, bool Interlace[], double MinTTUVBlank[], - unsigned int DPPPerSurface[], + unsigned int DPPPerSurface[], unsigned int DETBufferSizeY[], unsigned int BytePerPixelY[], double BytePerPixelDETY[],
@@ -1046,10 +1046,10 @@ void dml32_CalculateStutterEfficiency(/* Output */ double *StutterEfficiencyNotIncludingVBlank, double *StutterEfficiency, - unsigned int *NumberOfStutterBurstsPerFrame, + int *NumberOfStutterBurstsPerFrame, double *Z8StutterEfficiencyNotIncludingVBlank, double *Z8StutterEfficiency, - unsigned int *Z8NumberOfStutterBurstsPerFrame, + int *Z8NumberOfStutterBurstsPerFrame, double *StutterPeriod, bool *DCHUBBUB_ARB_CSTATE_MAX_CAP_MODE);
drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h +6 -6
@@ -472,7 +472,7 @@ struct vba_vars_st {unsigned int VTotal[DC__NUM_DPP__MAX ];unsigned int VTotal_Max[DC__NUM_DPP__MAX ];unsigned int VTotal_Min[DC__NUM_DPP__MAX ]; -int DPPPerPlane[DC__NUM_DPP__MAX ]; +unsigned int DPPPerPlane[DC__NUM_DPP__MAX ];double PixelClock[DC__NUM_DPP__MAX ];double PixelClockBackEnd[DC__NUM_DPP__MAX ];bool DCCEnable[DC__NUM_DPP__MAX ];
@@ -739,7 +739,7 @@ struct vba_vars_st {/* ms locals */ double IdealSDPPortBandwidthPerState[DC__VOLTAGE_STATES ][2 ];unsigned int NoOfDPP[DC__VOLTAGE_STATES ][2 ][DC__NUM_DPP__MAX ]; -int NoOfDPPThisState[DC__NUM_DPP__MAX ]; +unsigned int NoOfDPPThisState[DC__NUM_DPP__MAX ];enum odm_combine_mode ODMCombineEnablePerState[DC__VOLTAGE_STATES ][DC__NUM_DPP__MAX ];double SwathWidthYThisState[DC__NUM_DPP__MAX ];unsigned int SwathHeightCPerState[DC__VOLTAGE_STATES ][2 ][DC__NUM_DPP__MAX ];
@@ -900,7 +900,7 @@ struct vba_vars_st {int PTEBufferSizeInRequestsForChroma;// Missing from VBA -int dpte_group_bytes_chroma; +unsigned int dpte_group_bytes_chroma;unsigned int vm_group_bytes_chroma;double dst_x_after_scaler;double dst_y_after_scaler;
@@ -1100,8 +1100,8 @@ struct vba_vars_st {unsigned int DETBufferSizeCThisState[DC__NUM_DPP__MAX ];bool NoUrgentLatencyHiding[DC__NUM_DPP__MAX ];bool NoUrgentLatencyHidingPre[DC__NUM_DPP__MAX ]; -int swath_width_luma_ub_this_state[DC__NUM_DPP__MAX ]; -int swath_width_chroma_ub_this_state[DC__NUM_DPP__MAX ]; +unsigned int swath_width_luma_ub_this_state[DC__NUM_DPP__MAX ]; +unsigned int swath_width_chroma_ub_this_state[DC__NUM_DPP__MAX ];double UrgLatency[DC__VOLTAGE_STATES ];double VActiveCursorBandwidth[DC__VOLTAGE_STATES ][2 ][DC__NUM_DPP__MAX ];double VActivePixelBandwidth[DC__VOLTAGE_STATES ][2 ][DC__NUM_DPP__MAX ];
@@ -1172,7 +1172,7 @@ struct vba_vars_st {int ConfigReturnBufferSizeInKByte;enum unbounded_requesting_policy UseUnboundedRequesting;int CompressedBufferSegmentSizeInkByte; -int CompressedBufferSizeInkByte; +unsigned int CompressedBufferSizeInkByte;int MetaFIFOSizeInKEntries;int ZeroSizeBufferEntries;int COMPBUF_RESERVED_SPACE_64B ;
drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp_cm.c +1 -1
@@ -307,7 +307,7 @@ void dpp1_cm_set_output_csc_default( {struct dcn10_dpp *dpp =TO_DCN10_DPP (dpp_base);const uint16_t *regval =NULL ; -int arr_size; +uint32_t arr_size; regval =find_color_matrix (colorspace, &arr_size);if (regval ==NULL ) {
drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c +1 -1
@@ -543,7 +543,7 @@ bool dpp3_get_optimal_number_of_taps(static void dpp3_deferred_update (struct dpp *dpp_base) { -int bypass_state; +uint32_t bypass_state;struct dcn3_dpp *dpp =TO_DCN30_DPP (dpp_base);if (dpp_base->deferred_reg_writes.bits.disable_dscl) {
drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp_cm.c +2 -2
@@ -317,7 +317,7 @@ void dpp3_set_hdr_multiplier(static void program_gamut_remap (struct dcn3_dpp *dpp,const uint16_t *regval, -int select) +unsigned int select) {uint16_t selection =0 ;struct color_matrices_reg gam_regs;
@@ -379,7 +379,7 @@ void dpp3_cm_set_gamut_remap( {struct dcn3_dpp *dpp =TO_DCN30_DPP (dpp_base);int i =0 ; -int gamut_mode; +uint32_t gamut_mode;if (adjust->gamut_adjust_type !=GRAPHICS_GAMUT_ADJUST_TYPE_SW )/* Bypass if type is bypass or hw */
drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c +1 -1
@@ -1333,7 +1333,7 @@ uint32_t dc_dsc_stream_bandwidth_in_kbpsuint32_t dc_dsc_stream_bandwidth_overhead_in_kbps (const struct dc_crtc_timing *timing, -const int num_slices_h, +const uint32_t num_slices_h,const bool is_dp) {struct fixed31_32 max_dsc_overhead;
drivers/gpu/drm/amd/display/dc/dsc/dcn20/dcn20_dsc.c +4 -4
@@ -227,9 +227,9 @@ bool dsc2_get_packed_pps(struct display_void dsc2_enable (struct display_stream_compressor *dsc,int opp_pipe) {struct dcn20_dsc *dsc20 =TO_DCN20_DSC (dsc); -int dsc_clock_en; -int dsc_fw_config; -int enabled_opp_pipe; +uint32_t dsc_clock_en; +uint32_t dsc_fw_config; +uint32_t enabled_opp_pipe;DC_LOG_DSC ("enable DSC %d at opp pipe %d" , dsc->inst, opp_pipe);
@@ -252,7 +252,7 @@ void dsc2_enable(struct display_stream_cvoid dsc2_disable (struct display_stream_compressor *dsc) {struct dcn20_dsc *dsc20 =TO_DCN20_DSC (dsc); -int dsc_clock_en; +uint32_t dsc_clock_en;DC_LOG_DSC ("disable DSC %d" , dsc->inst);
drivers/gpu/drm/amd/display/dc/dsc/dcn35/dcn35_dsc.c +4 -4
@@ -79,9 +79,9 @@ void dsc35_construct(struct dcn20_dsc *dstatic void dsc35_enable (struct display_stream_compressor *dsc,int opp_pipe) {struct dcn20_dsc *dsc20 =TO_DCN20_DSC (dsc); -int dsc_clock_en; -int dsc_fw_config; -int enabled_opp_pipe; +uint32_t dsc_clock_en; +uint32_t dsc_fw_config; +uint32_t enabled_opp_pipe;DC_LOG_DSC ("enable DSC %d at opp pipe %d" , dsc->inst, opp_pipe);
@@ -96,7 +96,7 @@ static void dsc35_enable(struct display_REG_GET (DSC_TOP_CONTROL ,DSC_CLOCK_EN , &dsc_clock_en);REG_GET_2 (DSCRM_DSC_FORWARD_CONFIG ,DSCRM_DSC_FORWARD_EN , &dsc_fw_config,DSCRM_DSC_OPP_PIPE_SOURCE , &enabled_opp_pipe);if ((dsc_clock_en || dsc_fw_config) && enabled_opp_pipe != opp_pipe) { -DC_LOG_DSC ("ERROR: DSC %d at opp pipe %d already enabled!" , dsc->inst, enabled_opp_pipe); +DC_LOG_DSC ("ERROR: DSC %d at opp pipe %u already enabled!" , dsc->inst, enabled_opp_pipe);ASSERT (0 ); }
drivers/gpu/drm/amd/display/dc/dsc/dcn401/dcn401_dsc.c +5 -5
@@ -144,16 +144,16 @@ void dsc401_set_config(struct display_stvoid dsc401_enable (struct display_stream_compressor *dsc,int opp_pipe) {struct dcn401_dsc *dsc401 =TO_DCN401_DSC (dsc); -int dsc_clock_en; -int dsc_fw_config; -int enabled_opp_pipe; +uint32_t dsc_clock_en; +uint32_t dsc_fw_config; +uint32_t enabled_opp_pipe;DC_LOG_DSC ("enable DSC %d at opp pipe %d" , dsc->inst, opp_pipe);REG_GET (DSC_TOP_CONTROL ,DSC_CLOCK_EN , &dsc_clock_en);REG_GET_2 (DSCRM_DSC_FORWARD_CONFIG ,DSCRM_DSC_FORWARD_EN , &dsc_fw_config,DSCRM_DSC_OPP_PIPE_SOURCE , &enabled_opp_pipe);if ((dsc_clock_en || dsc_fw_config) && enabled_opp_pipe != opp_pipe) { -DC_LOG_DSC ("ERROR: DSC %d at opp pipe %d already enabled!" , dsc->inst, enabled_opp_pipe); +DC_LOG_DSC ("ERROR: DSC %d at opp pipe %u already enabled!" , dsc->inst, enabled_opp_pipe);ASSERT (0 ); }
@@ -169,7 +169,7 @@ void dsc401_enable(struct display_streamvoid dsc401_disable (struct display_stream_compressor *dsc) {struct dcn401_dsc *dsc401 =TO_DCN401_DSC (dsc); -int dsc_clock_en; +uint32_t dsc_clock_en;DC_LOG_DSC ("disable DSC %d" , dsc->inst);
drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c +2 -2
@@ -63,10 +63,10 @@ void hubp401_enable_3dlut_fl(struct hubpREG_UPDATE (HUBP_3DLUT_CONTROL ,HUBP_3DLUT_ENABLE , enable ?1 :0 ); } -int hubp401_get_3dlut_fl_done (struct hubp *hubp) +uint32_t hubp401_get_3dlut_fl_done (struct hubp *hubp) {struct dcn20_hubp *hubp2 =TO_DCN20_HUBP (hubp); -int ret; +uint32_t ret;REG_GET (HUBP_3DLUT_CONTROL ,HUBP_3DLUT_DONE , &ret);return ret;
drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.h +1 -1
@@ -324,7 +324,7 @@ bool hubp401_construct(void hubp401_init (struct hubp *hubp); -int hubp401_get_3dlut_fl_done (struct hubp *hubp); +uint32_t hubp401_get_3dlut_fl_done (struct hubp *hubp);void hubp401_set_unbounded_requesting (struct hubp *hubp,bool enable);
drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c +4 -2
@@ -2484,7 +2484,8 @@ void dcn10_enable_vblanks_synchronizatio (void )group_index;struct output_pixel_processor *opp;struct timing_generator *tg; -int i, width =0 , height =0 , master; +int i, master; +uint32_t width =0 , height =0 ;DC_LOGGER_INIT (dc->ctx);
@@ -2550,7 +2551,8 @@ void dcn10_enable_timing_synchronization (void )group_index;struct output_pixel_processor *opp;struct timing_generator *tg; -int i, width =0 , height =0 ; +int i; +uint32_t width =0 , height =0 ;DC_LOGGER_INIT (dc->ctx);
drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c +1 -1
@@ -147,7 +147,7 @@ static void update_dsc_on_stream(struct// Given any pipe_ctx, return the total ODM combine factor, and optionally return // the OPPids which are used -static unsigned int get_odm_config (struct pipe_ctx *pipe_ctx,unsigned int *opp_instances) +static unsigned int get_odm_config (struct pipe_ctx *pipe_ctx,int *opp_instances) {unsigned int opp_count =1 ;struct pipe_ctx *odm_pipe;
drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c +1 -1
@@ -1119,7 +1119,7 @@ void dcn32_update_dsc_on_stream(struct p* Given any pipe_ctx, return the total ODM combine factor, and optionally return * the OPPids which are used * */ -static unsigned int get_odm_config (struct pipe_ctx *pipe_ctx,unsigned int *opp_instances) +static unsigned int get_odm_config (struct pipe_ctx *pipe_ctx,int *opp_instances) {unsigned int opp_count =1 ;struct pipe_ctx *odm_pipe;
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +1 -1
@@ -403,7 +403,7 @@ static void update_dsc_on_stream(struct// Given any pipe_ctx, return the total ODM combine factor, and optionally return // the OPPids which are used -static unsigned int get_odm_config (struct pipe_ctx *pipe_ctx,unsigned int *opp_instances) +static unsigned int get_odm_config (struct pipe_ctx *pipe_ctx,int *opp_instances) {unsigned int opp_count =1 ;struct pipe_ctx *odm_pipe;
drivers/gpu/drm/amd/display/dc/inc/bw_fixed.h +1 -1
@@ -126,7 +126,7 @@ static inline struct bw_fixed bw_div(constatic inline struct bw_fixed bw_mod (const struct bw_fixed arg1,const struct bw_fixed arg2) {struct bw_fixed res; -div64_u64_rem (arg1.value, arg2.value, (uint64_t *)&res.value); +div64_u64_rem ((uint64_t )arg1.value, (uint64_t )arg2.value, (uint64_t *)&res.value);return res; }
drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h +1 -1
@@ -305,7 +305,7 @@ struct hubp_funcs {enum hubp_3dlut_fl_crossbar_bit_slice bit_slice_y_g, enum hubp_3dlut_fl_crossbar_bit_slice bit_slice_cb_b, enum hubp_3dlut_fl_crossbar_bit_slice bit_slice_cr_r); -int (*hubp_get_3dlut_fl_done)(struct hubp *hubp); +uint32_t (*hubp_get_3dlut_fl_done)(struct hubp *hubp);void (*hubp_program_3dlut_fl_config)(struct hubp *hubp,struct hubp_fl_3dlut_config *cfg);void (*hubp_clear_tiling)(struct hubp *hubp);uint32_t (*hubp_get_current_read_line)(struct hubp *hubp);
drivers/gpu/drm/amd/display/dc/inc/hw/opp.h +2 -2
@@ -356,8 +356,8 @@ struct opp_funcs {void (*opp_program_dpg_dimensions)(struct output_pixel_processor *opp, -int width, -int height); +uint32_t width, +uint32_t height);bool (*dpg_is_blanked)(struct output_pixel_processor *opp);
drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h +4 -4
@@ -32,9 +32,9 @@ struct dc_bios;/* Contains CRTC vertical/horizontal pixel counters */ struct crtc_position { -int32_t vertical_count; -int32_t horizontal_count; -int32_t nominal_vcount; +uint32_t vertical_count; +uint32_t horizontal_count; +uint32_t nominal_vcount; };struct dcp_gsl_params {
@@ -321,7 +321,7 @@ struct timing_generator {const struct timing_generator_funcs *funcs;struct dc_bios *bp;struct dc_context *ctx; -int inst; +uint32_t inst; };struct dc_crtc_timing ;
drivers/gpu/drm/amd/display/dc/inc/link_service.h +1 -1
@@ -110,7 +110,7 @@ struct link_service {struct dc_sink *(*add_remote_sink)(struct dc_link *link,const uint8_t *edid, -int len, +unsigned int len,struct dc_sink_init_data *init_data);void (*remove_remote_sink)(struct dc_link *link,struct dc_sink *sink);bool (*get_hpd_state)(struct dc_link *link);
drivers/gpu/drm/amd/display/dc/inc/reg_helper.h +36 -36
99 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/link/link_detection.c +1 -1
@@ -1565,7 +1565,7 @@ static bool link_add_remote_sink_helper(struct dc_sink *link_add_remote_sink (struct dc_link *link,const uint8_t *edid, -int len, +unsigned int len,struct dc_sink_init_data *init_data) {struct dc_sink *dc_sink;
drivers/gpu/drm/amd/display/dc/link/link_detection.h +1 -1
@@ -32,7 +32,7 @@ bool link_detect_connection_type(structstruct dc_sink *link_add_remote_sink (struct dc_link *link,const uint8_t *edid, -int len, +unsigned int len,struct dc_sink_init_data *init_data);void link_remove_remote_sink (struct dc_link *link,struct dc_sink *sink);bool link_reset_cur_dp_mst_topology (struct dc_link *link);
drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c +4 -4
@@ -47,9 +47,9 @@#define DP_SINK_PR_ENABLE_AND_CONFIGURATION 0x37B/* Travis */ -static const uint8_t DP_VGA_LVDS_CONVERTER_ID_2 [] ="sivarT" ; +static const char DP_VGA_LVDS_CONVERTER_ID_2 [] ="sivarT" ;/* Nutmeg */ -static const uint8_t DP_VGA_LVDS_CONVERTER_ID_3 [] ="dnomlA" ; +static const char DP_VGA_LVDS_CONVERTER_ID_3 [] ="dnomlA" ;void dp_set_panel_mode (struct dc_link *link,enum dp_panel_mode panel_mode) {
@@ -1211,9 +1211,9 @@ int edp_get_backlight_level(const struct fw_set_brightness = dmcu->funcs->is_dmcu_initialized (dmcu);if (!fw_set_brightness && panel_cntl->funcs->get_current_backlight) -return panel_cntl->funcs->get_current_backlight (panel_cntl); +return (int )panel_cntl->funcs->get_current_backlight (panel_cntl);else if (abm !=NULL && abm->funcs->get_current_backlight !=NULL ) -return (int ) abm->funcs->get_current_backlight (abm); +return (int )abm->funcs->get_current_backlight (abm);else return DC_ERROR_UNEXPECTED ; }
drivers/gpu/drm/amd/display/dc/mpc/dcn10/dcn10_mpc.c +1 -1
@@ -375,7 +375,7 @@ void mpc1_mpc_init(struct mpc *mpc)void mpc1_mpc_init_single_inst (struct mpc *mpc,unsigned int mpcc_id) {struct dcn10_mpc *mpc10 =TO_DCN10_MPC (mpc); -int opp_id; +uint32_t opp_id;REG_GET (MPCC_OPP_ID [mpcc_id],MPCC_OPP_ID , &opp_id);
drivers/gpu/drm/amd/display/dc/mpc/dcn30/dcn30_mpc.c +3 -3
@@ -1067,7 +1067,7 @@ static void program_gamut_remap(struct dcn30_mpc *mpc30, int mpcc_id, const uint16_t *regval, - int select) + uint32_t select) { uint16_t selection = 0;struct color_matrices_reg gam_regs;
@@ -1129,7 +1129,7 @@ void mpc3_set_gamut_remap( {struct dcn30_mpc *mpc30 =TO_DCN30_MPC (mpc);int i =0 ; -int gamut_mode; +uint32_t gamut_mode;if (adjust->gamut_adjust_type !=GRAPHICS_GAMUT_ADJUST_TYPE_SW )program_gamut_remap (mpc30, mpcc_id,NULL ,GAMUT_REMAP_BYPASS );
@@ -1201,7 +1201,7 @@ void mpc3_get_gamut_remap(struct mpc *mp {struct dcn30_mpc *mpc30 =TO_DCN30_MPC (mpc);uint16_t arr_reg_val[12 ] = {0 }; -int select; +uint32_t select;read_gamut_remap (mpc30, mpcc_id, arr_reg_val, &select);
drivers/gpu/drm/amd/display/dc/opp/dcn20/dcn20_opp.c +1 -1
@@ -293,7 +293,7 @@ void opp2_set_disp_pattern_generator( void opp2_program_dpg_dimensions( struct output_pixel_processor *opp,
Lines of this file are not shown. View the raw message.
drivers/gpu/drm/amd/display/dc/opp/dcn20/dcn20_opp.h +1 -1
Lines of this file are not shown. View the raw message.
drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.c +1 -1
Lines of this file are not shown. View the raw message.
drivers/gpu/drm/amd/display/include/fixed31_32.h +3 -3
Lines of this file are not shown. View the raw message.
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_log.c +1 -1
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 153/228 ceph: avoid fs reclaim while using current->journal_info
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
[ Upstream commit 5b602344a49e039e792ce5a8923bcc61412ee134 ]
handle_reply() stores a ceph_mds_request pointer in current->journal_info while filling the inode and dentry cache from an MDS reply.
An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in current->journal_info as a journal handle and dereferences the request's r_tid as h_transaction, causing a kernel crash, e.g.:
Unable to handle kernel paging request at virtual address 00000000077b4818 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE [...] Workqueue: ceph-msgr ceph_con_workfn pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : jbd2__journal_start+0x2c/0x208 lr : __ext4_journal_start_sb+0x100/0x178 [...] Call trace: jbd2__journal_start+0x2c/0x208 (P) __ext4_journal_start_sb+0x100/0x178 ext4_dirty_inode+0x3c/0x90 __mark_inode_dirty+0x58/0x400 iput.part.0+0x2b0/0x370 iput+0x18/0x30 dentry_unlink_inode+0xc0/0x158 __dentry_kill+0x80/0x250 shrink_dentry_list+0x90/0x130 prune_dcache_sb+0x60/0x98 super_cache_scan+0xe8/0x190 do_shrink_slab+0x174/0x388 shrink_slab+0xd8/0x4c0 shrink_node+0x31c/0x908 do_try_to_free_pages+0xd0/0x508 try_to_free_pages+0x11c/0x238 __alloc_frozen_pages_noprof+0x4d0/0xdd0 __folio_alloc_noprof+0x18/0x70 __filemap_get_folio+0x248/0x440 ceph_readdir_prepopulate+0x570/0x9e8 mds_dispatch+0x1424/0x1ba0 ceph_con_process_message+0x74/0xa0 ceph_con_v1_try_read+0x3a0/0x1510 ceph_con_workfn+0x260/0x460
Enter a scoped NOFS allocation context and leave it after clearing journal_info. This prevents filesystem reclaim from recursing into another filesystem while the field contains Ceph-private data.
--- fs/ceph/mds_client.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/ceph/mds_client.c +11 -0
@@ -6,6 +6,7 @@#include <linux/slab.h> #include <linux/gfp.h> #include <linux/sched.h> +#include <linux/sched/mm.h> #include <linux/debugfs.h> #include <linux/seq_file.h> #include <linux/ratelimit.h>
@@ -3903,6 +3904,7 @@ static void handle_reply(struct ceph_mdsstruct ceph_mds_reply_head *head = msg->front.iov_base;struct ceph_mds_reply_info_parsed *rinfo;/* parsed reply info */ struct ceph_snap_realm *realm; +unsigned int nofs_flags;u64 tid;int err, result;int mds = session->s_mds;
@@ -4046,6 +4048,14 @@ static void handle_reply(struct ceph_mds/* insert trace into our cache */ mutex_lock (&req->r_fill_mutex); + +/* disable fs reclaim while we are using current->journal_info +* for our own purposes, or else shrinkers of other +* filesystems might dereference this pointer as a different +* type +*/ + nofs_flags =memalloc_nofs_save (); + current->journal_info = req; err =ceph_fill_trace (mdsc->fsc->sb, req);if (err ==0 ) {
@@ -4054,6 +4064,7 @@ static void handle_reply(struct ceph_mds err =ceph_readdir_prepopulate (req, req->r_session); } current->journal_info =NULL ; +memalloc_nofs_restore (nofs_flags);mutex_unlock (&req->r_fill_mutex);up_read (&mdsc->snap_rwsem);
Greg Kroah-Hartman
maintainerPATCH 154/228 ceph: fix hanging __ceph_get_caps() with stale mds_wanted
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <[email protected]>
[ Upstream commit 50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6 ]
A reader can hang forever in __ceph_get_caps() when the client no longer holds FILE_RD, but local cap state still says that the capability is already wanted (via mds_wanted).
One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke FILE_RD from the reader; the next read then has to reacquire FILE_RD. If the cap update that should request FILE_RD never reaches the MDS after cap->mds_wanted was raised, the reader is left holding only non-file caps while local mds_wanted still includes the file read caps.
In that state, try_get_cap_refs() sees need <= mds_wanted and returns 0, so __ceph_get_caps() just waits on i_cap_wq. If the cap update that was supposed to request FILE_RD never reaches the MDS after cap->mds_wanted was` raised, no further request is sent and the waiter can sleep indefinitely until unrelated cap traffic happens to wake it up.
The ordering issue is that cap->mds_wanted is updated in __prep_cap() before the CEPH_MSG_CLIENT_CAPS message is actually queued for send. That makes one field serve two different meanings at
once: what this client wants, and what the client believes the MDS already knows it wants.
A proper fix would be to split those states and track whether a cap update is actually in flight or has been observed by the MDS. However, simply moving the cap->mds_wanted assignment later would not be sufficient: queueing the message in the messenger does not guarantee that the MDS processed that specific wanted set, and reconnect or message loss can still invalidate that assumption. Fixing that properly would require a larger rework of the cap state machine.
To allow simpler backports to stable kernels, this patch implements a simpler workaround:
- stop waiting forever in __ceph_get_caps(); after a bounded wait, fall back to the renew path
- make ceph_renew_caps() issue a synchronous OPEN request whenever the inode still does not actually hold the wanted caps, instead of only calling ceph_check_caps()
The extra issued-vs-wanted check in ceph_renew_caps() is necessary because the previous test only checked whether the inode still had any real caps at all. That is not enough after revocation: the client can still hold something like pLs and yet be missing FILE_RD completely. In that case, falling back to ceph_check_caps() is not sufficient, because it still trusts cap->mds_wanted and may resend nothing. By requiring (issued & wanted) == wanted before taking the asynchronous path, the code only uses ceph_check_caps() when the wanted caps are already actually issued. Otherwise, it sends the synchronous OPEN renew.
This preserves the existing asynchronous fast path when the wanted caps are already issued, avoids changing cap-state semantics, and fixes the hang by guaranteeing that a stalled waiter eventually retries through a path that does not rely on the stale mds_wanted state.
[ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to
mds_client.h, formatting ]
--- fs/ceph/caps.c | 17 +++++++++++++++-- fs/ceph/file.c | 9 +++++---- fs/ceph/mds_client.h | 1 + 3 files changed, 21 insertions(+), 6 deletions(-)
fs/ceph/caps.c +15 -2
@@ -3091,7 +3091,19 @@ int __ceph_get_caps(struct inode *inode, ret = -ERESTARTSYS ;break ; } -wait_woken (&wait,TASK_INTERRUPTIBLE ,MAX_SCHEDULE_TIMEOUT ); + +/* +* If a cap update is lost after +* mds_wanted was raised, waiting +* forever will never make progress. +* Retry the renew path periodically +* so we can resend synchronously. +*/ +if (!wait_woken (&wait,TASK_INTERRUPTIBLE , +CEPH_GET_CAPS_WAIT_TIMEOUT )) { + ret = -EUCLEAN ; +break ; + } }remove_wait_queue (&ci->i_cap_wq, &wait);
@@ -3125,7 +3137,8 @@ int __ceph_get_caps(struct inode *inode,continue ; }if (ret == -EUCLEAN ) { -/* session was killed, try renew caps */ +/* session was killed or a waited cap +* request needs a retry */ ret =ceph_renew_caps (inode, flags);if (ret ==0 )continue ;
fs/ceph/file.c +5 -4
@@ -314,7 +314,7 @@ static int ceph_init_file(struct inode * }/* -* try renew caps after session gets killed. +* Retry cap acquisition after a stale session or a lost cap update. */ int ceph_renew_caps (struct inode *inode,int fmode) {
@@ -322,14 +322,15 @@ int ceph_renew_caps(struct inode *inode,struct ceph_client *cl = mdsc->fsc->client;struct ceph_inode_info *ci =ceph_inode (inode);struct ceph_mds_request *req; -int err, flags, wanted; +int err, flags, wanted, issued;spin_lock (&ci->i_ceph_lock);__ceph_touch_fmode (ci, mdsc, fmode); wanted =__ceph_caps_file_wanted (ci); + issued =__ceph_caps_issued (ci,NULL );if (__ceph_is_any_real_caps (ci) && - (!(wanted &CEPH_CAP_ANY_WR ) || ci->i_auth_cap)) { -int issued =__ceph_caps_issued (ci,NULL ); + (!(wanted &CEPH_CAP_ANY_WR ) || ci->i_auth_cap) && + (issued & wanted) == wanted) {spin_unlock (&ci->i_ceph_lock); doutc(cl, "%p %llx.%llx want %s issued %s updating mds_wanted\n", inode, ceph_vinop(inode), ceph_cap_string(wanted),
fs/ceph/mds_client.h +1 -0
@@ -77,6 +77,7 @@ struct ceph_fs_client;struct ceph_cap ;#define MDS_AUTH_UID_ANY -1 +#define CEPH_GET_CAPS_WAIT_TIMEOUT (5 * HZ)struct ceph_mds_cap_match {s64 uid;/* default to MDS_AUTH_UID_ANY */
Greg Kroah-Hartman
maintainerPATCH 155/228 ASoC: tas2562: Validate values for volume writes
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 8fb41964f7e4e4207c8999af2056894caa7a252a ]
tas2562_volume_control_put() does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and then writes whatever value it gets back to the device. Add validation that we are loading a value we have in the array.
--- sound/soc/codecs/tas2562.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
sound/soc/codecs/tas2562.c +7 -2
@@ -472,10 +472,15 @@ static int tas2562_volume_control_put(st {struct snd_soc_component *component =snd_kcontrol_chip (kcontrol);struct tas2562_data *tas2562 =snd_soc_component_get_drvdata (component); -int ret; +int ret, index;u32 reg_val; - reg_val = float_vol_db_lookup[ucontrol->value.integer.value[0 ]/2 ]; + index = ucontrol->value.integer.value[0 ] /2 ; +if (index <0 || index >=ARRAY_SIZE (float_vol_db_lookup)) +return -EINVAL ; + + reg_val = float_vol_db_lookup[index]; +/* * The device applies the 32-bit coefficient to the playback path on * the write to DVC_CFG4 (the LSB, book 0 page 2 reg 0x0F), so the
Greg Kroah-Hartman
maintainerPATCH 156/228 drm/mediatek: Convert legacy DRM logging to drm_* helpers in mtk_dsi.c
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Rajput <[email protected]>
[ Upstream commit c319b83e152181cc669a761695a9475510f5d3e5 ]
Replace DRM_INFO(), DRM_WARN() and DRM_ERROR() calls in drivers/gpu/drm/mediatek/mtk_dsi.c with the corresponding drm_info(), drm_warn() and drm_err() helpers.
The drm_*() logging helpers take a struct drm_device * argument, allowing the DRM core to prefix log messages with the correct device name and instance. This is required to correctly distinguish log messages on systems with multiple GPUs.
This change aligns the radeon driver with the DRM TODO item:
"Convert logging to drm_* functions with drm_device parameter".
Stable-dep-of: 3e191eddbdcb ("drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable")
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/gpu/drm/mediatek/mtk_dsi.c +17 -10
@@ -511,6 +511,7 @@ static void mtk_dsi_config_vdo_timing_peu32 delta;struct mtk_phy_timing *timing = &dsi->phy_timing;struct videomode *vm = &dsi->vm; +struct drm_device *drm = dsi->bridge.dev;if (dsi->format ==MIPI_DSI_FMT_RGB565 ) dsi_tmp_buf_bpp =2 ;
@@ -544,7 +545,7 @@ static void mtk_dsi_config_vdo_timing_pe horizontal_backporch_byte / horizontal_front_back_byte; }else { -DRM_WARN ("HFP + HBP less than d-phy, FPS will under 60Hz\n" ); +drm_warn (drm,"HFP + HBP less than d-phy, FPS will under 60Hz\n" ); } if ((dsi->mode_flags & MIPI_DSI_HS_PKT_END_ALIGNED) &&
@@ -624,12 +625,13 @@ static s32 mtk_dsi_wait_for_irq_done(str {s32 ret =0 ;unsigned long jiffies =msecs_to_jiffies (timeout); +struct drm_device *drm = dsi->bridge.dev; ret =wait_event_interruptible_timeout (dsi->irq_wait_queue, dsi->irq_data & irq_flag, jiffies);if (ret ==0 ) { -DRM_WARN ("Wait DSI IRQ(0x%08x) Timeout\n" , irq_flag); +drm_warn (drm,"Wait DSI IRQ(0x%08x) Timeout\n" , irq_flag);mtk_dsi_enable (dsi);mtk_dsi_reset_engine (dsi);
@@ -664,9 +666,10 @@ static s32 mtk_dsi_switch_to_cmd_mode(st {mtk_dsi_irq_data_clear (dsi, irq_flag);mtk_dsi_set_cmd_mode (dsi); +struct drm_device *drm = dsi->bridge.dev;if (!mtk_dsi_wait_for_irq_done (dsi, irq_flag, t)) { -DRM_ERROR ("failed to switch cmd mode\n" ); +drm_err (drm,"failed to switch cmd mode\n" );return -ETIME ; }else {return 0 ;
@@ -849,11 +852,12 @@ static void mtk_dsi_bridge_atomic_pre_en struct drm_atomic_state *state) {struct mtk_dsi *dsi =bridge_to_dsi (bridge); +struct drm_device *drm = bridge->dev;int ret; ret =mtk_dsi_poweron (dsi);if (ret <0 ) -DRM_ERROR ("failed to power on dsi\n" ); +drm_err (drm,"failed to power on dsi\n" ); } static void mtk_dsi_bridge_atomic_post_disable(struct drm_bridge *bridge,
@@ -916,7 +920,7 @@ static int mtk_dsi_encoder_init(struct d ret =drm_simple_encoder_init (drm, &dsi->encoder,DRM_MODE_ENCODER_DSI );if (ret) { -DRM_ERROR ("Failed to encoder init to drm\n" ); +drm_err (drm,"Failed to encoder init to drm\n" );return ret; }
@@ -932,7 +936,7 @@ static int mtk_dsi_encoder_init(struct d dsi->connector =drm_bridge_connector_init (drm, &dsi->encoder);if (IS_ERR (dsi->connector)) { -DRM_ERROR ("Unable to create bridge connector\n" ); +drm_err (drm,"Unable to create bridge connector\n" ); ret =PTR_ERR (dsi->connector); goto err_cleanup_encoder; }
@@ -985,6 +989,7 @@ static int mtk_dsi_host_attach(struct mi {struct mtk_dsi *dsi =host_to_dsi (host);struct device *dev = host->dev; +struct drm_device *drm = dsi->bridge.dev;int ret; dsi->lanes = device->lanes;
@@ -1006,7 +1011,7 @@ static int mtk_dsi_host_attach(struct mi ret =component_add (host->dev, &mtk_dsi_component_ops);if (ret) { -DRM_ERROR ("failed to add dsi_host component: %d\n" , ret); +drm_err (drm,"failed to add dsi_host component: %d\n" , ret);drm_bridge_remove (&dsi->bridge);return ret; }
@@ -1028,11 +1033,12 @@ static void mtk_dsi_wait_for_idle(struct {int ret;u32 val; +struct drm_device *drm = dsi->bridge.dev; ret =readl_poll_timeout (dsi->regs +DSI_INTSTA , val, !(val &DSI_BUSY ),4 ,2000000 );if (ret) { -DRM_WARN ("polling dsi wait not busy timeout!\n" ); +drm_warn (drm,"polling dsi wait not busy timeout!\n" );mtk_dsi_enable (dsi);mtk_dsi_reset_engine (dsi);
@@ -1120,6 +1126,7 @@ static ssize_t mtk_dsi_host_transfer(str const struct mipi_dsi_msg *msg) {struct mtk_dsi *dsi =host_to_dsi (host); +struct drm_device *drm = dsi->bridge.dev;ssize_t recv_cnt;u8 read_data[16 ];void *src_addr;
@@ -1150,7 +1157,7 @@ static ssize_t mtk_dsi_host_transfer(str }if (!msg->rx_buf) { -DRM_ERROR ("dsi receive buffer size may be NULL\n" ); +drm_err (drm,"dsi receive buffer size may be NULL\n" ); ret = -EINVAL ; goto restore_dsi_mode; }
@@ -1174,7 +1181,7 @@ static ssize_t mtk_dsi_host_transfer(strif (recv_cnt)memcpy (msg->rx_buf, src_addr, recv_cnt); -DRM_INFO ("dsi get %zd byte data from the panel address(0x%x)\n" , +drm_info (drm,"dsi get %zd byte data from the panel address(0x%x)\n" , recv_cnt, *((u8 *)(msg->tx_buf))); restore_dsi_mode:
Greg Kroah-Hartman
maintainerPATCH 157/228 drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 3e191eddbdcb8bf7beb1e9b58209073bd5450719 ]
Commit 76255024cadb ("drm/mediatek: mtk_dsi: enable hs clock during pre-enable") rightfully moves the HS clock enablement to before atomic_enable(), but it's moving it to mtk_dsi_poweron(), which is not only called in the .atomic_pre_enable() callback for the DRM bridge, but also in the MediaTek DRM's .ddp_start() callback, which happens way before the bridge ones.
The HS clock enablement should be done at just the right time, otherwise some bridge chips (or some Display Driver ICs) may not work correctly: this is seen at least with a Parade DSI to eDP bridge (PS8640) on the MT8173 Elm Chromebook.
This resolves a regression that was seen on the aforementioned machine, which was happening only after a suspend-resume cycle.
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_dsi.c +3 -2
@@ -743,8 +743,6 @@ static int mtk_dsi_poweron(struct mtk_dsmtk_dsi_set_vm_cmd (dsi);mtk_dsi_config_vdo_timing (dsi);mtk_dsi_set_interrupt_enable (dsi); -mtk_dsi_lane_ready (dsi); -mtk_dsi_clk_hs_mode (dsi,1 );return 0 ; err_disable_engine_clk:
@@ -858,6 +856,9 @@ static void mtk_dsi_bridge_atomic_pre_en ret =mtk_dsi_poweron (dsi);if (ret <0 )drm_err (drm,"failed to power on dsi\n" ); + +mtk_dsi_lane_ready (dsi); +mtk_dsi_clk_hs_mode (dsi,1 ); } static void mtk_dsi_bridge_atomic_post_disable(struct drm_bridge *bridge,
Greg Kroah-Hartman
maintainerPATCH 158/228 drm/amdkfd: Add bounds check for CRAT subtype length
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Palacek <[email protected]>
[ Upstream commit 6e7566ba4739dd573c331adde1c96690f7a567bd ]
The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures.
Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents.
--- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/amd/amdkfd/kfd_crat.c +9 -0
@@ -1404,6 +1404,15 @@ int kfd_parse_crat_table(void *crat_imag sub_type_hdr = (struct crat_subtype_generic *)(crat_table+1 );while ((char *)sub_type_hdr +sizeof (struct crat_subtype_generic ) < ((char *)crat_image) + image_len) { +/* Validate subtype fits within remaining image */ +if ((char *)sub_type_hdr + sub_type_hdr->length > + (char *)crat_image + image_len) { +pr_warn ("CRAT subtype length %u exceeds image bounds\n" , + sub_type_hdr->length); + ret = -EINVAL ; +break ; + } +if (sub_type_hdr->flags &CRAT_SUBTYPE_FLAGS_ENABLED ) { ret =kfd_parse_subtype (sub_type_hdr, device_list);if (ret)
Greg Kroah-Hartman
maintainerPATCH 159/228 net: rename netdev_ops_assert_locked()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 251bc9db88fb351ea2dfbd976c4e6aaae6507a91 ]
Jakub suggests renaming the existing assert to match the netdev_lock_ops_compat() semantics.
We want netdev_assert_locked_ops() to mean - if the driver is ops locked - check that it's holding the device lock.
The existing helper check for either ops lock or rtnl_lock, which is the locking behavior of netdev_lock_ops_compat().
The reason for naming divergence is likely that netdev_ops_assert_locked() predated the _compat() helpers.
Stable-dep-of: 92465f46f3c3 ("net: expect instance lock in netdev_queue_get_dma_dev()")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- include/net/netdev_lock.h | 6 +++--- net/core/dev.c | 26 +++++++++++++------------- net/core/dev_addr_lists.c | 2 +- net/core/link_watch.c | 2 +- net/core/lock_debug.c | 2 +- net/core/netdev_queues.c | 2 +- net/ethtool/netlink.c | 4 ++-- net/ipv6/addrconf.c | 2 +- net/xdp/xsk_buff_pool.c | 2 +- 10 files changed, 25 insertions(+), 25 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -1
@@ -16854,7 +16854,7 @@ int bnxt_restore_pf_fw_resources(struct {int rc; -netdev_ops_assert_locked (bp->dev); +netdev_assert_locked_ops_compat (bp->dev);bnxt_hwrm_func_qcaps (bp);if (netif_running (bp->dev))
include/net/netdev_lock.h +3 -3
@@ -64,7 +64,7 @@ static inline void netdev_unlock_full_tonetdev_unlock (dev); } -static inline void netdev_ops_assert_locked (const struct net_device *dev) +static inline void netdev_assert_locked_ops_compat (const struct net_device *dev) {if (netdev_need_ops_lock (dev))lockdep_assert_held (&dev->lock);
@@ -73,11 +73,11 @@ static inline void netdev_ops_assert_loc }static inline void -netdev_ops_assert_locked_or_invisible (const struct net_device *dev) +netdev_assert_locked_ops_compat_or_invisible (const struct net_device *dev) {if (dev->reg_state ==NETREG_REGISTERED || dev->reg_state ==NETREG_UNREGISTERING ) -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev); }static inline void netdev_lock_ops_compat (struct net_device *dev)
net/core/dev.c +13 -13
@@ -1593,7 +1593,7 @@ EXPORT_SYMBOL(netdev_features_change);void netif_state_change (struct net_device *dev) { -netdev_ops_assert_locked_or_invisible (dev); +netdev_assert_locked_ops_compat_or_invisible (dev);if (dev->flags &IFF_UP ) { struct netdev_notifier_change_info change_info = {
@@ -1693,7 +1693,7 @@ static int __dev_open(struct net_deviceset_bit (__LINK_STATE_START, &dev->state); -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);if (ops->ndo_validate_addr) ret = ops->ndo_validate_addr (dev);
@@ -1770,7 +1770,7 @@ static void __dev_close_many(struct list* event. */ -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);if (ops->ndo_stop) ops->ndo_stop (dev);
@@ -3198,7 +3198,7 @@ int netif_set_real_num_tx_queues(structif (dev->reg_state ==NETREG_REGISTERED || dev->reg_state ==NETREG_UNREGISTERING ) { -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev); rc =netdev_queue_update_kobjects (dev, dev->real_num_tx_queues, txq);
@@ -3247,7 +3247,7 @@ int netif_set_real_num_rx_queues(structreturn -EINVAL ;if (dev->reg_state ==NETREG_REGISTERED ) { -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev); rc =net_rx_queue_update_kobjects (dev, dev->real_num_rx_queues, rxq);
@@ -7313,7 +7313,7 @@ void netif_queue_set_napi(struct net_devif (WARN_ON_ONCE (napi && !napi->dev))return ; -netdev_ops_assert_locked_or_invisible (dev); +netdev_assert_locked_ops_compat_or_invisible (dev);switch (type) {case NETDEV_QUEUE_TYPE_RX :
@@ -9608,7 +9608,7 @@ int __dev_set_promiscuity(struct net_devkuid_t uid;kgid_t gid; -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev); promiscuity = dev->promiscuity + inc;if (promiscuity ==0 ) {
@@ -9667,7 +9667,7 @@ int netif_set_allmulti(struct net_deviceunsigned int old_flags = dev->flags, old_gflags = dev->gflags;unsigned int allmulti, flags; -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev); allmulti = dev->allmulti + inc;if (allmulti ==0 ) {
@@ -9735,7 +9735,7 @@ int __dev_change_flags(struct net_deviceunsigned int old_flags = dev->flags;int ret; -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);/* * Set the flags on our device.
@@ -9883,7 +9883,7 @@ int netif_set_mtu_ext(struct net_device {int err, orig_mtu; -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);if (new_mtu == dev->mtu)return 0 ;
@@ -10317,7 +10317,7 @@ static int dev_xdp_install(struct net_destruct netdev_bpf xdp;int err; -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);if (dev->cfg->hds_config ==ETHTOOL_TCP_DATA_SPLIT_ENABLED && prog && !prog->aux->xdp_has_frags) {
@@ -10769,7 +10769,7 @@ u32 dev_get_min_mp_channel_count(const s {int i; -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);for (i = dev->real_num_rx_queues -1 ; i >=0 ; i--)if (dev->_rx[i].mp_params.mp_priv)
@@ -10997,7 +10997,7 @@ int __netdev_update_features(struct net_int err =-1 ;ASSERT_RTNL (); -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev); features =netdev_get_wanted_features (dev);
net/core/dev_addr_lists.c +1 -1
@@ -1260,7 +1260,7 @@ static void netif_rx_mode_run(struct netint err;might_sleep (); -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);__hw_addr_init (&uc_snap);__hw_addr_init (&mc_snap);
net/core/link_watch.c +1 -1
@@ -277,7 +277,7 @@ static bool linkwatch_clean_dev(struct nvoid __linkwatch_sync_dev (struct net_device *dev) { -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);if (linkwatch_clean_dev (dev)) {linkwatch_do_dev (dev);
net/core/lock_debug.c +1 -1
@@ -24,7 +24,7 @@ int netdev_debug_event(struct notifier_bcase NETDEV_CHANGE :case NETDEV_REGISTER :case NETDEV_UP : -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev); fallthrough;case NETDEV_DOWN :case NETDEV_REBOOT :
net/core/netdev_queues.c +1 -1
@@ -40,7 +40,7 @@ struct device *netdev_queue_get_dma_dev(struct netdev_rx_queue *hw_rxq;struct device *dma_dev; -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);/* Only RX side supports queue leasing today. */ if (type !=NETDEV_QUEUE_TYPE_RX || !netif_rxq_is_leased (dev, idx))
net/ethtool/netlink.c +2 -2
@@ -98,7 +98,7 @@ int ethnl_ops_begin(struct net_device *dif (dev->dev.parent)pm_runtime_get_sync (dev->dev.parent); -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);if (!netif_device_present (dev) || dev->reg_state >=NETREG_UNREGISTERING ) {
@@ -1003,7 +1003,7 @@ static void ethnl_default_notify(struct ops->req_info_size - sizeof(*req_info)); } -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);ethnl_init_reply_data (reply_data, ops, dev); ret = ops->prepare_data (req_info, reply_data, &info);
net/ipv6/addrconf.c +1 -1
@@ -380,7 +380,7 @@ static struct inet6_dev *ipv6_add_dev(stint err = -ENOMEM ;ASSERT_RTNL (); -netdev_ops_assert_locked (dev); +netdev_assert_locked_ops_compat (dev);if (dev->mtu <IPV6_MIN_MTU && dev != blackhole_netdev)return ERR_PTR (-EINVAL );
net/xdp/xsk_buff_pool.c +1 -1
@@ -244,7 +244,7 @@ int xp_assign_dev(struct xsk_buff_pool * bpf.xsk.pool = pool; bpf.xsk.queue_id = queue_id; -netdev_ops_assert_locked (netdev); +netdev_assert_locked_ops_compat (netdev); err = netdev->netdev_ops->ndo_bpf (netdev, &bpf);if (err) goto err_unreg_pool;
Greg Kroah-Hartman
maintainerPATCH 160/228 net: expect instance lock in netdev_queue_get_dma_dev()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 92465f46f3c3a92e4758af20d2363b7adc43e1f5 ]
netdev_queue_get_dma_dev() uses "compat" locking assert which wants either the rtnl_lock or netdev instance lock. This is not right, the callers are taking the instance lock unconditionally. All entry points for queue config are purely instance locked.
In other words the callers use netdev_get_by_index_lock(), not netdev_get_by_index_lock_ops_compat(). All the state we will access is effectively instance lock protected (it's const for devices which are not ops-locked).
Update the assert to avoid false positive warnings.
--- net/core/netdev_queues.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/netdev_queues.c +1 -1
@@ -40,7 +40,7 @@ struct device *netdev_queue_get_dma_dev(struct netdev_rx_queue *hw_rxq;struct device *dma_dev; -netdev_assert_locked_ops_compat (dev); +netdev_assert_locked (dev);/* Only RX side supports queue leasing today. */ if (type !=NETDEV_QUEUE_TYPE_RX || !netif_rxq_is_leased (dev, idx))
Greg Kroah-Hartman
maintainerPATCH 161/228 ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
commit 0c0e418dbcf0582bf80d8dbfd9b306607c065992 upstream.
The ipc_config_data buffer for copier widgets is built once during ipc_prepare (called from sof_pcm_setup_connected_widgets) and cached for reuse. For host copiers this buffer contains the copier_data with gtw_cfg.node_id (host DMA ID). For DAI copiers it additionally includes a dma_config_tlv trailer with stream_id and dma_channel_id for HDA link DMA.
On suspend/resume, both host and link DMA streams are released and re-allocated with potentially different stream tags. The underlying copier_data and dma_config_tlv structures are correctly updated by host_config and sdw_hda_dai_hw_params respectively. However, since the widget list (spcm->stream[].list) persists across suspend, sof_pcm_hw_params skips sof_pcm_setup_connected_widgets and ipc_prepare never runs again to rebuild ipc_config_data. The stale cached payload is then sent to firmware with boot-time DMA channel assignments, causing DMA channel conflicts that lead to firmware errors and crashes.
Fix this by refreshing copier_data and dma_config_tlv portions of ipc_config_data in sof_ipc4_widget_setup right before the IPC message is sent. This ensures the payload always reflects the current DMA state regardless of whether ipc_prepare ran.
For DAI copiers, the gtw_cfg.config_length in copier_data is temporarily inflated to include the TLV size (matching the ipc_config_data layout) before copying, then restored, mirroring what sof_ipc4_prepare_copier_module does when first building the buffer.
--- sound/soc/sof/ipc4-topology.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
sound/soc/sof/ipc4-topology.c +33 -0
@@ -3151,6 +3151,15 @@ static int sof_ipc4_widget_setup(struct ipc_size = ipc4_copier->ipc_config_size; ipc_data = ipc4_copier->ipc_config_data; +/* +* Refresh copier_data in ipc_config_data for host copiers. +* The node_id may have been updated by host_config after +* ipc_prepare, e.g. when host stream tags change after a +* suspend/resume cycle. +*/ +if (swidget->id != snd_soc_dapm_buffer) +memcpy (ipc_data, &ipc4_copier->data,sizeof (ipc4_copier->data)); + msg = &ipc4_copier->msg;break ; }
@@ -3159,6 +3168,9 @@ static int sof_ipc4_widget_setup(struct {struct snd_sof_dai *dai = swidget->private;struct sof_ipc4_copier *ipc4_copier = dai->private; +struct sof_ipc4_copier_data *copier_data; +u32 gtw_cfg_config_length; +u32 tlv_size; pipeline = pipe_widget->private;if (pipeline->use_chain_dma)
@@ -3167,6 +3179,27 @@ static int sof_ipc4_widget_setup(struct ipc_size = ipc4_copier->ipc_config_size; ipc_data = ipc4_copier->ipc_config_data; +/* +* Refresh copier_data and dma_config_tlv in ipc_config_data. +* These may have been updated after ipc_prepare, e.g. when +* link DMA stream tags change after a suspend/resume cycle. +* +* copier_data->gtw_cfg.config_length does not include the +* TLV size (it was restored after sof_ipc4_prepare_copier_module), +* so temporarily inflate it to match the ipc_config_data layout. +*/ + copier_data = &ipc4_copier->data; + gtw_cfg_config_length = copier_data->gtw_cfg.config_length *4 ; + tlv_size = ipc_size -sizeof (*copier_data) - gtw_cfg_config_length; + + copier_data->gtw_cfg.config_length += tlv_size /4 ; +memcpy (ipc_data, copier_data,sizeof (*copier_data)); + copier_data->gtw_cfg.config_length = gtw_cfg_config_length /4 ; + +if (tlv_size) +memcpy (ipc_data +sizeof (*copier_data) + gtw_cfg_config_length, + &ipc4_copier->dma_config_tlv, tlv_size); + msg = &ipc4_copier->msg;break ; }
Greg Kroah-Hartman
maintainerPATCH 162/228 clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 2ef00630c5c0b7b2c08aba7643f47594952d357e ]
Eliza EVK (eliza-cqs-evk.dts) does not have display enabled, however its Display Clock Controller is enabled and references parent clocks from DSI PHYs, which causes clock reparenting issues during probe (init) and warning on Eliza EVK:
disp_cc_mdss_mdp_clk_src: rcg didn't update its configuration.
WARNING: drivers/clk/qcom/clk-rcg2.c:136 at update_config+0xd4/0xe4, CPU#1: udevd/273
...
update_config (drivers/clk/qcom/clk-rcg2.c:136 (discriminator 2)) (P)
clk_rcg2_shared_disable (drivers/clk/qcom/clk-rcg2.c:1471)
clk_rcg2_shared_init (drivers/clk/qcom/clk-rcg2.c:1540)
__clk_register (drivers/clk/clk.c:3959 drivers/clk/clk.c:4368)
devm_clk_hw_register (drivers/clk/clk.c:4448 (discriminator 1) drivers/clk/clk.c:4672 (discriminator 1))
devm_clk_register_regmap (drivers/clk/qcom/clk-regmap.c:104)
qcom_cc_really_probe (drivers/clk/qcom/common.c:418)
qcom_cc_probe (drivers/clk/qcom/common.c:445)
disp_cc_eliza_probe (dispcc-eliza.c:?) dispcc_eliza
platform_probe (drivers/base/platform.c:1432)--- drivers/clk/qcom/dispcc-eliza.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/dispcc-eliza.c +1 -1
@@ -757,7 +757,7 @@ static struct clk_rcg2 disp_cc_mdss_mdp_clk_src = { .parent_data = disp_cc_parent_data_11, .num_parents = ARRAY_SIZE(disp_cc_parent_data_11), .flags = CLK_SET_RATE_PARENT, - .ops = &clk_rcg2_shared_ops, + .ops = &clk_rcg2_shared_no_init_park_ops, }, };
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 163/228 optee: ffa: Add NULL check in optee_ffa_lend_protmem
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <[email protected]>
[ Upstream commit 650c88738ae8976f46ba71b24dd8aa311adc6fde ]
Sashiko (locally) reports a possible null dereference under memory pressure due to the lack of validation of the allocated pointer.
Fix that by adding the missing check.
--- drivers/tee/optee/ffa_abi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/tee/optee/ffa_abi.c +3 -0
@@ -698,6 +698,9 @@ static int optee_ffa_lend_protmem(struct optee *optee, struct tee_shm *protmem,int rc; mem_attr =kzalloc_objs (*mem_attr, ma_count); +if (!mem_attr) +return -ENOMEM ; +for (n =0 ; n < ma_count; n++) { mem_attr[n].receiver = mem_attrs[n] &U16_MAX ; mem_attr[n].attrs = mem_attrs[n] >>16 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 164/228 clk: spacemit: k3: fix USB2 bus clock
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yixun Lan <[email protected]>
[ Upstream commit 51ed53630915c9cc290036fe4f430849e23bbf8e ]
According to SpacemiT K3's updated docs, the USB2 ahb reset and USB2 bus clock enable bit was wrongly swapped, the correct one should be:
Register : APMU_USB_CLK_RES_CTRL
bit[1] : usb2_port_bus_clk_en
bit[0] : usb2_port_ahb_rstn
--- drivers/clk/spacemit/ccu-k3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/spacemit/ccu-k3.c +1 -1
@@ -777,7 +777,7 @@ static const struct clk_parent_data sdh2_parents[] = {CCU_MUX_DIV_GATE_FC_DEFINE (sdh2_clk, sdh2_parents,APMU_SDH2_CLK_RES_CTRL ,8 ,3 ,BIT (11 ),5 ,3 ,BIT (4 ),0 ); -CCU_GATE_DEFINE (usb2_bus_clk,CCU_PARENT_HW (axi_clk),APMU_USB_CLK_RES_CTRL ,BIT (0 ),0 ); +CCU_GATE_DEFINE (usb2_bus_clk,CCU_PARENT_HW (axi_clk),APMU_USB_CLK_RES_CTRL ,BIT (1 ),0 );CCU_GATE_DEFINE (usb3_porta_bus_clk,CCU_PARENT_HW (axi_clk),APMU_USB_CLK_RES_CTRL ,BIT (4 ),0 );CCU_GATE_DEFINE (usb3_portb_bus_clk,CCU_PARENT_HW (axi_clk),APMU_USB_CLK_RES_CTRL ,BIT (8 ),0 );CCU_GATE_DEFINE (usb3_portc_bus_clk,CCU_PARENT_HW (axi_clk),APMU_USB_CLK_RES_CTRL ,BIT (12 ),0 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 165/228 clk: spacemit: k3: set hdma clock as critical
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yixun Lan <[email protected]>
[ Upstream commit eb525edd48907795c0d4e498ff57ad168070b289 ]
HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will hang, for example in the case of a vector instruction access generates a page fault.
--- drivers/clk/spacemit/ccu-k3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/spacemit/ccu-k3.c +1 -1
@@ -1021,7 +1021,7 @@ CCU_MUX_DIV_GATE_DEFINE(isim_vclk_out3, isim_vclk_parents, APMU_SNR_ISIM_VCLK_CT/* APMU clocks end */ /* DCIU clocks start */ -CCU_GATE_DEFINE (hdma_clk,CCU_PARENT_HW (axi_clk),DCIU_DMASYS_CLK_EN ,BIT (0 ),0 ); +CCU_GATE_DEFINE (hdma_clk,CCU_PARENT_HW (axi_clk),DCIU_DMASYS_CLK_EN ,BIT (0 ),CLK_IS_CRITICAL );CCU_GATE_DEFINE (dma350_clk,CCU_PARENT_HW (axi_clk),DCIU_DMASYS_SDMA_CLK_EN ,BIT (0 ),0 );CCU_GATE_DEFINE (c2_tcm_pipe_clk,CCU_PARENT_HW (axi_clk),DCIU_C2_TCM_PIPE_CLK ,BIT (0 ),0 );CCU_GATE_DEFINE (c3_tcm_pipe_clk,CCU_PARENT_HW (axi_clk),DCIU_C3_TCM_PIPE_CLK ,BIT (0 ),0 );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 166/228 arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Hunter <[email protected]>
[ Upstream commit a7c28483fd57dd0e1487024af70622315320774b ]
Commit d87773de9efe ("clocksource/drivers/arm_arch_timer: Default to EL2 virtual timer when running VHE") updated the ARM arch timer driver to use the virtual timer by default if the CPU is running at EL2 with VHE enabled. If the CPU is running at EL2 with VHE enabled but there is no interrupt provided for the virtual timer, then the following warning is displayed:
arch_timer: [Firmware Bug]: VHE-capable CPU without EL2 virtual timer
interrupt
This warning is observed on Tegra194 platforms. Tegra194 SoC includes NVIDIA Carmel ARM v8.2 CPUs and support an EL2 virtual timer. Fix the above warning by adding the PPI for the EL2 virtual timer interrupt for Tegra194.
--- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/nvidia/tegra194.dtsi +2 -0
@@ -3163,6 +3163,8 @@ timer { <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, <GIC_PPI 10 + (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, + <GIC_PPI 15 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>; interrupt-parent = <&gic>; always-on;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 167/228 crypto: ccm - Set rfc4309 maxauthsize from child
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 438f4896f78f69ec73d5f32d2c024193f1223569 ]
Set the maxauthsize of rfc4309 using that of the child algorithm.
--- crypto/ccm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/ccm.c +1 -1
@@ -747,7 +747,7 @@ static int crypto_rfc4309_create(struct crypto_template *tmpl, inst->alg.ivsize =8 ; inst->alg.chunksize =crypto_aead_alg_chunksize (alg); - inst->alg.maxauthsize =16 ; + inst->alg.maxauthsize =crypto_aead_alg_maxauthsize (alg); inst->alg.base.cra_ctxsize =sizeof (struct crypto_rfc4309_ctx );
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 168/228 crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladislav Dronov <[email protected]>
[ Upstream commit 360f2974fcea49c61f6d6f81554741a9eeee7168 ]
Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer.
As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively.
--- drivers/crypto/tegra/tegra-se-aes.c | 22 +++------------------- 1 file changed, 3 insertions(+), 19 deletions(-)
drivers/crypto/tegra/tegra-se-aes.c +3 -19
@@ -45,7 +45,6 @@ struct tegra_aes_reqctx {struct tegra_aead_ctx {struct tegra_se *se; -unsigned int authsize;u32 alg;u32 key_id;u32 keylen;
@@ -1290,7 +1289,7 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)if (rctx->encrypt) rctx->cryptlen = req->cryptlen;else - rctx->cryptlen = req->cryptlen - ctx->authsize; + rctx->cryptlen = req->cryptlen - rctx->authsize;memcpy (rctx->iv, req->iv,GCM_AES_IV_SIZE ); rctx->iv[3 ] = (1 <<24 );
@@ -1394,8 +1393,6 @@ static int tegra_aead_cra_init(struct crypto_aead *tfm)static int tegra_ccm_setauthsize (struct crypto_aead *tfm,unsigned int authsize) { -struct tegra_aead_ctx *ctx =crypto_aead_ctx (tfm); -switch (authsize) {case 4 :case 6 :
@@ -1404,28 +1401,15 @@ static int tegra_ccm_setauthsize(struct crypto_aead *tfm, unsigned int authsizecase 12 :case 14 :case 16 : -break ; +return 0 ;default :return -EINVAL ; } - - ctx->authsize = authsize; - -return 0 ; }static int tegra_gcm_setauthsize (struct crypto_aead *tfm,unsigned int authsize) { -struct tegra_aead_ctx *ctx =crypto_aead_ctx (tfm); -int ret; - - ret =crypto_gcm_check_authsize (authsize); -if (ret) -return ret; - - ctx->authsize = authsize; - -return 0 ; +return crypto_gcm_check_authsize (authsize); }static void tegra_aead_cra_exit (struct crypto_aead *tfm)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 169/228 rhashtable: fix false-positive lockdep splat on rhltable destruction
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 1132c38927886259c694f77cd74fc577c2216eeb ]
Blamed commit removed ht->mutex usage during destruction but forgot to switch rhashtable_free_one() to rcu_dereference_raw(), this triggers a lockdep splat when an rhltable gets zapped.
--- lib/rhashtable.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/rhashtable.c +1 -1
@@ -1159,7 +1159,7 @@ static void rhashtable_free_one(struct rhashtable *ht, struct rhash_head *obj, list = container_of(obj, struct rhlist_head, rhead);do { obj = &list->rhead; - list =rht_dereference (list->next, ht); + list =rcu_dereference_raw (list->next);free_fn (rht_obj (ht, obj), arg); }while (list); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 170/228 gpiolib: Check gc->get_direction() before calling gpiod_get_direction()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy (CS GROUP) <[email protected]>
[ Upstream commit d761c7e38a000603a9d16270a1af770a0e8efb5e ]
According to 'struct gpio_chip' documentation in linux/gpio/driver.h, implementing .get_direction() is recommended but not mandatory. Most places verify that gc->get_direction() exists before calling gpiod_get_direction(), but gpiolib_dbg_show() doesn't.
Until commit 471e998c0e31 ("gpiolib: remove redundant callback check") it was also verified by gpiod_get_direction() itself so calling it at all time from gpiolib_dbg_show() was not an issue. But after the check in gpiod_get_direction() has been removed, calling it inconditionaly leads to a big fat warning in gpiochip_get_direction().
In gpiod_get_direction(), verify that gc->get_direction() exists before calling gpiod_get_direction().
--- drivers/gpio/gpiolib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib.c +2 -1
@@ -5408,7 +5408,8 @@ static void gpiolib_dbg_show(struct seq_file *s, struct gpio_chip *gc) flags =READ_ONCE (desc->flags); is_irq =test_bit (GPIOD_FLAG_USED_AS_IRQ , &flags);if (is_irq ||test_bit (GPIOD_FLAG_REQUESTED , &flags)) { -gpiod_get_direction (desc); +if (gc->get_direction) +gpiod_get_direction (desc); is_out =test_bit (GPIOD_FLAG_IS_OUT , &flags); value =gpio_chip_get_value (gc, desc); active_low =test_bit (GPIOD_FLAG_ACTIVE_LOW , &flags);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 171/228 regulator: fp9931: Fix VPOS/VNEG voltage selector table
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robby Cai <[email protected]>
[ Upstream commit 66694b5f90f3876fccb87bbd02b453cdc33b3ae4 ]
The VPOSNEG_table[] mapping does not match the FP9931 datasheet.
The datasheet defines the VPOS/VNEG voltage mapping as:
00h-04h -> 7.04V (-7.04V) 05h -> 7.26V (-7.26V) 06h -> 7.49V (-7.49V)
...
28h-3Fh -> 15.06V (-15.06V)
However, VPOSNEG_table[] has two issues:
1. Selector 0x00~0x04 should all map to 7.04V (5 entries), but the table has 6 entries of 7.04V, causing all subsequent entries to be shifted by one position.
2. Selectors 0x29~0x3F should all clamp to 15.06V (23 entries), but the table has only 41 entries. Any selector value above 0x28 would result in an out-of-bounds table access.
Fix both issues by removing the duplicate 7.04V entry and appending the missing 23 clamped 15.06V entries, bringing the table to the correct size of 64 entries (0x00~0x3F).
--- drivers/regulator/fp9931.c | 54 +++++++++----------------------------- 1 file changed, 12 insertions(+), 42 deletions(-)
drivers/regulator/fp9931.c +12 -42
@@ -37,48 +37,18 @@ struct fp9931_data { };static const unsigned int VPOSNEG_table[] = { -7040000 , -7040000 , -7040000 , -7040000 , -7040000 , -7040000 , -7260000 , -7490000 , -7710000 , -7930000 , -8150000 , -8380000 , -8600000 , -8820000 , -9040000 , -9270000 , -9490000 , -9710000 , -9940000 , -10160000 , -10380000 , -10600000 , -10830000 , -11050000 , -11270000 , -11490000 , -11720000 , -11940000 , -12160000 , -12380000 , -12610000 , -12830000 , -13050000 , -13280000 , -13500000 , -13720000 , -13940000 , -14170000 , -14390000 , -14610000 , -14830000 , -15060000 , +7040000 ,7040000 ,7040000 ,7040000 ,7040000 ,/* 00h-04h */ +7260000 ,7490000 ,7710000 ,7930000 ,8150000 ,8380000 ,/* 05h-0Ah */ +8600000 ,8820000 ,9040000 ,9270000 ,9490000 ,9710000 ,/* 0Bh-10h */ +9940000 ,10160000 ,10380000 ,10600000 ,10830000 ,11050000 ,/* 11h-16h */ +11270000 ,11490000 ,11720000 ,11940000 ,12160000 ,12380000 ,/* 17h-1Ch */ +12610000 ,12830000 ,13050000 ,13280000 ,13500000 ,13720000 ,/* 1Dh-22h */ +13940000 ,14170000 ,14390000 ,14610000 ,14830000 ,15060000 ,/* 23h-28h */ +/* 29h-3Fh: clamped to 15.06V per datasheet */ +15060000 ,15060000 ,15060000 ,15060000 ,15060000 ,15060000 , +15060000 ,15060000 ,15060000 ,15060000 ,15060000 ,15060000 , +15060000 ,15060000 ,15060000 ,15060000 ,15060000 ,15060000 , +15060000 ,15060000 ,15060000 ,15060000 ,15060000 , };static const struct hwmon_channel_info *fp9931_info[] = {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 172/228 af_unix: Unlink scc_entry in unix_del_edge().
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 594d905195024b228c962627ae5ae7c17bd582a4 ]
Kyle Zeng reported that GC could free a dead SCC partially.
The scenario is as follows:
1) Create two SCCs:
X -. A <-> B
^--'2) Run the following concurrently:
2-1) send() sk-B to sk-B from sk-X
2-2) close() both A and B
At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail().
If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge.
X -. A <-> B -. This edge is visible
^--' ^..' but skb is not
This itself is not a problem since the next GC run will judge B as dead as well and free it finally.
X -. A <.> B -.
^--' ^--'However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry.
Let's unlink scc_entry before freeing the vertex in unix_del_edge().
--- net/unix/garbage.c | 1 + 1 file changed, 1 insertion(+)
net/unix/garbage.c +1 -0
@@ -186,6 +186,7 @@ static void unix_del_edge(struct scm_fp_list *fpl, struct unix_edge *edge)if (!vertex->out_degree) { edge->predecessor->vertex =NULL ;list_move_tail (&vertex->entry, &fpl->vertices); +list_del (&vertex->scc_entry); } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 173/228 ovpn: fix NULL dereference when killing missing key
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit 41d44ac7a61e2f74453af40d4fe1b82af9ea0ada ]
ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present.
Read each slot once while holding the crypto state lock, check for NULL before looking at key_id, and only replace the slot that actually matches.
--- drivers/net/ovpn/crypto.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/net/ovpn/crypto.c +10 -6
@@ -58,15 +58,19 @@ void ovpn_crypto_state_release(struct ovpn_crypto_state *cs)bool ovpn_crypto_kill_key (struct ovpn_crypto_state *cs,u8 key_id) {struct ovpn_crypto_key_slot *ks =NULL ; +struct ovpn_crypto_key_slot *tmp; +int slot =0 ;spin_lock_bh (&cs->lock); -if (rcu_access_pointer (cs->slots[0 ])->key_id == key_id) { - ks =rcu_replace_pointer (cs->slots[0 ],NULL , -lockdep_is_held (&cs->lock)); - }else if (rcu_access_pointer (cs->slots[1 ])->key_id == key_id) { - ks =rcu_replace_pointer (cs->slots[1 ],NULL , -lockdep_is_held (&cs->lock)); + tmp =rcu_access_pointer (cs->slots[slot]); +if (!tmp || tmp->key_id != key_id) { + slot =1 ; + tmp =rcu_access_pointer (cs->slots[slot]); } + +if (tmp && tmp->key_id == key_id) + ks =rcu_replace_pointer (cs->slots[slot],NULL , +lockdep_is_held (&cs->lock));spin_unlock_bh (&cs->lock);if (ks)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 174/228 ovpn: finish crypto callback cleanup before peer release
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit 9e163917a86c6adfbe150e13f4c73653a54616de ]
Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress.
Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window.
Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action.
--- drivers/net/ovpn/io.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/ovpn/io.c +5 -5
@@ -204,10 +204,10 @@ void ovpn_decrypt_post(void *data, int ret)ovpn_dev_dstats_rx_dropped (peer->ovpn->dev);kfree_skb (skb); drop_nocount: -if (likely (peer)) -ovpn_peer_put (peer);if (likely (ks))ovpn_crypto_key_slot_put (ks); +if (likely (peer)) +ovpn_peer_put (peer); }/* RX path entry point: decrypt packet and forward it to the device */
@@ -302,11 +302,11 @@ void ovpn_encrypt_post(void *data, int ret) err:if (unlikely (skb))ovpn_dev_dstats_tx_dropped (peer->ovpn->dev); -if (likely (peer)) -ovpn_peer_put (peer); +kfree_skb (skb);if (likely (ks))ovpn_crypto_key_slot_put (ks); -kfree_skb (skb); +if (likely (peer)) +ovpn_peer_put (peer); }static bool ovpn_encrypt_one (struct ovpn_peer *peer,struct sk_buff *skb)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 175/228 riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <[email protected]>
[ Upstream commit 2820d227ad4ee70805d693d698437cc3e88d6c3d ]
We are frequently hitting the following splat during the riscv bpf selftests:
00000000026dc75a: expected (7c3ff297) but got (00100073) ------------[ ftrace bug ]------------
ftrace failed to modify
[<ffffffff03c44c1c>] bpf_kfunc_common_test+0x4/0x20 [bpf_testmod] actual: e7:82:c2:ce
Updating ftrace call site to call a different ftrace function ftrace record flags: 80100002
(2)
expected tramp: ffffffff80043904
------------[ cut here ]------------ WARNING: kernel/trace/ftrace.c:2278 at ftrace_bug+0x46e/0x4b0, CPU#1: test_progs/98 ... [<ffffffff80008f4e>] ftrace_bug+0x46e/0x4b0 [<ffffffff803d3e86>] ftrace_replace_code+0x16e/0x170 [<ffffffff803d42b6>] ftrace_modify_all_code+0x12e/0x1b8 [<ffffffff800430f4>] arch_ftrace_update_code+0x14/0x28 [<ffffffff803e0324>] ftrace_startup+0x14c/0x2a0 [<ffffffff803e133c>] ftrace_startup_subops+0x584/0x1050 [<ffffffff804500e6>] register_ftrace_graph+0x4e6/0x1018 [<ffffffff804cf9f6>] register_fprobe_ips+0xc66/0x12f8 [<ffffffff8049abe8>] bpf_kprobe_multi_link_attach+0x5d8/0xe68 [<ffffffff8050fcaa>] __sys_bpf+0x3d5a/0x47f0 [<ffffffff805107ee>] __riscv_sys_bpf+0xae/0x168 [<ffffffff80034d78>] syscall_handler+0x60/0x100 [<ffffffff8228b4f4>] do_trap_ecall_u+0x174/0x208 [<ffffffff822b69c4>] handle_exception+0x16c/0x178
After debugging, it can be triggered by similar commands below:
``` echo do_nanosleep > set_ftrace_filter echo function > current_tracer echo 'p do_nanosleep' > kprobe_events echo 1 > events/kprobes/enable echo 'f do_nanosleep' > dynamic_events echo 1 > events/fprobes/enable ```
The reason is that attaching a kprobe to an ftrace-traced function entry replaces its initial auipc insn with ebreak. When ftrace_modify_call later runs, it expects auipc insn, so verification fails and triggers ftrace_bug.
The expected auipc logic remains conceptually unchanged, and kprobe single-stepping ensures normal execution. Therefore, if the first insn is ebreak, bypassing the check to continue patching the jalr insn is safe and avoids ftrace failures.
--- arch/riscv/kernel/ftrace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/riscv/kernel/ftrace.c +4 -1
@@ -12,6 +12,7 @@#include <linux/stop_machine.h> #include <asm/cacheflush.h> #include <asm/text-patching.h> +#include <asm/insn.h> #ifdef CONFIG_DYNAMIC_FTRACE void ftrace_arch_code_modify_prepare (void )
@@ -63,7 +64,9 @@ static int __ftrace_modify_call(unsigned long source, unsigned long target, boolif (copy_from_kernel_nofault (replaced, (void *)source,2 *MCOUNT_INSN_SIZE ))return -EFAULT ; -if (replaced[0 ] != call[0 ]) { +/* Bypass the check if the auipc insn is a kprobe breakpoint */ +if (replaced[0 ] != call[0 ] && + !(riscv_insn_is_ebreak (replaced[0 ]) ||riscv_insn_is_c_ebreak (replaced[0 ]))) {pr_err ("%p: expected (%08x) but got (%08x)\n" , (void *)source, call[0 ], replaced[0 ]);return -EINVAL ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 176/228 scsi: core: pair EH runtime PM get and put
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongjie Fang <[email protected]>
[ Upstream commit 872f486259ae0bc6b73ca4735a15d013241f73e9 ]
shost->eh_noresume is currently consulted twice in one error handling
iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host().
That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running.
The problem flow looks like this:
PM path
ufshcd_set_dev_pwr_mode()
shost->eh_noresume = 1
ufshcd_execute_start_stop <-- trigger EH
...
shost->eh_noresume = 0EH path
scsi_error_handler()
if (!shost->eh_noresume)
scsi_autopm_get_host() <-- skipped
...
if (!shost->eh_noresume)
scsi_autopm_put_host() <-- executed laterIn that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow.
Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions.
--- drivers/scsi/scsi_error.c | 6 ++++-- drivers/ufs/core/ufshcd.c | 4 ++-- include/scsi/scsi_host.h | 6 +++--- 3 files changed, 9 insertions(+), 7 deletions(-)
drivers/scsi/scsi_error.c +4 -2
@@ -2362,6 +2362,7 @@ static void scsi_unjam_host(struct Scsi_Host *shost)int scsi_error_handler (void *data) {struct Scsi_Host *shost = data; +bool eh_noresume;/* * We use TASK_INTERRUPTIBLE so that the thread is not
@@ -2403,7 +2404,8 @@ int scsi_error_handler(void *data)* what we need to do to get it up and online again (if we can). * If we fail, we end up taking the thing offline. */ -if (!shost->eh_noresume &&scsi_autopm_get_host (shost) !=0 ) { + eh_noresume =READ_ONCE (shost->eh_noresume); +if (!eh_noresume &&scsi_autopm_get_host (shost) !=0 ) { SCSI_LOG_ERROR_RECOVERY(1, shost_printk(KERN_ERR, shost, "scsi_eh_%d: unable to autoresume\n",
@@ -2427,7 +2429,7 @@ int scsi_error_handler(void *data)* which are still online. */ scsi_restart_operations (shost); -if (!shost->eh_noresume) +if (!eh_noresume)scsi_autopm_put_host (shost); }__set_current_state (TASK_RUNNING );
drivers/ufs/core/ufshcd.c +2 -2
@@ -9985,7 +9985,7 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba,* we are functional while we are here, skip host resume in error * handling context. */ - hba->host->eh_noresume =1 ; +WRITE_ONCE (hba->host->eh_noresume,1 );/* * Current function would be generally called from the power management
@@ -10007,7 +10007,7 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba, }scsi_device_put (sdp); - hba->host->eh_noresume =0 ; +WRITE_ONCE (hba->host->eh_noresume,0 );return ret; }
include/scsi/scsi_host.h +3 -3
@@ -664,6 +664,9 @@ struct Scsi_Host {/* Asynchronous scan in progress */ bool async_scan __guarded_by(&scan_mutex); +/* Don't resume host in EH */ +bool eh_noresume; + unsigned active_mode:2;/*
@@ -682,9 +685,6 @@ struct Scsi_Host {/* Task mgmt function in progress */ unsigned tmf_in_progress:1; -/* Don't resume host in EH */ - unsigned eh_noresume:1; -/* The controller does not support WRITE SAME */ unsigned no_write_same:1;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 177/228 perf: Reject exited events as group leaders
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <[email protected]>
[ Upstream commit fa091f46c3833fb22384f10eade2b4e1e1d0b278 ]
perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perf_event_open() currently accepts that event as a group leader because its early validation rejects only REVOKED and DEAD events.
A new sibling can consequently be linked to the detached leader. When the leader is closed, perf_group_detach() observes that its PERF_ATTACH_GROUP bit is already clear and skips the new sibling. The sibling then retains a group_leader pointer to the freed event.
Reject group leaders in the EXIT state. Perform the check while holding the shared context mutex so that an exec in the target task cannot detach the leader between validation and group attachment.
--- kernel/events/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/events/core.c +7 -1
@@ -13942,7 +13942,7 @@ SYSCALL_DEFINE5(perf_event_open, goto err_fd; } group_leader =fd_file (group)->private_data; -if (group_leader->state <=PERF_EVENT_STATE_REVOKED ) { +if (group_leader->state <=PERF_EVENT_STATE_EXIT ) { err = -ENODEV ; goto err_fd; }
@@ -14073,6 +14073,12 @@ SYSCALL_DEFINE5(perf_event_open,if (group_leader->ctx != ctx) goto err_locked; +/* Recheck under ctx::mutex to serialize against remove-on-exec. */ +if (group_leader->state <=PERF_EVENT_STATE_EXIT ) { + err = -ENODEV ; + goto err_locked; + } +/* * Only a group leader can be exclusive or pinned */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 178/228 sctp: validate cookie AUTH state before use
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <[email protected]>
[ Upstream commit 3dbb44d88b1e94dd31fe43588af7437b34b44d56 ]
When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays.
A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain.
Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.
--- include/net/sctp/auth.h | 3 ++ net/sctp/auth.c | 75 ++++++++++++++++++++++++++++++++++++++++ net/sctp/sm_make_chunk.c | 3 ++ 3 files changed, 81 insertions(+)
include/net/sctp/auth.h +3 -0
@@ -22,6 +22,7 @@ struct sctp_endpoint;struct sctp_association ;struct sctp_authkey ;struct sctp_hmacalgo ; +struct sctp_cookie ;/* Defines an HMAC algorithm supported by SCTP chunk authentication */ struct sctp_hmac {
@@ -72,6 +73,8 @@ struct sctp_shared_key *sctp_auth_get_shkey(int sctp_auth_asoc_copy_shkeys (const struct sctp_endpoint *ep,struct sctp_association *asoc,gfp_t gfp); +bool sctp_auth_verify_cookie_params (const struct sctp_endpoint *ep, +const struct sctp_cookie *cookie);const struct sctp_hmac *sctp_auth_get_hmac (__u16 hmac_id);const struct sctp_hmac *sctp_auth_asoc_get_hmac (const struct sctp_association *asoc);
net/sctp/auth.c +75 -0
81 lines not on this page · raw message
net/sctp/sm_make_chunk.c +3 -0
@@ -1852,6 +1852,9 @@ struct sctp_association *sctp_unpack_cookie(/* Set up our peer's port number. */ retval->peer.port =ntohs (chunk->sctp_hdr->source); +if (!sctp_auth_verify_cookie_params (ep, bear_cookie)) + goto malformed; +/* Populate the association from the cookie. */ memcpy (&retval->c, bear_cookie,sizeof (*bear_cookie));
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 179/228 ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 885c22d259c8b245c479f3e19e9eeee54dee8b24 ]
The recent "sticky mixer" sanity check in USB-audio driver caused a regression on SteelSeries Arctis Nova 5 (1038:2232); because the firmware doesn't handle GET_CUR requests, some mixers are effectively disabled, leading to the too low / soft volumes:
usb 5-1.1: 9:0: sticky mixer values (-19712/0/256 => 0), disabling usb 5-1.1: 10:0: sticky mixer values (-21248/0/256 => 0), disabling
Restore the functionality by ignoring GET_CUR errors intentionally with MIXER_GET_CUR_BROKEN quirk.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2356,6 +2356,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),DEVICE_FLG (0x1038 ,0x1294 ,/* SteelSeries Arctis Pro Wireless */ QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE ), +DEVICE_FLG (0x1038 ,0x2232 ,/* SteelSeries Arctis Nova 5 */ +QUIRK_FLAG_MIXER_GET_CUR_BROKEN ),DEVICE_FLG (0x1101 ,0x0003 ,/* Audioengine D1 */ QUIRK_FLAG_GET_SAMPLE_RATE ), DEVICE_FLG(0x12d1, 0x3a07, /* HUAWEI USB-C HEADSET */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 180/228 riscv: lib: Fix ZBB strnlen reading past count boundary
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
[ Upstream commit 5d588c684833e678a0008eb69c33190f01a65f4b ]
The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG // advance
orc.b t1, t1
bgeu t0, t4, 4f // boundary check AFTER loadwhere t4 = (s + count) & -SZREG. When s is aligned and count is a multiple of SZREG, t4 equals s + count and the loop loads a full word starting at exactly s + count. If s + count falls on a page boundary with the next page unmapped, this faults.
Fix by computing the aligned boundary from the last valid byte (s + count - 1) instead of s + count. This makes the loop stop at the word containing the last valid byte rather than potentially loading the word after it. The count == 0 case is already handled by the beqz early exit.
Also add a pre-loop guard (bgeu t0, t4) for the case where all valid bytes fit within the first word. With the adjusted boundary, t4 can equal t0, and entering the loop with stale register state from the first-word processing would produce incorrect results.
The final minu clamp ensures the result is still correct when the last loaded word extends past s + count - 1 within the same aligned word.
--- arch/riscv/lib/strnlen.S | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/riscv/lib/strnlen.S +9 -1
@@ -83,8 +83,13 @@ strnlen_zbb: sub t3, t3, t2 slli t2, t2, 3 - /* Aligned boundary. */ + /* + * Aligned boundary. Use the address of the last valid byte + * (s + count - 1) to avoid loading a word past the count + * boundary in the loop below. count == 0 is handled above. + */ add t4, a0, a1 + addi t4, t4, -1 andi t4, t4, -SZREG /* Get the first word. */
@@ -120,6 +125,9 @@ strnlen_zbb: bgtu t3, a0, 2f + /* All remaining bytes are in the first word, no loop needed. */ + bgeu t0, t4, 2f + /* Prepare for the word comparison loop. */ addi t2, t0, SZREG li t3, -1
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 181/228 ovpn: run deferred work on a module-owned workqueue
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit e9714db8041763f59dde152c812b96b3de05c6d9 ]
ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point that guarantees the callbacks have fully returned before the module text can be freed.
Object references protect the objects used by the callbacks, but they do not prove that a workqueue function has returned. In particular, a worker can drop the final reference that unblocks device teardown while it is still executing ovpn code.
Add a module-owned workqueue and queue all ovpn work items on it. During module exit, unregister rtnl and netlink first, flush the workqueue so ordinary ovpn workers finish, run the final RCU barrier, and destroy the workqueue last. This keeps the workqueue available for cleanup work queued from RCU callbacks, while ensuring no ovpn work item can outlive the module text.
The per-device delayed keepalive work remains explicitly disabled during netdev teardown (disable_delayed_work_sync in ndo_uninit), since flush_workqueue does not flush delayed work that is still only pending on its timer.
--- drivers/net/ovpn/main.c | 19 ++++++++++++++++++- drivers/net/ovpn/ovpnpriv.h | 4 ++++ drivers/net/ovpn/peer.c | 8 ++++---- drivers/net/ovpn/tcp.c | 9 ++++----- 4 files changed, 30 insertions(+), 10 deletions(-)
drivers/net/ovpn/main.c +18 -1
@@ -12,6 +12,7 @@#include <linux/module.h> #include <linux/netdevice.h> #include <linux/inetdevice.h> +#include <linux/workqueue.h> #include <net/gro_cells.h> #include <net/ip.h> #include <net/rtnetlink.h>
@@ -26,6 +27,9 @@#include "tcp.h" #include "udp.h" +/* module-owned workqueue on which all ovpn-specific work is queued */ +struct workqueue_struct *ovpn_wq; +static void ovpn_priv_free (struct net_device *net) {struct ovpn_priv *ovpn =netdev_priv (net);
@@ -264,10 +268,16 @@ static int __init ovpn_init(void)ovpn_tcp_init (); + ovpn_wq =alloc_workqueue ("ovpn" ,WQ_PERCPU ,0 ); +if (!ovpn_wq) { +pr_err ("ovpn: cannot allocate workqueue\n" ); +return -ENOMEM ; + } + err =rtnl_link_register (&ovpn_link_ops);if (err) {pr_err ("ovpn: can't register rtnl link ops: %d\n" , err); -return err; + goto destroy_wq; } err =ovpn_nl_register ();
@@ -280,6 +290,9 @@ static int __init ovpn_init(void) unreg_rtnl:rtnl_link_unregister (&ovpn_link_ops); +destroy_wq: +destroy_workqueue (ovpn_wq); + ovpn_wq =NULL ;return err; }
@@ -288,7 +301,11 @@ static __exit void ovpn_cleanup(void)ovpn_nl_unregister ();rtnl_link_unregister (&ovpn_link_ops); +flush_workqueue (ovpn_wq);rcu_barrier (); + +destroy_workqueue (ovpn_wq); + ovpn_wq =NULL ; }module_init (ovpn_init);
drivers/net/ovpn/ovpnpriv.h +4 -0
@@ -15,6 +15,10 @@#include <uapi/linux/if_link.h> #include <uapi/linux/ovpn.h> +struct workqueue_struct ; + +extern struct workqueue_struct *ovpn_wq; +/** * struct ovpn_peer_collection - container of peers for MultiPeer mode * @by_id: table of peers index by ID
drivers/net/ovpn/peer.c +4 -4
@@ -62,7 +62,7 @@ void ovpn_peer_keepalive_set(struct ovpn_peer *peer, u32 interval, u32 timeout)/* now that interval and timeout have been changed, kick * off the worker so that the next delay can be recomputed */ -mod_delayed_work (system_percpu_wq, &peer->ovpn->keepalive_work,0 ); +mod_delayed_work (ovpn_wq, &peer->ovpn->keepalive_work,0 ); }/**
@@ -1371,7 +1371,7 @@ static time64_t ovpn_peer_keepalive_work_single(struct ovpn_peer *peer, peer->id);if (WARN_ON (!ovpn_peer_hold (peer)))return 0 ; -if (!schedule_work (&peer->keepalive_work)) +if (!queue_work (ovpn_wq, &peer->keepalive_work))ovpn_peer_put (peer); }
@@ -1463,8 +1463,8 @@ void ovpn_peer_keepalive_work(struct work_struct *work)netdev_dbg (ovpn->dev,"scheduling keepalive work: now=%llu next_run=%llu delta=%llu\n" , next_run, now, next_run - now); -schedule_delayed_work (&ovpn->keepalive_work, - (next_run - now) *HZ ); +queue_delayed_work (ovpn_wq, &ovpn->keepalive_work, + (next_run - now) *HZ ); }unlock_ovpn (ovpn, &release_list); }
drivers/net/ovpn/tcp.c +4 -5
@@ -151,7 +151,7 @@ static void ovpn_tcp_rcv(struct strparser *strp, struct sk_buff *skb)/* take reference for deferred peer deletion. should never fail */ if (WARN_ON (!ovpn_peer_hold (peer))) goto err_nopeer; -if (!schedule_work (&peer->tcp.defer_del_work)) +if (!queue_work (ovpn_wq, &peer->tcp.defer_del_work))ovpn_peer_put (peer);ovpn_dev_dstats_rx_dropped (peer->ovpn->dev); err_nopeer:
@@ -284,13 +284,12 @@ static void ovpn_tcp_send_sock(struct ovpn_peer *peer, struct sock *sk)* stream therefore we abort the connection */ ovpn_peer_hold (peer); -if (!schedule_work (&peer->tcp.defer_del_work)) +if (!queue_work (ovpn_wq, &peer->tcp.defer_del_work))ovpn_peer_put (peer);/* we bail out immediately and keep tx_in_progress set * to true. This way we prevent more TX attempts -* which would lead to more invocations of -* schedule_work() +* which would lead to more invocations of queue_work() */ return ; }
@@ -487,7 +486,7 @@ static void ovpn_tcp_write_space(struct sock *sk)rcu_read_lock (); sock =rcu_dereference_sk_user_data (sk);if (likely (sock && sock->peer)) { -schedule_work (&sock->tcp_tx_work); +queue_work (ovpn_wq, &sock->tcp_tx_work); sock->peer->tcp.sk_cb.sk_write_space (sk); }rcu_read_unlock ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 182/228 ovpn: defer key slot crypto freeing to workqueue
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Lici <[email protected]>
[ Upstream commit 2da3dfa1ddfe55a065f484750c83660e3bd4ac00 ]
Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: crypto_free_aead can sleep, for example when an async or hardware implementation has teardown work to complete.
Use queue_rcu_work for key-slot release. This keeps the RCU grace period needed by lockless key-slot readers, but runs the actual crypto teardown from workqueue context where sleeping is allowed. Once the rcu_work callback runs, pre-existing RCU readers are gone, and the final kref put already proves that no transform user remains, so the worker can release the AEAD transforms and free the slot directly.
The previous patch drains ovpn_wq during module exit, so queued key-slot teardown work cannot outlive module text.
--- drivers/net/ovpn/crypto.c | 10 +--------- drivers/net/ovpn/crypto.h | 4 +++- drivers/net/ovpn/crypto_aead.c | 19 ++++++++++++++----- drivers/net/ovpn/crypto_aead.h | 1 - 4 files changed, 18 insertions(+), 16 deletions(-)
drivers/net/ovpn/crypto.c +1 -9
@@ -18,20 +18,12 @@#include "crypto_aead.h" #include "crypto.h" -static void ovpn_ks_destroy_rcu (struct rcu_head *head) -{ -struct ovpn_crypto_key_slot *ks; - - ks = container_of(head, struct ovpn_crypto_key_slot, rcu); -ovpn_aead_crypto_key_slot_destroy (ks); -} -void ovpn_crypto_key_slot_release (struct kref *kref) {struct ovpn_crypto_key_slot *ks; ks = container_of(kref, struct ovpn_crypto_key_slot, refcount); -call_rcu (&ks->rcu, ovpn_ks_destroy_rcu); +queue_rcu_work (ovpn_wq, &ks->free_work); }/* can only be invoked when all peer references have been dropped (i.e. RCU
drivers/net/ovpn/crypto.h +3 -1
@@ -10,6 +10,8 @@#ifndef _NET_OVPN_OVPNCRYPTO_H_#define _NET_OVPN_OVPNCRYPTO_H_ +#include <linux/workqueue.h> +#include "pktid.h" #include "proto.h"
@@ -45,8 +47,8 @@ struct ovpn_crypto_key_slot {struct ovpn_pktid_recv pid_recv____cacheline_aligned_in_smp ;struct ovpn_pktid_xmit pid_xmit____cacheline_aligned_in_smp ; +struct rcu_work free_work;struct kref refcount; -struct rcu_head rcu; };struct ovpn_crypto_state {
drivers/net/ovpn/crypto_aead.c +14 -5
@@ -9,6 +9,7 @@#include <crypto/aead.h> #include <linux/skbuff.h> +#include <linux/workqueue.h> #include <net/ip.h> #include <net/ipv6.h> #include <net/udp.h>
@@ -380,13 +381,19 @@ static struct crypto_aead *ovpn_aead_init(const char *title,return ERR_PTR (ret); } -void ovpn_aead_crypto_key_slot_destroy (struct ovpn_crypto_key_slot *ks) +static void ovpn_aead_crypto_key_slot_free (struct ovpn_crypto_key_slot *ks) { -if (!ks) -return ; -crypto_free_aead (ks->encrypt);crypto_free_aead (ks->decrypt); +} + +static void ovpn_aead_crypto_key_slot_free_work (struct work_struct *work) +{ +struct ovpn_crypto_key_slot *ks; + + ks = container_of(to_rcu_work(work), struct ovpn_crypto_key_slot, + free_work); +ovpn_aead_crypto_key_slot_free (ks);kfree (ks); }
@@ -420,6 +427,7 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc) ks->encrypt =NULL ; ks->decrypt =NULL ; +INIT_RCU_WORK (&ks->free_work, ovpn_aead_crypto_key_slot_free_work);kref_init (&ks->refcount); ks->key_id = kc->key_id;
@@ -453,7 +461,8 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc)return ks; destroy_ks: -ovpn_aead_crypto_key_slot_destroy (ks); +ovpn_aead_crypto_key_slot_free (ks); +kfree (ks);return ERR_PTR (ret); }
drivers/net/ovpn/crypto_aead.h +0 -1
@@ -22,7 +22,6 @@ int ovpn_aead_decrypt(struct ovpn_peer *peer, struct ovpn_crypto_key_slot *ks,struct ovpn_crypto_key_slot *ovpn_aead_crypto_key_slot_new (const struct ovpn_key_config *kc); -void ovpn_aead_crypto_key_slot_destroy (struct ovpn_crypto_key_slot *ks);enum ovpn_cipher_alg ovpn_aead_crypto_alg (struct ovpn_crypto_key_slot *ks);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 183/228 rseq: Prevent hard lockup on granted time slice extension
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niels Pressel <[email protected]>
[ Upstream commit ada54c2ba652348c590d1ace6a2f4ff77cbbf809 ]
__exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled. If the extension is granted it invokes hrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer rearm is handled before exiting to user space.
Though this invokes __hrtimer_rearm_deferred() which expects to be invoked with interrupts disabled as it takes hrtimer_cpu_base::lock with raw_spin_lock(). That's a livelock waiting to happen and caught by lockdep:
WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test
WARNING: inconsistent lock state
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.Prevent this by disabling interrupts around the invocation of hrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension().
[ tglx: Massaged change log ]
--- include/linux/rseq_entry.h | 1 + 1 file changed, 1 insertion(+)
include/linux/rseq_entry.h +1 -0
@@ -233,6 +233,7 @@ static __always_inline bool __rseq_grant_slice_extension(bool work_pending) static __always_inline bool rseq_grant_slice_extension(unsigned long ti_work, unsigned long mask) {if (unlikely (__rseq_grant_slice_extension (ti_work & mask))) { +guard (irq)();hrtimer_rearm_deferred_tif (ti_work);return true; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 184/228 gpio: ml-ioh: share the register lock across channels
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <[email protected]>
[ Upstream commit a9253ee6771c8ab3c6de07ea75d9e2c1cef3cd97 ]
Suspend and resume hold channel 0's lock while saving and restoring registers for all eight channels. Code paths using the other seven locks can therefore run concurrently with PM.
Use one controller-wide lock shared by all channels.
--- drivers/gpio/gpio-ml-ioh.c | 69 ++++++++++++++++++++------------------ 1 file changed, 37 insertions(+), 32 deletions(-)
drivers/gpio/gpio-ml-ioh.c +37 -32
@@ -73,7 +73,7 @@ struct ioh_gpio_reg_data {* @gpio_use_sel: Save GPIO_USE_SEL1~4 register for PM * @ch: Indicate GPIO channel * @irq_base: Save base of IRQ number for interrupt -* @spinlock: Used for register access protection +* @spinlock: Shared register access lock */ struct ioh_gpio {void __iomem *base;
@@ -84,7 +84,12 @@ struct ioh_gpio {u32 gpio_use_sel;int ch;int irq_base; +raw_spinlock_t *spinlock; +}; + +struct ioh_gpio_device {raw_spinlock_t spinlock; +struct ioh_gpio chip[8 ]; };static const int num_ports[] = {6 ,12 ,16 ,16 ,15 ,16 ,16 ,12 };
@@ -95,7 +100,7 @@ static int ioh_gpio_set(struct gpio_chip *gpio, unsigned int nr, int val)struct ioh_gpio *chip =gpiochip_get_data (gpio);unsigned long flags; -raw_spin_lock_irqsave (&chip->spinlock, flags); +raw_spin_lock_irqsave (chip->spinlock, flags); reg_val =ioread32 (&chip->reg->regs[chip->ch].po);if (val) reg_val |=BIT (nr);
@@ -103,7 +108,7 @@ static int ioh_gpio_set(struct gpio_chip *gpio, unsigned int nr, int val) reg_val &= ~BIT (nr);iowrite32 (reg_val, &chip->reg->regs[chip->ch].po); -raw_spin_unlock_irqrestore (&chip->spinlock, flags); +raw_spin_unlock_irqrestore (chip->spinlock, flags);return 0 ; }
@@ -123,7 +128,7 @@ static int ioh_gpio_direction_output(struct gpio_chip *gpio, unsigned nr,u32 reg_val;unsigned long flags; -raw_spin_lock_irqsave (&chip->spinlock, flags); +raw_spin_lock_irqsave (chip->spinlock, flags); pm =ioread32 (&chip->reg->regs[chip->ch].pm); pm &=BIT (num_ports[chip->ch]) -1 ; pm |=BIT (nr);
@@ -136,7 +141,7 @@ static int ioh_gpio_direction_output(struct gpio_chip *gpio, unsigned nr, reg_val &= ~BIT (nr);iowrite32 (reg_val, &chip->reg->regs[chip->ch].po); -raw_spin_unlock_irqrestore (&chip->spinlock, flags); +raw_spin_unlock_irqrestore (chip->spinlock, flags);return 0 ; }
@@ -147,12 +152,12 @@ static int ioh_gpio_direction_input(struct gpio_chip *gpio, unsigned nr)u32 pm;unsigned long flags; -raw_spin_lock_irqsave (&chip->spinlock, flags); +raw_spin_lock_irqsave (chip->spinlock, flags); pm =ioread32 (&chip->reg->regs[chip->ch].pm); pm &=BIT (num_ports[chip->ch]) -1 ; pm &= ~BIT (nr);iowrite32 (pm, &chip->reg->regs[chip->ch].pm); -raw_spin_unlock_irqrestore (&chip->spinlock, flags); +raw_spin_unlock_irqrestore (chip->spinlock, flags);return 0 ; }
@@ -256,7 +261,7 @@ static int ioh_irq_type(struct irq_data *d, unsigned int type)dev_dbg (chip->dev,"%s:irq=%d type=%d ch=%d pos=%d type=%d\n" , __func__, irq, type, ch, im_pos, type); -raw_spin_lock_irqsave (&chip->spinlock, flags); +raw_spin_lock_irqsave (chip->spinlock, flags);switch (type) {case IRQ_TYPE_EDGE_RISING :
@@ -296,7 +301,7 @@ static int ioh_irq_type(struct irq_data *d, unsigned int type) ien =ioread32 (&chip->reg->regs[chip->ch].ien);iowrite32 (ien |BIT (ch), &chip->reg->regs[chip->ch].ien); end: -raw_spin_unlock_irqrestore (&chip->spinlock, flags); +raw_spin_unlock_irqrestore (chip->spinlock, flags);return 0 ; }
@@ -326,11 +331,11 @@ static void ioh_irq_disable(struct irq_data *d)unsigned long flags;u32 ien; -raw_spin_lock_irqsave (&chip->spinlock, flags); +raw_spin_lock_irqsave (chip->spinlock, flags); ien =ioread32 (&chip->reg->regs[chip->ch].ien); ien &= ~BIT (d->irq - chip->irq_base);iowrite32 (ien, &chip->reg->regs[chip->ch].ien); -raw_spin_unlock_irqrestore (&chip->spinlock, flags); +raw_spin_unlock_irqrestore (chip->spinlock, flags); }static void ioh_irq_enable (struct irq_data *d)
@@ -340,11 +345,11 @@ static void ioh_irq_enable(struct irq_data *d)unsigned long flags;u32 ien; -raw_spin_lock_irqsave (&chip->spinlock, flags); +raw_spin_lock_irqsave (chip->spinlock, flags); ien =ioread32 (&chip->reg->regs[chip->ch].ien); ien |=BIT (d->irq - chip->irq_base);iowrite32 (ien, &chip->reg->regs[chip->ch].ien); -raw_spin_unlock_irqrestore (&chip->spinlock, flags); +raw_spin_unlock_irqrestore (chip->spinlock, flags); }static irqreturn_t ioh_gpio_handler (int irq,void *dev_id)
@@ -407,8 +412,8 @@ static int ioh_gpio_probe(struct pci_dev *pdev,int ret;int i, j;struct ioh_gpio *chip; +struct ioh_gpio_device *priv;void __iomem *base; -void *chip_save;int irq_base; ret =pcim_enable_device (pdev);
@@ -429,18 +434,18 @@ static int ioh_gpio_probe(struct pci_dev *pdev,return -ENOMEM ; } - chip_save =devm_kcalloc (dev,8 ,sizeof (*chip),GFP_KERNEL ); -if (chip_save ==NULL ) { + priv =devm_kzalloc (dev,sizeof (*priv),GFP_KERNEL ); +if (!priv)return -ENOMEM ; - } - chip = chip_save; +raw_spin_lock_init (&priv->spinlock); + chip = priv->chip;for (i =0 ; i <8 ; i++, chip++) { chip->dev = dev; chip->base = base; chip->reg = chip->base; chip->ch = i; -raw_spin_lock_init (&chip->spinlock); + chip->spinlock = &priv->spinlock;ioh_gpio_setup (chip, num_ports[i]); ret =devm_gpiochip_add_data (dev, &chip->gpio, chip);if (ret) {
@@ -449,7 +454,7 @@ static int ioh_gpio_probe(struct pci_dev *pdev, } } - chip = chip_save; + chip = priv->chip;for (j =0 ; j <8 ; j++, chip++) { irq_base =devm_irq_alloc_descs (dev,-1 ,IOH_IRQ_BASE , num_ports[j],NUMA_NO_NODE );
@@ -466,7 +471,7 @@ static int ioh_gpio_probe(struct pci_dev *pdev,return ret; } - chip = chip_save; + chip = priv->chip; ret =devm_request_irq (dev, pdev->irq, ioh_gpio_handler,IRQF_SHARED ,KBUILD_MODNAME , chip);if (ret !=0 ) {
@@ -474,33 +479,33 @@ static int ioh_gpio_probe(struct pci_dev *pdev,return ret; } -pci_set_drvdata (pdev, chip); +pci_set_drvdata (pdev, priv);return 0 ; }static int ioh_gpio_suspend (struct device *dev) { -struct ioh_gpio *chip =dev_get_drvdata (dev); +struct ioh_gpio_device *priv =dev_get_drvdata (dev);unsigned long flags; -raw_spin_lock_irqsave (&chip->spinlock, flags); -ioh_gpio_save_reg_conf (chip); -raw_spin_unlock_irqrestore (&chip->spinlock, flags); +raw_spin_lock_irqsave (&priv->spinlock, flags); +ioh_gpio_save_reg_conf (priv->chip); +raw_spin_unlock_irqrestore (&priv->spinlock, flags);return 0 ; }static int ioh_gpio_resume (struct device *dev) { -struct ioh_gpio *chip =dev_get_drvdata (dev); +struct ioh_gpio_device *priv =dev_get_drvdata (dev);unsigned long flags; -raw_spin_lock_irqsave (&chip->spinlock, flags); -iowrite32 (0x01 , &chip->reg->srst); -iowrite32 (0x00 , &chip->reg->srst); -ioh_gpio_restore_reg_conf (chip); -raw_spin_unlock_irqrestore (&chip->spinlock, flags); +raw_spin_lock_irqsave (&priv->spinlock, flags); +iowrite32 (0x01 , &priv->chip->reg->srst); +iowrite32 (0x00 , &priv->chip->reg->srst); +ioh_gpio_restore_reg_conf (priv->chip); +raw_spin_unlock_irqrestore (&priv->spinlock, flags);return 0 ; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 185/228 ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <[email protected]>
[ Upstream commit 566fec6a33075a0ea5c441c26571221f17f4ed98 ]
Remove invalid goto exit paths that jump across guard(mutex) cleanup variable initialization, replace them with direct kfree(src) and return, to fix the s390 clang build error in acoustic_ctl_write().
--- sound/soc/codecs/tas2781-i2c.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
sound/soc/codecs/tas2781-i2c.c +9 -9
@@ -1542,8 +1542,8 @@ static ssize_t acoustic_ctl_write(struct file *file,if (src[0 ] > max_pkg_len && src[0 ] != count) {dev_err (priv->dev,"pkg(%u), max(%u), count(%u) mismatch.\n" , src[0 ], max_pkg_len, (unsigned int )count); - ret =0 ; - goto exit; +kfree (src); +return 0 ; }switch (src[1 ]) {
@@ -1557,14 +1557,14 @@ static ssize_t acoustic_ctl_write(struct file *file,break ;default :dev_err (priv->dev,"%s Wrong code %02x.\n" , __func__, src[1 ]); - ret =0 ; - goto exit; +kfree (src); +return 0 ; }if (len <1 ) {dev_err (priv->dev,"pkg fmt invalid %02x.\n" , len); - ret =0 ; - goto exit; +kfree (src); +return 0 ; }for (j =0 ; j < priv->ndev; j++)
@@ -1574,8 +1574,8 @@ static ssize_t acoustic_ctl_write(struct file *file, }if (j >= priv->ndev) {dev_err (priv->dev,"no such device 0x%02x.\n" , src[2 ]); - ret =0 ; - goto exit; +kfree (src); +return 0 ; } reg =TASDEVICE_REG (src[3 ], src[4 ], src[5 ]);
@@ -1606,7 +1606,7 @@ static ssize_t acoustic_ctl_write(struct file *file,dev_err (priv->dev,"i2c communication error.\n" ); else ret = count; -exit: +kfree (src);return ret; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 186/228 tick: Include ktime.h and jiffies.h in linux/tick.h
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karl Mehltretter <[email protected]>
[ Upstream commit 45f8dffc0714c3ef49c83e5bba4c56a4499bd5fc ]
The !CONFIG_NO_HZ_COMMON stubs use ktime_add(), ktime_get() and TICK_NSEC, but tick.h includes neither <linux/ktime.h> nor <linux/jiffies.h>. Most configurations build only because those declarations arrive transitively.
Commit 6440966067dc ("cpuset: Remove cpuset_cpu_is_isolated()") removed <linux/cpuset.h> from <linux/sched/isolation.h>. The <linux/cpuset.h> include chain had been satisfying these declarations before <linux/tick.h> was parsed. Commit 8aa76aa41589 ("ring-buffer: Use a housekeeping CPU to wake up waiters") then added <linux/sched/isolation.h> to ring_buffer.c ahead of any header which provides them. Neither change is wrong on its
own: the failure requires both and appeared in v7.0.
ARM rpc_defconfig + CONFIG_FUNCTION_TRACER fails to build:
$ make ARCH=arm rpc_defconfig
$ ./scripts/config -e FTRACE -e FUNCTION_TRACER
$ make ARCH=arm olddefconfig
$ make ARCH=arm kernel/trace/ring_buffer.o
In file included from include/linux/sched/isolation.h:6,
from kernel/trace/ring_buffer.c:8:
include/linux/tick.h: In function 'tick_nohz_get_next_hrtimer':
include/linux/tick.h:156:9: error: implicit declaration of function
'ktime_add'; did you mean 'size_add'?
include/linux/tick.h:156:19: error: implicit declaration of function
'ktime_get'; did you mean 'time_init'?
include/linux/tick.h:156:32: error: 'TICK_NSEC' undeclaredInclude the headers the file actually uses.
--- include/linux/tick.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/tick.h +2 -0
@@ -7,6 +7,8 @@#include <linux/clockchips.h> #include <linux/irqflags.h> +#include <linux/jiffies.h> +#include <linux/ktime.h> #include <linux/percpu.h> #include <linux/context_tracking_state.h> #include <linux/cpumask.h>
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 187/228 netfilter: ipset: fix refcount race between list:set GC and swap
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <[email protected]>
[ Upstream commit 0c88868271653537ed443272dd8e7d13634d214b ]
__ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set->ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets' ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -> ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets.
Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap() already does, keeping the refcount tied to the index rather than to a stale set pointer.
kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870) Call Trace: <IRQ> list_set_del (net/netfilter/ipset/ip_set_list_set.c:159) set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181) list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578) call_timer_fn (kernel/time/timer.c:1748) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374) run_timer_softirq (kernel/time/timer.c:2405) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt
--- net/netfilter/ipset/ip_set_core.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
net/netfilter/ipset/ip_set_core.c +13 -6
@@ -679,11 +679,18 @@ __ip_set_get(struct ip_set *set) }static void -__ip_set_put (struct ip_set *set) +__ip_set_put_locked (struct ip_set *set) { -write_lock_bh (&ip_set_ref_lock); +lockdep_assert_held (&ip_set_ref_lock);BUG_ON (set->ref ==0 ); set->ref--; +} + +static void +__ip_set_put (struct ip_set *set) +{ +write_lock_bh (&ip_set_ref_lock); +__ip_set_put_locked (set);write_unlock_bh (&ip_set_ref_lock); }
@@ -854,11 +861,11 @@ __ip_set_put_byindex(struct ip_set_net *inst, ip_set_id_t index) {struct ip_set *set; -rcu_read_lock (); - set =rcu_dereference (inst->ip_set_list)[index]; +write_lock_bh (&ip_set_ref_lock); + set =ip_set (inst, index);if (set) -__ip_set_put (set); -rcu_read_unlock (); +__ip_set_put_locked (set); +write_unlock_bh (&ip_set_ref_lock); }void
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 188/228 ipvs: revalidate ihl to prevent out-of-bounds access
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <[email protected]>
[ Upstream commit d93660df4dd1d116f608ada4a29a80a5d6f0a6ed ]
While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access.
One such place reported by Sashiko is ip_vs_nat_icmp() where local process can change the ihl field and after skb_ensure_writable() we can see larger value which is a problem for the ip_send_check(cih) calls.
Add check to drop the packet if the ihl field is changed.
--- include/net/ip_vs.h | 2 +- net/netfilter/ipvs/ip_vs_core.c | 11 +++++++++-- net/netfilter/ipvs/ip_vs_xmit.c | 3 ++- 3 files changed, 12 insertions(+), 4 deletions(-)
include/net/ip_vs.h +1 -1
@@ -2046,7 +2046,7 @@ static inline bool ip_vs_conn_use_hash2(struct ip_vs_conn *cp) !(cp->flags &IP_VS_CONN_F_TEMPLATE ); } -void ip_vs_nat_icmp (struct sk_buff *skb,struct ip_vs_protocol *pp, +bool ip_vs_nat_icmp (struct sk_buff *skb,struct ip_vs_protocol *pp,struct ip_vs_conn *cp,int dir,unsigned int toff,bool has_ports,struct ip_vs_iphdr *ciph);
net/netfilter/ipvs/ip_vs_core.c +9 -2
@@ -923,7 +923,7 @@ static int ip_vs_route_me_harder(struct netns_ipvs *ipvs, int af,* Packet has been made sufficiently writable in caller * - inout: 1=in->out, 0=out->in */ -void ip_vs_nat_icmp (struct sk_buff *skb,struct ip_vs_protocol *pp, +bool ip_vs_nat_icmp (struct sk_buff *skb,struct ip_vs_protocol *pp,struct ip_vs_conn *cp,int inout,unsigned int toff,bool has_ports,struct ip_vs_iphdr *ciph) {
@@ -931,6 +931,11 @@ void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,struct icmphdr *icmph = (struct icmphdr *)(skb->data + toff);struct iphdr *cih = (struct iphdr *)(icmph +1 ); +/* Before now we may used ihl from skb frag, revalidate it after +* copying it into skb head to prevent out-of-bounds access +*/ +if (cih->ihl *4 != ciph->len - ciph->off) +return false;if (inout) { iph->saddr = cp->vaddr.ip;ip_send_check (iph);
@@ -964,6 +969,7 @@ void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,else IP_VS_DBG_PKT (11 ,AF_INET , pp, skb, ciph->off,"Forwarding altered incoming ICMP" ); +return true; }#ifdef CONFIG_IP_VS_IPV6
@@ -1055,7 +1061,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,ip_vs_nat_icmp_v6 (skb, pp, cp,1 , toff, has_ports, ciph); else#endif -ip_vs_nat_icmp (skb, pp, cp,1 , toff, has_ports, ciph); +if (!ip_vs_nat_icmp (skb, pp, cp,1 , toff, has_ports, ciph)) + goto out;if (ip_vs_route_me_harder (cp->ipvs, af, skb, hooknum)) goto out;
net/netfilter/ipvs/ip_vs_xmit.c +2 -1
@@ -1580,7 +1580,8 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,if (skb_cow (skb, rt->dst.dev->hard_header_len)) goto tx_error; -ip_vs_nat_icmp (skb, pp, cp,0 , toff, has_ports, ciph); +if (!ip_vs_nat_icmp (skb, pp, cp,0 , toff, has_ports, ciph)) + goto tx_error;/* Another hack: avoid icmp_send in ip_fragment */ skb->ignore_df =1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 189/228 netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Velichayshiy <[email protected]>
[ Upstream commit d02f592064347e0c1e0d84f24941ad338838cc48 ]
In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug.
Trace for example:nft_flow_offload_chain() // FLOW_BLOCK_BIND
nft_flow_block_chain()
nft_chain_offload_cmd()
nft_block_offload_cmd()
->ndo_setup_tc()
nsim_setup_tc()
flow_block_cb_setup_simple()
flow_block_cb_alloc() // fails to -ENOMEMThe warning was reproduced on the 5.10 stable kernel under memory pressure via fault injection, but the underlying bug exists in mainline as well, as demonstrated by the ENOMEM trace above. The following splat was triggered during nf_tables transaction processing:
WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Modules linked in: CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:nft_flow_rule_offload_abort net/netfilter/nf_tables_offload.c:532 [inline] RIP: 0010:nft_flow_rule_offload_commit+0x971/0xcd0 net/netfilter/nf_tables_offload.c:591 Call Trace: nf_tables_commit+0x3bd/0x4bd0 net/netfilter/nf_tables_api.c:8604 nfnetlink_rcv_batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:579 [inline] nfnetlink_rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x6cd/0xa00 net/netfilter/af_netlink.c:1340 netlink_sendmsg+0x906/0xe10 net/netfilter/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:651 [inline] __sock_sendmsg+0x155/0x190 net/socket.c:663 ____sys_sendmsg+0x705/0x870 net/socket.c:2379 ___sys_sendmsg+0x100/0x170 net/socket.c:2433 __sys_sendmsg+0xe9/0x1c0 net/socket.c:2462 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1
Change the condition to WARN_ON_ONCE(err && err != -ENOMEM) so that warnings are only emitted for unexpected errors. This aligns with the common kernel practice of not warning on -ENOMEM.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/netfilter/nf_tables_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_offload.c +1 -1
@@ -558,7 +558,7 @@ static void nft_flow_rule_offload_abort(struct net *net,break ; } -if (WARN_ON_ONCE (err)) +if (WARN_ON_ONCE (err && err != -ENOMEM ))break ; } }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 190/228 netfilter: flowtable: publish GC-visible tuple last
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <[email protected]>
[ Upstream commit 2014ac62df9d45bb9a004a043e85df7be09ed780 ]
nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
--- net/netfilter/nf_flow_table_core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/netfilter/nf_flow_table_core.c +4 -3
@@ -332,17 +332,18 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) flow->timeout = nf_flowtable_time_stamp +flow_offload_get_timeout (flow); err =rhashtable_insert_fast (&flow_table->rhashtable, - &flow->tuplehash[0 ].node, + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].node, nf_flow_offload_rhash_params);if (err <0 )return err; +/* GC only iterates original-direction entries; publish original last. */ err =rhashtable_insert_fast (&flow_table->rhashtable, - &flow->tuplehash[1 ].node, + &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL ].node, nf_flow_offload_rhash_params);if (err <0 ) {rhashtable_remove_fast (&flow_table->rhashtable, - &flow->tuplehash[0 ].node, + &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY ].node, nf_flow_offload_rhash_params);return err; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 191/228 netfilter: ipset: fix list type element drift bug
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 4cbd69766b35a089664cadb1f613bb85f7ef77a9 ]
If list_set_uadd() calls list_set_replace() to swap an expired entry, the element count remains the same, therefore the increment must be elided.
--- net/netfilter/ipset/ip_set_list_set.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netfilter/ipset/ip_set_list_set.c +5 -2
@@ -301,9 +301,12 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext, e->set = set;INIT_LIST_HEAD (&e->list);list_set_init_extensions (set, ext, e); -if (n) +if (n) {list_set_replace (set, e, n); -else if (next) +return 0 ; + } + +if (next)list_add_tail_rcu (&e->list, &next->list);else if (prev)list_add_rcu (&e->list, &prev->list);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 192/228 netfilter: ipset: let destroy callbacks adjust ext mem size
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 490937b88cb592cc0c5367758edd700fd5abd15c ]
For bitmap this change makes no difference, because destructors are called synchronously.
List type however calls them via call_rcu() so accounting decrement can happen after list_set_flush() set ext_size to 0.
'set->elements = 0' can be removed for the same reason in the list type case, it calls 'set->elements--' for each element.
--- net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/netfilter/ipset/ip_set_list_set.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
net/netfilter/ipset/ip_set_bitmap_gen.h +1 -1
@@ -77,7 +77,7 @@ mtype_flush(struct ip_set *set)mtype_ext_cleanup (set);bitmap_zero (map->members, map->elements); set->elements =0 ; -atomic64_set (&set->ext_size,0 ); +DEBUG_NET_WARN_ON_ONCE (atomic64_read (&set->ext_size) >0 ); }/* Calculate the actual memory size of the set data */
net/netfilter/ipset/ip_set_list_set.c +1 -2
@@ -423,8 +423,7 @@ list_set_flush(struct ip_set *set)list_for_each_entry_safe (e, n, &map->members, list)list_set_del (set, e); - set->elements =0 ; -atomic64_set (&set->ext_size,0 ); +DEBUG_NET_WARN_ON_ONCE (set->elements >0 ); } static void
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 193/228 eth: bnxt: cancel IRQ notifier before freeing affinity mask
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit c703f62c30f2db7f40ad575f0034636d8a401fac ]
bnxt_irq_affinity_notify() copies into irq->cpu_mask. Cancel the notifier before freeing irq->cpu_mask.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -2
@@ -11874,14 +11874,14 @@ static void bnxt_free_irq(struct bnxt *bp) irq = &bp->irq_tbl[map_idx];if (irq->requested) { +bnxt_release_irq_notifier (irq); +if (irq->have_cpumask) {irq_update_affinity_hint (irq->vector,NULL );free_cpumask_var (irq->cpu_mask); irq->have_cpumask =0 ; } -bnxt_release_irq_notifier (irq); -free_irq (irq->vector, bp->bnapi[i]); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 194/228 eth: bnxt: keep the aRFS rmap updated when TPH is enabled
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 4b5cb58a4443fff67aa18a0d7b645b2220f2fcf8 ]
The TPH support must have broken aRFS in bnxt. IRQ can only have one notifier, so installing the TPH notifier is overriding the one implicitly installed by irq_cpu_rmap_add().
Make sure we call cpu_rmap_update() from the TPH notifier.
We need to be careful with the ordering and not free the rmap until we unregistered the notifier. Note that moving the rmap freeing after the early return in bnxt_free_irq() is fine - there's no path that could leave rmap with irq_tbl being NULL.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +15 -4
@@ -11789,6 +11789,16 @@ static void bnxt_irq_affinity_notify(struct irq_affinity_notify *notify, irq = container_of(notify, struct bnxt_irq, affinity_notify); +#ifdef CONFIG_RFS_ACCEL +if (irq->bp->dev->rx_cpu_rmap && irq->ring_nr < irq->bp->rx_nr_rings) { + err =cpu_rmap_update (irq->bp->dev->rx_cpu_rmap, irq->ring_nr, + mask); +if (err) +netdev_warn (irq->bp->dev, +"aRFS rmap update failed: %d\n" , err); + } +#endif +if (!irq->bp->tph_mode)return ;
@@ -11862,10 +11872,6 @@ static void bnxt_free_irq(struct bnxt *bp)struct bnxt_irq *irq;int i; -#ifdef CONFIG_RFS_ACCEL -free_irq_cpu_rmap (bp->dev->rx_cpu_rmap); - bp->dev->rx_cpu_rmap =NULL ; -#endif if (!bp->irq_tbl || !bp->bnapi)return ;
@@ -11891,6 +11897,11 @@ static void bnxt_free_irq(struct bnxt *bp)/* Disable TPH support */ pcie_disable_tph (bp->pdev); bp->tph_mode =0 ; + +#ifdef CONFIG_RFS_ACCEL +free_irq_cpu_rmap (bp->dev->rx_cpu_rmap); + bp->dev->rx_cpu_rmap =NULL ; +#endif }static int bnxt_request_irq (struct bnxt *bp)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 195/228 eth: bnxt: decrease indent in bnxt_request_irq()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 0fd562c7b9e48e7958f7405e54bf98e8e22ad184 ]
bnxt_request_irq() has unnecessary level of indentation. Use continue instead. No need to re-fetch NUMA node for each IRQ, move to the function level.
No functional changes.
Stable-dep-of: 51e96fa31f7e ("eth: bnxt: avoid deadlock when canceling IRQ affinity notifier")
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 46 +++++++++++------------ 1 file changed, 23 insertions(+), 23 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +23 -23
@@ -11906,6 +11906,7 @@ static void bnxt_free_irq(struct bnxt *bp)static int bnxt_request_irq (struct bnxt *bp) { +const int numa_node =dev_to_node (&bp->pdev->dev);struct cpu_rmap *rmap =NULL ;int i, j, rc =0 ;unsigned long flags =0 ;
@@ -11928,6 +11929,7 @@ static int bnxt_request_irq(struct bnxt *bp)for (i =0 , j =0 ; i < bp->cp_nr_rings; i++) {int map_idx =bnxt_cp_num_to_irq_num (bp, i);struct bnxt_irq *irq = &bp->irq_tbl[map_idx]; +u16 tag;if (IS_ENABLED (CONFIG_RFS_ACCEL ) && rmap && bp->bnapi[i]->rx_ring) {
@@ -11946,33 +11948,31 @@ static int bnxt_request_irq(struct bnxt *bp)netif_napi_set_irq_locked (&bp->bnapi[i]->napi, irq->vector); irq->requested =1 ; -if (zalloc_cpumask_var (&irq->cpu_mask,GFP_KERNEL )) { -int numa_node =dev_to_node (&bp->pdev->dev); -u16 tag; +if (!zalloc_cpumask_var (&irq->cpu_mask,GFP_KERNEL )) +continue ; - irq->have_cpumask =1 ; - irq->msix_nr = map_idx; - irq->ring_nr = i; -cpumask_set_cpu (cpumask_local_spread (i, numa_node), - irq->cpu_mask); - rc =irq_update_affinity_hint (irq->vector, irq->cpu_mask); -if (rc) { -netdev_warn (bp->dev, -"Update affinity hint failed, IRQ = %d\n" , - irq->vector); -break ; - } + irq->have_cpumask =1 ; + irq->msix_nr = map_idx; + irq->ring_nr = i; +cpumask_set_cpu (cpumask_local_spread (i, numa_node), + irq->cpu_mask); + rc =irq_update_affinity_hint (irq->vector, irq->cpu_mask); +if (rc) { +netdev_warn (bp->dev, +"Update affinity hint failed, IRQ = %d\n" , + irq->vector); +break ; + } -bnxt_register_irq_notifier (bp, irq); +bnxt_register_irq_notifier (bp, irq); -/* Init ST table entry */ -if (pcie_tph_get_cpu_st (irq->bp->pdev,TPH_MEM_TYPE_VM , -cpumask_first (irq->cpu_mask), - &tag)) -continue ; +/* Init ST table entry */ +if (pcie_tph_get_cpu_st (irq->bp->pdev,TPH_MEM_TYPE_VM , +cpumask_first (irq->cpu_mask), + &tag)) +continue ; -pcie_tph_set_st_entry (irq->bp->pdev, irq->msix_nr, tag); - } +pcie_tph_set_st_entry (irq->bp->pdev, irq->msix_nr, tag); }return rc; }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 196/228 eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 51e96fa31f7e7eac2cba8f854e24d36600cc040b ]
Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock.
Move the restart to the async service task. The queue restart isn't super time sensitive. Store the new TPH tag, schedule the task. Safely canceling the service task is already ironed out.
In bnxt_request_irq() the order of registering notifier, affinity and initial TPH programming has to be inverted. I think it was racy previously since user may trigger an update as soon as notifier is installed.
There's a small known gap - if pcie_tph_get_cpu_st() fails at init and the target tag is 0 we may miss programming the entry. This does not seem worth fixing, the code has skip-on-failure all over the place, anyway.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 86 ++++++++++++++++------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 + 2 files changed, 64 insertions(+), 25 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +61 -25
@@ -11785,12 +11785,13 @@ static void bnxt_irq_affinity_notify(struct irq_affinity_notify *notify, {struct bnxt_irq *irq;u16 tag; -int err; irq = container_of(notify, struct bnxt_irq, affinity_notify);#ifdef CONFIG_RFS_ACCEL if (irq->bp->dev->rx_cpu_rmap && irq->ring_nr < irq->bp->rx_nr_rings) { +int err; + err =cpu_rmap_update (irq->bp->dev->rx_cpu_rmap, irq->ring_nr, mask);if (err)
@@ -11808,20 +11809,11 @@ static void bnxt_irq_affinity_notify(struct irq_affinity_notify *notify,return ;if (pcie_tph_get_cpu_st (irq->bp->pdev,TPH_MEM_TYPE_VM , -cpumask_first (irq->cpu_mask), &tag)) +cpumask_first (mask), &tag))return ; -if (pcie_tph_set_st_entry (irq->bp->pdev, irq->msix_nr, tag)) -return ; - -netdev_lock (irq->bp->dev); -if (netif_running (irq->bp->dev)) { - err =netdev_rx_queue_restart (irq->bp->dev, irq->ring_nr); -if (err) -netdev_err (irq->bp->dev, -"RX queue restart failed: err=%d\n" , err); - } -netdev_unlock (irq->bp->dev); +WRITE_ONCE (irq->new_tag, tag); +bnxt_queue_sp_work (irq->bp,BNXT_TPH_UPDATE_SP_EVENT ); }static void bnxt_irq_affinity_release (struct kref *ref)
@@ -11892,6 +11884,8 @@ static void bnxt_free_irq(struct bnxt *bp) } irq->requested =0 ; + irq->tag =0 ; + irq->new_tag =0 ; }/* Disable TPH support */
@@ -11929,6 +11923,7 @@ static int bnxt_request_irq(struct bnxt *bp)for (i =0 , j =0 ; i < bp->cp_nr_rings; i++) {int map_idx =bnxt_cp_num_to_irq_num (bp, i);struct bnxt_irq *irq = &bp->irq_tbl[map_idx]; +unsigned int cpu_num;u16 tag; if (IS_ENABLED(CONFIG_RFS_ACCEL) &&
@@ -11954,8 +11949,19 @@ static int bnxt_request_irq(struct bnxt *bp) irq->have_cpumask =1 ; irq->msix_nr = map_idx; irq->ring_nr = i; -cpumask_set_cpu (cpumask_local_spread (i, numa_node), - irq->cpu_mask); + cpu_num =cpumask_local_spread (i, numa_node); +cpumask_set_cpu (cpu_num, irq->cpu_mask); + +/* Init ST table entry if we can get the mapping */ +if (!pcie_tph_get_cpu_st (bp->pdev,TPH_MEM_TYPE_VM , + cpu_num, &tag)) { +pcie_tph_set_st_entry (bp->pdev, irq->msix_nr, tag); + irq->tag = tag; + irq->new_tag = tag; + } + +bnxt_register_irq_notifier (bp, irq); + rc =irq_update_affinity_hint (irq->vector, irq->cpu_mask);if (rc) { netdev_warn(bp->dev,
@@ -11963,16 +11969,6 @@ static int bnxt_request_irq(struct bnxt *bp) irq->vector);break ; } - -bnxt_register_irq_notifier (bp, irq); - -/* Init ST table entry */ -if (pcie_tph_get_cpu_st (irq->bp->pdev,TPH_MEM_TYPE_VM , -cpumask_first (irq->cpu_mask), - &tag)) -continue ; - -pcie_tph_set_st_entry (irq->bp->pdev, irq->msix_nr, tag); }return rc; }
@@ -14479,6 +14475,43 @@ static void bnxt_rtnl_unlock_sp(struct bnxt *bp)rtnl_unlock (); } +static void bnxt_tph_update (struct bnxt *bp) +{ +struct net_device *dev = bp->dev; +int i; + +bnxt_lock_sp (bp); +if (!test_bit (BNXT_STATE_OPEN , &bp->state)) + goto unlock; + +for (i =0 ; i < bp->rx_nr_rings; i++) { +struct bnxt_irq *irq; +int map_idx, err; +u16 tag; + + map_idx =bnxt_cp_num_to_irq_num (bp, i); + irq = &bp->irq_tbl[map_idx]; + tag =READ_ONCE (irq->new_tag); +if (irq->tag == tag) +continue ; + +if (pcie_tph_set_st_entry (bp->pdev, irq->msix_nr, tag)) +continue ; + + err =netdev_rx_queue_restart (dev, irq->ring_nr); +if (err) { +netdev_err (dev,"RX queue restart failed: err=%d\n" , + err); +continue ; + } + + irq->tag = tag; + } + +unlock: +bnxt_unlock_sp (bp); +} +/* Only called from bnxt_sp_task() */ static void bnxt_reset (struct bnxt *bp,bool silent) {
@@ -14911,6 +14944,9 @@ static void bnxt_sp_task(struct work_struct *work)bnxt_devlink_health_fw_report (bp); } +if (test_and_clear_bit (BNXT_TPH_UPDATE_SP_EVENT , &bp->sp_event)) +bnxt_tph_update (bp); +smp_mb__before_atomic ();clear_bit (BNXT_STATE_IN_SP_TASK , &bp->state); }
drivers/net/ethernet/broadcom/bnxt/bnxt.h +3 -0
@@ -1268,6 +1268,8 @@ struct bnxt_irq {struct bnxt *bp;int msix_nr;int ring_nr; +u16 tag; +u16 new_tag;struct irq_affinity_notify affinity_notify; };
@@ -2644,6 +2646,7 @@ struct bnxt {#define BNXT_RING_COAL_NOW_SP_EVENT 17#define BNXT_FW_RESET_NOTIFY_SP_EVENT 18#define BNXT_FW_EXCEPTION_SP_EVENT 19 +#define BNXT_TPH_UPDATE_SP_EVENT 20#define BNXT_LINK_CFG_CHANGE_SP_EVENT 21#define BNXT_THERMAL_THRESHOLD_SP_EVENT 22#define BNXT_FW_ECHO_REQUEST_SP_EVENT 23
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 197/228 ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit e16e960d55a40d36bd7c2494cc005e757dc9a1ef ]
ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0.
When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom.
Fix this by:
1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().
2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
--- drivers/net/ipvlan/ipvlan_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ipvlan/ipvlan_main.c +4 -0
@@ -146,6 +146,8 @@ static int ipvlan_init(struct net_device *dev) dev->lltx = true;netif_inherit_tso_max (dev, phy_dev); dev->hard_header_len = phy_dev->hard_header_len; + dev->needed_headroom = phy_dev->needed_headroom; + dev->needed_tailroom = phy_dev->needed_tailroom;netdev_lockdep_set_classes (dev);
@@ -773,6 +775,8 @@ static int ipvlan_device_event(struct notifier_block *unused,case NETDEV_FEAT_CHANGE :list_for_each_entry (ipvlan, &port->ipvlans, pnode) {netif_inherit_tso_max (ipvlan->dev, dev); + ipvlan->dev->needed_headroom = dev->needed_headroom; + ipvlan->dev->needed_tailroom = dev->needed_tailroom;netdev_update_features (ipvlan->dev); }break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 198/228 macvlan: inherit needed_headroom and needed_tailroom from lowerdev
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cef51860becd9700217c81732ca1eb1ea6ed6fe1 ]
macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0.
When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom.
Fix this by:
1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init().
2. Propagating needed_headroom and needed_tailroom updates to attached macvlans in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
--- drivers/net/macvlan.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/macvlan.c +4 -0
@@ -950,6 +950,8 @@ static int macvlan_init(struct net_device *dev) dev->lltx = true;netif_inherit_tso_max (dev, lowerdev); dev->hard_header_len = lowerdev->hard_header_len; + dev->needed_headroom = lowerdev->needed_headroom; + dev->needed_tailroom = lowerdev->needed_tailroom;macvlan_set_lockdep_class (dev); vlan->pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
@@ -1824,6 +1826,8 @@ static int macvlan_device_event(struct notifier_block *unused,case NETDEV_FEAT_CHANGE :list_for_each_entry (vlan, &port->vlans, list) {netif_inherit_tso_max (vlan->dev, dev); + vlan->dev->needed_headroom = dev->needed_headroom; + vlan->dev->needed_tailroom = dev->needed_tailroom;netdev_update_features (vlan->dev); }break ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 199/228 veth: fix queue index used to wake the peer txq in veth_poll
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Köppeler <[email protected]>
[ Upstream commit 60db47f02bfa2aa688938aa199117ec4f8e31d23 ]
veth_poll() derives the index of the peer TX queue to wake from rq->xdp_rxq.queue_index. That field is only initialized by xdp_rxq_info_reg() in veth_enable_xdp_range(), which runs only when an XDP program is attached. On the plain GRO/NAPI path (veth_napi_enable_range()) xdp_rxq_info_reg() is never called, so queue_index stays 0 for every queue, as priv->rq is zero-allocated.
So in a multi-queue setup with GRO enabled and no XDP program attached, every NAPI instance looks at the peer's TX queue 0. If veth_xmit() stops peer TX queue 1 because the ptr_ring is full (NETDEV_TX_BUSY), nothing ever wakes it again: the poller draining queue 1 wakes queue 0 instead. veth implements no ndo_tx_timeout, so the netdev watchdog does not kick in either, and the queue stays stopped indefinitely.
Derive the index from the position of the rq within priv->rq instead, which is correct regardless of whether XDP was ever enabled.
Scripts to reproduce the stall are available at
https://github.com/netoptimizer/veth-backpressure-performance-testing
--- drivers/net/veth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/veth.c +1 -1
@@ -967,7 +967,7 @@ static int veth_poll(struct napi_struct *napi, int budget)struct veth_rq *rq = container_of(napi, struct veth_rq, xdp_napi);struct veth_priv *priv =netdev_priv (rq->dev); -int queue_idx = rq->xdp_rxq.queue_index; +int queue_idx = rq - priv->rq;struct netdev_queue *peer_txq;struct veth_stats stats = {};struct net_device *peer_dev;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 200/228 tcp: fix icsk_ack.ato bitfield overflow
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <[email protected]>
[ Upstream commit 60837e4b840a9c3f7ec826e3584df0bc6542a2c2 ]
On cross-region connections we observed delayed ACKs suddenly turning into immediate ACKs plus a TCP_MAX_QUICKACKS burst, as if the connection had just received its first data segment.
Commit 95b9a87c6a6b ("tcp: record last received ipv6 flowlabel") squeezed icsk_ack.ato into 8 bits, sized for TCP_DELACK_MAX. But both writers still bound ato by icsk_rto, which can be well above 255 jiffies, so the bitfield assignment silently wraps mod 256: repeated delack timer misses double ato up to icsk_rto, storing 320 as 64 and 256 as 0, and ato == 0 is the "first data packet" sentinel in tcp_event_data_recv().
Clamp both writers to TCP_DELACK_MAX, which the static_assert already guarantees to fit and tcp_send_delayed_ack() effectively caps ato at anyway.
--- net/ipv4/tcp_input.c | 6 +++--- net/ipv4/tcp_timer.c | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-)
net/ipv4/tcp_input.c +3 -3
@@ -1039,9 +1039,9 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb)/* The fastest case is the first. */ icsk->icsk_ack.ato = (icsk->icsk_ack.ato >>1 ) +TCP_ATO_MIN /2 ; }else if (m < icsk->icsk_ack.ato) { - icsk->icsk_ack.ato = (icsk->icsk_ack.ato >>1 ) + m; -if (icsk->icsk_ack.ato > icsk->icsk_rto) - icsk->icsk_ack.ato = icsk->icsk_rto; + icsk->icsk_ack.ato =min3 ((icsk->icsk_ack.ato >>1 ) + (u32 )m, + icsk->icsk_rto, + (u32 )TCP_DELACK_MAX ); }else if (m > icsk->icsk_rto) {/* Too long gap. Apparently sender failed to * restart window, so that we send ACKs quickly.
net/ipv4/tcp_timer.c +3 -1
@@ -334,7 +334,9 @@ void tcp_delack_timer_handler(struct sock *sk)if (inet_csk_ack_scheduled (sk)) {if (!inet_csk_in_pingpong_mode (sk)) {/* Delayed ACK missed: inflate ATO. */ - icsk->icsk_ack.ato =min_t (u32, icsk->icsk_ack.ato <<1 , icsk->icsk_rto); + icsk->icsk_ack.ato =min3 ((u32 )icsk->icsk_ack.ato <<1 , + icsk->icsk_rto, + (u32 )TCP_DELACK_MAX ); }else {/* Delayed ACK missed: leave pingpong mode and * deflate ATO.
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 201/228 net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
[ Upstream commit 202fef9bbbf5784487eec27581389c6fb97c350d ]
In rtlgen_write_mmd(), the MDIO_AN_EEE_ADV case swaps the arguments to rtlgen_write_vend2(): it passes the MMD register number as the OCP address and the OCP address constant as the value. The caller's value is discarded and the write lands on the wrong register, so the EEE advertisement cannot be configured on the affected PHYs.
Mirror rtlgen_read_mmd() and write the value to RTL_MDIO_AN_EEE_ADV.
--- drivers/net/phy/realtek/realtek_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/realtek/realtek_main.c +1 -1
@@ -1338,7 +1338,7 @@ static int rtlgen_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,if (devnum ==MDIO_MMD_VEND2 ) ret =rtlgen_write_vend2 (phydev, regnum, val);else if (devnum ==MDIO_MMD_AN && regnum ==MDIO_AN_EEE_ADV ) - ret =rtlgen_write_vend2 (phydev, regnum,RTL_MDIO_AN_EEE_ADV ); + ret =rtlgen_write_vend2 (phydev,RTL_MDIO_AN_EEE_ADV , val);else ret = -EOPNOTSUPP ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 202/228 net: packet: fix wrong transport_header when sending VLAN-tagged frame
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit 01fdecc0480d916c799dbee584833a4a37e94d06 ]
In packet_parse_headers(), when processing a VLAN-tagged frame, skb_set_network_header() is called to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to the outer VLAN EtherType (e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U).
Move skb_probe_transport_header() to before skb_set_network_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header, so nhoff correctly points to the VLAN header. The flow dissector can then parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.
--- net/packet/af_packet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/packet/af_packet.c +2 -2
@@ -1943,13 +1943,13 @@ static void packet_parse_headers(struct sk_buff *skb, struct socket *sock) sock->type == SOCK_RAW) skb->protocol =dev_parse_header_protocol (skb); +skb_probe_transport_header (skb); +/* Move network header to the right position for VLAN tagged packets */ if (likely (skb->dev->type ==ARPHRD_ETHER ) &ð_type_vlan (skb->protocol) &&vlan_get_protocol_and_depth (skb, skb->protocol, &depth) !=0 )skb_set_network_header (skb, depth); - -skb_probe_transport_header (skb); }/*
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 203/228 net: tap: fix wrong transport_header when sending VLAN-tagged frame
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <[email protected]>
[ Upstream commit cbb35cbe8db268fefe34c23df15348cf99025298 ]
In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_header() is called first to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to ETH_P_8021Q, while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U).
Move skb_set_network_header() to after skb_probe_transport_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the flow dissector can parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.
--- drivers/net/tap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/tap.c +2 -1
@@ -1091,12 +1091,13 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp) } } +skb_probe_transport_header (skb); +/* Move network header to the right position for VLAN tagged packets */ if (eth_type_vlan (skb->protocol) &&vlan_get_protocol_and_depth (skb, skb->protocol, &depth) !=0 )skb_set_network_header (skb, depth); -skb_probe_transport_header (skb);dev_queue_xmit (skb);rcu_read_unlock ();
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 204/228 net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawen Wu <[email protected]>
[ Upstream commit 5f3a13e0bb5ebcc1ca2dfda42ea40b9f3c2be6ea ]
In non-MSI-X mode (such as legacy INTx or single MSI), wx->msix_entry is not allocated or initialized. Calling NGBE_INTR_MISC(wx) dereferences wx->msix_entry->entry, leading to a NULL pointer dereference crash.
This issue was introduced by fixing the IRQ vector when the number of VFs is 7. Fix the issue by explicitly checking pdev->msix_enabled to determine the correct vector index.
Additionally, as a side fix, set the interrupt mask to BIT(0) for the non-MSI-X fallback. In MSI/INTx mode, the MISC and queue interrupts share vector 0, and the WX_PX_MISC_IVAR register is only valid in the MSI-X case. Thus, BIT(0) is the correct mask for the miscellaneous cause when MSI-X is disabled.
--- drivers/net/ethernet/wangxun/ngbe/ngbe_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/wangxun/ngbe/ngbe_main.c +3 -1
@@ -180,8 +180,10 @@ static void ngbe_irq_enable(struct wx *wx, bool queues)/* mask interrupt */ if (queues)wx_intr_enable (wx,NGBE_INTR_ALL ); -else +else if (wx->pdev->msix_enabled)wx_intr_enable (wx,NGBE_INTR_MISC (wx)); +else +wx_intr_enable (wx,BIT (0 )); }/**
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 205/228 net/tls: Fail tls_sw_splice_read() after a failed async decrypt
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 976df67f463db1fddaf2a32fb04f57ad2891a23d ]
When an async decrypt fails, tls_decrypt_done() records the error in ctx->async_wait.err and calls tls_err_abort(), which stores it in sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read async_wait.err once they hold the reader lock and fail the call: a record that did not authenticate breaks the connection.
tls_sw_splice_read() has no such check, and sk_err does not stand in for one. tls_rx_rec_wait() tests sk_err only inside the loop it skips whenever a record is already parsed, and the first reader to reach sock_error() clears it, while async_wait.err persists. A splice therefore keeps delivering records on a connection that recvmsg() and read_sock() refuse to read.
Read async_wait.err in tls_sw_splice_read() as the other two readers do.
--- net/tls/tls_sw.c | 5 +++++ 1 file changed, 5 insertions(+)
net/tls/tls_sw.c +5 -0
@@ -2319,6 +2319,11 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,if (err <0 )return err; +/* If crypto failed the connection is broken */ + err = ctx->async_wait.err; +if (err) + goto splice_read_end; +if (!skb_queue_empty (&ctx->rx_list)) { skb =__skb_dequeue (&ctx->rx_list); }else {
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 206/228 ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit f12afefb7b01f94d6d66d397f323a9914edbf70e ]
The irq handlers take a struct device pointer and call dev_get_drvdata() to obtain the driver data. However, the driver data is only set at the end of probe, after devm_request_irq(), so an interrupt taken in between causes the handlers to pass a NULL pointer to readl() and crash.
Pass the private data directly as the devm_request_irq() argument instead of the device pointer, matching what the handlers expect.
--- sound/soc/xilinx/xlnx_formatter_pcm.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
sound/soc/xilinx/xlnx_formatter_pcm.c +4 -6
@@ -281,8 +281,7 @@ static irqreturn_t xlnx_mm2s_irq_handler(int irq, void *arg) {u32 val;void __iomem *reg; -struct device *dev = arg; -struct xlnx_pcm_drv_data *adata =dev_get_drvdata (dev); +struct xlnx_pcm_drv_data *adata = arg; reg = adata->mmio +XLNX_MM2S_OFFSET +XLNX_AUD_STS ; val =readl (reg);
@@ -300,8 +299,7 @@ static irqreturn_t xlnx_s2mm_irq_handler(int irq, void *arg) {u32 val;void __iomem *reg; -struct device *dev = arg; -struct xlnx_pcm_drv_data *adata =dev_get_drvdata (dev); +struct xlnx_pcm_drv_data *adata = arg; reg = adata->mmio +XLNX_S2MM_OFFSET +XLNX_AUD_STS ; val =readl (reg);
@@ -637,7 +635,7 @@ static int xlnx_formatter_pcm_probe(struct platform_device *pdev) } ret =devm_request_irq (dev, aud_drv_data->mm2s_irq, xlnx_mm2s_irq_handler,0 , -"xlnx_formatter_pcm_mm2s_irq" , dev); +"xlnx_formatter_pcm_mm2s_irq" , aud_drv_data);if (ret) {dev_err (dev,"xlnx audio mm2s irq request failed\n" ); goto clk_err;
@@ -664,7 +662,7 @@ static int xlnx_formatter_pcm_probe(struct platform_device *pdev) ret =devm_request_irq (dev, aud_drv_data->s2mm_irq, xlnx_s2mm_irq_handler,0 ,"xlnx_formatter_pcm_s2mm_irq" , - dev); + aud_drv_data);if (ret) {dev_err (dev,"xlnx audio s2mm irq request failed\n" ); goto clk_err;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 207/228 regmap: sdw-mbq: Fix swap of timeout and retry times
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit ae7fd6ff4c6713270d2efe6db87a4a58ccb7cc61 ]
When polling Function Busy using read_poll_timeout() the total timeout and retry delay arguments are swapped. This leads to only a single retry being processed, it seems the existing users typically do succeed before the first retry.
Swap the arguments over to ensure the correct polling time.
--- drivers/base/regmap/regmap-sdw-mbq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap-sdw-mbq.c +1 -1
@@ -59,7 +59,7 @@ static int regmap_sdw_mbq_poll_busy(struct sdw_slave *slave, unsigned int reg,if (ctx->readable_reg (dev, reg)) { ret =read_poll_timeout (sdw_read_no_pm, val, val <0 || !(val &SDCA_CTL_ENTITY_0_FUNCTION_BUSY ), - ctx->cfg.timeout_us, ctx->cfg.retry_us, + ctx->cfg.retry_us, ctx->cfg.timeout_us, false, slave, reg);if (val <0 )return val;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 208/228 af_packet: Dont send zero-byte data in tpacket_snd().
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 6bcd76c134c55c697148acb5c0194e9666abdf84 ]
syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():
skb_assert_len
WARNING: at include/linux/skbuff.h:2753 skb_assert_len WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781 Call Trace: <TASK> dev_queue_xmit include/linux/netdevice.h:3448 [inline] packet_xmit+0x243/0x310 net/packet/af_packet.c:276 tpacket_snd net/packet/af_packet.c:2907 [inline] packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134
When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb() populates an skb with skb->len == 0 and returns 0. tpacket_snd() then forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to hit skb_assert_len(skb).
Similar checks exist in packet_snd() via commit dc633700f00f ("net/af_packet: check len when min_header_len equals to 0") and in packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send zero-byte data in packet_sendmsg_spkt().").
Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject zero-length packets in tpacket_snd().
--- net/packet/af_packet.c | 3 +++ 1 file changed, 3 insertions(+)
net/packet/af_packet.c +3 -0
@@ -2660,6 +2660,9 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, len = ((to_write > len_max) ? len_max : to_write); } +if (unlikely (!skb->len)) +return -EINVAL ; +packet_parse_headers (skb, sock);return tp_len;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 209/228 net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit f60b396ee174206fe08ebf997d16cd3801b77b22 ]
tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking rcu_access_pointer(a->goto_chain) and then calling tcf_action_goto_chain_exec(), which does a second, independent rcu_dereference_bh(a->goto_chain) read and immediately dereferences chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact replace path) can clear a->goto_chain between the two reads, so the second read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.
Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain in tcf_action_exec(), checking it once for NULL, and passing the resulting chain pointer into tcf_action_goto_chain_exec(). This turns the split check/use into a single check/use on one value.
--- net/sched/act_api.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/sched/act_api.c +5 -5
@@ -41,11 +41,9 @@ int tcf_dev_queue_xmit(struct sk_buff *skb, int (*xmit)(struct sk_buff *skb)) }EXPORT_SYMBOL_GPL (tcf_dev_queue_xmit); -static void tcf_action_goto_chain_exec (const struct tc_action *a, +static void tcf_action_goto_chain_exec (const struct tcf_chain *chain,struct tcf_result *res) { -const struct tcf_chain *chain =rcu_dereference_bh (a->goto_chain); - res->goto_tp =rcu_dereference_bh (chain->filter_chain); }
@@ -1170,12 +1168,14 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,return TC_ACT_OK ; } }else if (TC_ACT_EXT_CMP (ret,TC_ACT_GOTO_CHAIN )) { -if (unlikely (!rcu_access_pointer (a->goto_chain))) { +struct tcf_chain *chain =rcu_dereference_bh (a->goto_chain); + +if (unlikely (!chain)) {tcf_set_drop_reason (skb,SKB_DROP_REASON_TC_CHAIN_NOTFOUND );return TC_ACT_SHOT ; } -tcf_action_goto_chain_exec (a, res); +tcf_action_goto_chain_exec (chain, res); }if (ret !=TC_ACT_PIPE )
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 210/228 net/sched: cls_u32: skip hash tables in u32_bind_class()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <[email protected]>
[ Upstream commit 6d3724e616faf952c3adcf8414fc21a828ef3709 ]
u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses &n->res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a slab-out-of-bounds read of res->classid in tc_cls_bind_class().
The issue can be reproduced with the following commands:
tc qdisc add dev lo root handle 1: hfsc
tc class add dev lo parent 1: classid 1:1 hfsc sc rate 1000kbit
tc filter add dev lo parent 1:1 protocol ip prio 1 u32 match u32 0 0 flowid 1:1 tc class add dev lo parent 1: classid 1:2 hfsc sc rate 2000kbit
Fix this by skipping hash tables via the TC_U32_KEY(handle) check.
--- net/sched/cls_u32.c | 3 +++ 1 file changed, 3 insertions(+)
net/sched/cls_u32.c +3 -0
@@ -1346,6 +1346,9 @@ static void u32_bind_class(void *fh, u32 classid, unsigned long cl, void *q, {struct tc_u_knode *n = fh; +if (TC_U32_KEY (n->handle) ==0 ) +return ; +tc_cls_bind_class (classid, cl, q, &n->res, base); }
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 211/228 pid: reject allocations through dead ancestor pid namespaces
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <[email protected]>
[ Upstream commit b64a9f67e082e04835ddd69d422a25168d69375b ]
alloc_pid() checks PIDNS_ADDING only on the leaf pid namespace before making a new struct pid visible in every ancestor namespace. That is insufficient when an unborn descendant pid namespace outlives an ancestor whose init task has already exited. The descendant can still be initialized later through setns(), and the new pid is then published into the dead ancestor as well.
Keep the existing ENOMEM behavior, but require PIDNS_ADDING to be set in every namespace that will receive the new pid before publishing any of them. This preserves the invariant that free_pid() never decrements pid_allocated in a namespace whose child_reaper is no longer live.
--- kernel/pid.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/pid.c +4 -2
@@ -324,8 +324,10 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *arg_set_tid,* error path may try to wakeup the possibly freed ns->child_reaper. */ retval = -ENOMEM ; -if (unlikely (!(ns->pid_allocated &PIDNS_ADDING ))) - goto out_free; +for (upid = pid->numbers + ns->level; upid >= pid->numbers; --upid) +if (unlikely (!(upid->ns->pid_allocated &PIDNS_ADDING ))) + goto out_free; +for (upid = pid->numbers + ns->level; upid >= pid->numbers; --upid) {/* Make the PID visible to find_pid_ns. */ idr_replace (&upid->ns->idr, pid, upid->nr);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 212/228 m68k: Define NR_CPUS to 1
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 1fd495ef09eef96169a379a749c24b5e69974bb8 ]
This fixes a Kconfig warning
fs/erofs/Kconfig:137:warning: range is invalid
which originates from EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS using NR_CPUS which up to now didn't exist for ARCH=m68k. All other architectures define this symbol, so fix the outlier.
[geert] This also fixes:
- CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS being set to the literal NR_CPUS instead of a number by automatic configs like "make allmodconfig" or "make olddefconfig",
- An infinite loop in manual configs like "make oldconfig" when CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS is not present or has an invalid value in your existing .config.
--- arch/m68k/Kconfig.cpu | 4 ++++ 1 file changed, 4 insertions(+)
arch/m68k/Kconfig.cpu +4 -0
@@ -548,6 +548,10 @@ config CACHE_COPYBACK endchoice endif # HAVE_CACHE_CB +config NR_CPUS + int + default "1" + # Coldfire cores that do not have a data cache configured can do coherent DMA. config COLDFIRE_COHERENT_DMA bool
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 213/228 regmap: sdw-mbq: dont call an unset readable_reg callback
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Golovko <[email protected]>
[ Upstream commit 00268f9452d2a0d660aa9c1bb0ca07a994af6a4f ]
regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit by calling ctx->readable_reg(), which is a straight copy of config->readable_reg. That callback is optional: regmap_readable() treats a NULL ->readable_reg as "every register is readable", and drivers rely on that. es9356 and tac5xx2-sdw both build an MBQ regmap without one.
Since commit ca1b11b36d82 ("regmap: sdw-mbq: Allow defers on undeferrable controls") the poll runs on every -ENODATA, not only for Controls the driver marked deferrable, so any of those devices answering COMMAND_IGNORED takes the kernel through a NULL function pointer.
Treat a missing callback the way the rest of regmap does and poll.
--- drivers/base/regmap/regmap-sdw-mbq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap-sdw-mbq.c +1 -1
@@ -56,7 +56,7 @@ static int regmap_sdw_mbq_poll_busy(struct sdw_slave *slave, unsigned int reg, reg =SDW_SDCA_CTL (SDW_SDCA_CTL_FUNC (reg),0 ,SDCA_CTL_ENTITY_0_FUNCTION_STATUS ,0 ); -if (ctx->readable_reg (dev, reg)) { +if (!ctx->readable_reg || ctx->readable_reg (dev, reg)) { ret = read_poll_timeout(sdw_read_no_pm, val, val < 0 || !(val & SDCA_CTL_ENTITY_0_FUNCTION_BUSY), ctx->cfg.retry_us, ctx->cfg.timeout_us,
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 214/228 net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <[email protected]>
[ Upstream commit 36a05d2820077bb3955acb8111e1041d39148037 ]
On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port_id' variable. However, it is only the lower 8-bits of the 16-bit Source Tag that represent the MAC Port ID, while the upper 8-bits are Hardware-Reserved and carry an arbitrary value. With the existing logic, sporadic kernel crash is observed due to the subsequent driver code accessing out-of-bound memory because of an invalid port_id.
Hence, fix the port_id extraction logic to use only the lower 8-bits of the Source Tag as the MAC Port ID.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +2 -0
@@ -1312,6 +1312,8 @@ static int am65_cpsw_nuss_rx_packets(struct am65_cpsw_rx_flow *flow,k3_udma_glue_rx_cppi5_to_dma_addr (rx_chn->rx_chn, &buf_dma); pkt_len =cppi5_hdesc_get_pktlen (desc_rx);cppi5_desc_get_tags_ids (&desc_rx->hdr, &port_id,NULL ); +/* Port ID is contained in the lower 8-bits of the 16-bit Source Tag */ + port_id &=0xFF ;dev_dbg (dev,"%s rx port_id:%d\n" , __func__, port_id); port =am65_common_get_port (common, port_id); ndev = port->ndev;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 215/228 accel/amdxdna: Skip unmapped range in aie2_populate_range()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit 6c916e301fa10de9158b922474ade7b43d726cda ]
aie2_populate_range() incorrectly failed jobs for BOs with multiple
mmaps: if the unmapped entry appeared first in umap_list, the loop would pick it up, call hmm_range_fault() on a gone VMA, and return -EFAULT without ever trying the remaining valid mapps.
Fix it by skipping unmapped entries. After the loop, if the map list is empty or all maps are valid, map_invalid can be cleared normally.
--- drivers/accel/amdxdna/aie2_ctx.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/accel/amdxdna/aie2_ctx.c +16 -0
@@ -963,6 +963,16 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo) found = false;down_write (&xdna->notifier_lock);list_for_each_entry (mapp, &abo->mem.umap_list, node) { +/* +* Skip entries that have already been unmapped. +* +* If userspace unmaps the address and later submits I/O using +* it, the IOMMU will reject the access and report a fault. +* Ignore such entries here. +*/ +if (mapp->unmapped) +continue ; +if (mapp->invalid &&kref_get_unless_zero (&mapp->refcnt)) { found = true;break ;
@@ -970,6 +980,12 @@ static int aie2_populate_range(struct amdxdna_gem_obj *abo) }if (!found) { +/* +* This also covers the case where all mappings have been +* removed. There are no invalid mappings left to process. +* Any subsequent I/O using the unmapped address will be +* rejected by the IOMMU. +*/ abo->mem.map_invalid = false;up_write (&xdna->notifier_lock);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 216/228 net/sched: cls_bpf: reject dev-bound programs bound to a different device
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit 120977e2c096deea4e866e4273be9220b957c29e ]
cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1).
Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device.
--- net/sched/cls_bpf.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
net/sched/cls_bpf.c +16 -2
@@ -374,7 +374,8 @@ static int cls_bpf_prog_from_ops(struct nlattr **tb, struct cls_bpf_prog *prog) }static int cls_bpf_prog_from_efd (struct nlattr **tb,struct cls_bpf_prog *prog, -u32 gen_flags,const struct tcf_proto *tp) +u32 gen_flags,const struct tcf_proto *tp, +struct netlink_ext_ack *extack) {struct bpf_prog *fp;char *name =NULL ;
@@ -388,6 +389,19 @@ static int cls_bpf_prog_from_efd(struct nlattr **tb, struct cls_bpf_prog *prog,if (IS_ERR (fp))return PTR_ERR (fp); +if (bpf_prog_is_dev_bound (fp->aux)) { +struct tcf_block *block = tp->chain->block; +struct net_device *dev; + + dev = block->q ?qdisc_dev (block->q) :NULL ; +if (!dev || !bpf_offload_dev_match (fp, dev)) { +NL_SET_ERR_MSG (extack, +"Program is bound to a different device" ); +bpf_prog_put (fp); +return -EINVAL ; + } + } +if (tb[TCA_BPF_NAME ]) { name =nla_memdup (tb[TCA_BPF_NAME ],GFP_KERNEL );if (!name) {
@@ -492,7 +506,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, prog->gen_flags = gen_flags; ret = is_bpf ?cls_bpf_prog_from_ops (tb, prog) : -cls_bpf_prog_from_efd (tb, prog, gen_flags, tp); +cls_bpf_prog_from_efd (tb, prog, gen_flags, tp, extack);if (ret <0 ) goto errout_idr;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 217/228 l2tp: fix tunnel and session refcount leak on seq_file release
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9006c116dd111d457bf5d074990210f70a4ad2c8 ]
In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls.
However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.
Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.
--- net/l2tp/l2tp_debugfs.c | 4 +++ net/l2tp/l2tp_ppp.c | 56 ++++++++++++++++++++++++++++++++++++++--- 2 files changed, 57 insertions(+), 3 deletions(-)
net/l2tp/l2tp_debugfs.c +4 -0
@@ -306,6 +306,10 @@ static int l2tp_dfs_seq_release(struct inode *inode, struct file *file) seq = file->private_data; pd = seq->private; +if (pd->session) +l2tp_session_put (pd->session); +if (pd->tunnel) +l2tp_tunnel_put (pd->tunnel);if (pd->net)put_net_track (pd->net, &pd->ns_tracker);kfree (pd);
net/l2tp/l2tp_ppp.c +53 -3
77 lines not on this page · raw message
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 218/228 firewire: ohci: fix NULL pointer dereference in ar_context_release
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <[email protected]>
[ Upstream commit 42d217add8d80d6e7d9f58f80d11ea9b07ea113e ]
During the error handling path of the driver's probe function, a NULL pointer dereference can occur in ar_context_release().
When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping fails), the devres cleanup mechanism invokes release_ohci(). This function unconditionally calls ar_context_release() to clean up the asynchronous receive contexts. However, if ar_context_init() was not yet called, ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by devres_alloc()).
ar_context_release() immediately dereferences ctx->ohci to get the dev pointer before checking if the context was actually initialized, leading to a crash:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543 Call Trace: release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567 release_nodes drivers/base/devres.c:546 [inline] devres_release_all+0x1a8/0x260 drivers/base/devres.c:576 device_unbind_cleanup drivers/base/dd.c:597 [inline] really_probe+0x451/0xae0 drivers/base/dd.c:772
To fix this, move the assignment of the dev pointer after the !ctx->buffer check. If ctx->buffer is NULL, it indicates that the context was never successfully initialized and there is nothing to release, safely avoiding the dereference of the uninitialized ctx->ohci pointer.
--- drivers/firewire/ohci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firewire/ohci.c +3 -1
@@ -540,11 +540,13 @@ static void ar_context_link_page(struct ar_context *ctx, unsigned int index)static void ar_context_release (struct ar_context *ctx) { -struct device *dev = ctx->ohci->card.device; +struct device *dev;if (!ctx->buffer)return ; + dev = ctx->ohci->card.device; +for (int i =0 ; i <AR_BUFFERS ; ++i) {dma_addr_t dma_addr = ctx->dma_addrs[i];if (dma_addr)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 219/228 drm/xe/pxp: add termination on resume
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Ceraolo Spurio <[email protected]>
[ Upstream commit 51afaf53e01e01bda489fc6ffacf07a706e72783 ]
Suspend/resume causes the PXP keys to become invalid, but doesn't actually kill the session. The driver also doesn't explicitly kill and re-start the session until a new PXP request comes in, which means that the "zombie" session can potentially stick around if there are no new requests from userspace. While this is not an issue for PXP, HDCP has a new behavior starting on PTL where a communication is sent to GSC if a session is active at suspend time (even if it doesn't have a valid key), which can lead to delays in the suspend flow if we suspend while the zombie session is still active.
To avoid this, we can trigger a termination on resume and kill the zombie session immediately, instead of delaying the termination to the next PXP request. Due to restrictions in the rpm suspend/resume flow, we can't call the termination flow from within the resume call itself, so the pxp irq worker is expanded to cover this scenario.
The existing logic in the worker doesn't work as-is for the new flow, because the pm_get_if_active will fail if the worker runs before the pci_resume call has completed (which is possible, since we queue it from within that call) or after we're started to suspend again. Given that we always want to run the worker after a resume (differently from the irq case, where we want to skip if we're suspended), we can solve this by just taking the PM reference before queueing the worker. As part of this rework, the pxp->events variable has been moved to atomic, to avoid having to take xe->irq.lock from non-irq related paths.
--- drivers/gpu/drm/xe/xe_pxp.c | 162 ++++++++++++++++++++++-------- drivers/gpu/drm/xe/xe_pxp_types.h | 27 +++-- 2 files changed, 139 insertions(+), 50 deletions(-)
drivers/gpu/drm/xe/xe_pxp.c +120 -42
@@ -8,6 +8,8 @@#include <drm/drm_managed.h> #include <uapi/drm/xe_drm.h> +#include <linux/device.h> +#include "xe_bo.h" #include "xe_bo_types.h" #include "xe_device_types.h"
@@ -162,16 +164,9 @@ static void mark_termination_in_progress(struct xe_pxp *pxp) pxp->status =XE_PXP_TERMINATION_IN_PROGRESS ; } -static void pxp_terminate (struct xe_pxp *pxp) +static bool pxp_prep_for_termination (struct xe_pxp *pxp) { -int ret =0 ; -struct xe_device *xe = pxp->xe; - -if (!wait_for_completion_timeout (&pxp->activation, -msecs_to_jiffies (PXP_ACTIVATION_TIMEOUT_MS ))) -drm_err (&xe->drm,"failed to wait for PXP start before termination\n" ); - -mutex_lock (&pxp->mutex); +lockdep_assert_held (&pxp->mutex);if (pxp->status ==XE_PXP_ACTIVE ) pxp->key_instance++;
@@ -180,10 +175,8 @@ static void pxp_terminate(struct xe_pxp *pxp)* we'll mark the status as needing termination on resume, so no need to * emit a termination now. */ -if (pxp->status ==XE_PXP_SUSPENDED ) { -mutex_unlock (&pxp->mutex); -return ; - } +if (pxp->status ==XE_PXP_SUSPENDED ) +return false;/* * If we have a termination already in progress, we need to wait for
@@ -193,15 +186,44 @@ static void pxp_terminate(struct xe_pxp *pxp)*/ if (pxp->status ==XE_PXP_TERMINATION_IN_PROGRESS ) { pxp->status =XE_PXP_NEEDS_ADDITIONAL_TERMINATION ; -mutex_unlock (&pxp->mutex); -return ; +return false; }mark_termination_in_progress (pxp); -mutex_unlock (&pxp->mutex); +return true; +} + +static void pxp_terminate (struct xe_pxp *pxp,bool hw_only) +{ +struct xe_device *xe = pxp->xe; +int ret =0 ; -pxp_invalidate_queues (pxp); +if (!wait_for_completion_timeout (&pxp->activation, +msecs_to_jiffies (PXP_ACTIVATION_TIMEOUT_MS ))) +drm_err (&xe->drm,"failed to wait for PXP start before termination\n" ); + +if (!hw_only) { +bool prep_ok; + +mutex_lock (&pxp->mutex); + + prep_ok =pxp_prep_for_termination (pxp); + +mutex_unlock (&pxp->mutex); + +if (!prep_ok) +return ; + +pxp_invalidate_queues (pxp); + }else { +/* +* The caller of the HW-only termination should have already +* called pxp_prep_for_termination and marked the termination as +* in progress. +*/ +xe_assert (xe, !completion_done (&pxp->termination)); + } ret =pxp_terminate_hw (pxp);if (ret) {
@@ -247,33 +269,46 @@ static void pxp_terminate_complete(struct xe_pxp *pxp)mutex_unlock (&pxp->mutex); } -static void pxp_irq_work (struct work_struct *work) +static void pxp_events_work (struct work_struct *work) { -struct xe_pxp *pxp =container_of (work,typeof (*pxp), irq.work); +struct xe_pxp *pxp =container_of (work,typeof (*pxp), events.work);struct xe_device *xe = pxp->xe; +bool hw_only = false;u32 events =0 ; -spin_lock_irq (&xe->irq.lock); - events = pxp->irq.events; - pxp->irq.events =0 ; -spin_unlock_irq (&xe->irq.lock); + events =atomic_xchg (&pxp->events.pending,0 );if (!events)return ;/* -* If we're processing a termination irq while suspending then don't -* bother, we're going to re-init everything on resume anyway. +* If the termination request comes from an irq while we're suspending, +* then we can defer it to the resume path instead of waking the device +* up. +* In the case of the termination on resume the pm reference is taken +* in xe_pxp_pm_resume() and released here. +* Note that we do not expect both events to be set at the same time, +* but if it does happen due to a spurious interrupt we want to behave +* as if the only request we got was the one from the resume path; this +* is because the termination prep has already been done in +* xe_pxp_pm_resume() and it is impossible for any PXP operations to +* occur between the prep and the termination completion, so there is no +* need for a new SW prep. */ -if ((events &PXP_TERMINATION_REQUEST ) && !xe_pm_runtime_get_if_active (xe)) +if (events &PXP_TERMINATION_REQUEST_ON_RESUME ) { + events &= ~PXP_TERMINATION_REQUEST_IRQ ; + hw_only = true; + } + +if ((events &PXP_TERMINATION_REQUEST_IRQ ) && !xe_pm_runtime_get_if_active (xe))return ;if (events &PXP_TERMINATION_REQUEST ) { - events &= ~PXP_TERMINATION_COMPLETE ; -pxp_terminate (pxp); + events &= ~PXP_TERMINATION_COMPLETE_IRQ ; +pxp_terminate (pxp, hw_only); } -if (events &PXP_TERMINATION_COMPLETE ) +if (events &PXP_TERMINATION_COMPLETE_IRQ )pxp_terminate_complete (pxp);if (events &PXP_TERMINATION_REQUEST )
@@ -294,20 +329,18 @@ void xe_pxp_irq_handler(struct xe_device *xe, u16 iir)return ; } -lockdep_assert_held (&xe->irq.lock); -if (unlikely (!iir))return ;if (iir & (KCR_PXP_STATE_TERMINATED_INTERRUPT |KCR_APP_TERMINATED_PER_FW_REQ_INTERRUPT )) - pxp->irq.events |=PXP_TERMINATION_REQUEST ; +atomic_or (PXP_TERMINATION_REQUEST_IRQ , &pxp->events.pending);if (iir &KCR_PXP_STATE_RESET_COMPLETE_INTERRUPT ) - pxp->irq.events |=PXP_TERMINATION_COMPLETE ; +atomic_or (PXP_TERMINATION_COMPLETE_IRQ , &pxp->events.pending); -if (pxp->irq.events) -queue_work (pxp->irq.wq, &pxp->irq.work); +if (atomic_read (&pxp->events.pending)) +queue_work (pxp->events.wq, &pxp->events.work); }static int kcr_pxp_set_status (const struct xe_pxp *pxp,bool enable)
@@ -338,7 +371,7 @@ static void pxp_fini(void *arg) {struct xe_pxp *pxp = arg; -destroy_workqueue (pxp->irq.wq); +destroy_workqueue (pxp->events.wq);xe_pxp_destroy_execution_resources (pxp);/* no need to explicitly disable KCR since we're going to do an FLR */
@@ -400,7 +433,7 @@ int xe_pxp_init(struct xe_device *xe)INIT_LIST_HEAD (&pxp->queues.list);spin_lock_init (&pxp->queues.lock); -INIT_WORK (&pxp->irq.work, pxp_irq_work); +INIT_WORK (&pxp->events.work, pxp_events_work); pxp->xe = xe; pxp->gt = gt;
@@ -419,8 +452,8 @@ int xe_pxp_init(struct xe_device *xe)mutex_init (&pxp->mutex); - pxp->irq.wq =alloc_ordered_workqueue ("pxp-wq" ,0 ); -if (!pxp->irq.wq) { + pxp->events.wq =alloc_ordered_workqueue ("pxp-wq" ,0 ); +if (!pxp->events.wq) { err = -ENOMEM ; goto out_free; }
@@ -440,7 +473,7 @@ int xe_pxp_init(struct xe_device *xe) out_kcr_disable:kcr_pxp_disable (pxp); out_wq: -destroy_workqueue (pxp->irq.wq); +destroy_workqueue (pxp->events.wq); out_free:drmm_kfree (&xe->drm, pxp); out:
@@ -883,6 +916,7 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp) fallthrough;case XE_PXP_ACTIVE : pxp->key_instance++; + pxp->needs_termination_on_resume = true; needs_queue_inval = true;break ; }
@@ -918,6 +952,7 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)*/ void xe_pxp_pm_resume (struct xe_pxp *pxp) { +bool has_pm = false;int err;if (!xe_pxp_is_enabled (pxp))
@@ -925,14 +960,57 @@ void xe_pxp_pm_resume(struct xe_pxp *pxp) err =kcr_pxp_enable (pxp); +/* +* We want to avoid the device runtime suspending before we're done with +* the termination queued below, so we need a runtime PM reference; we +* can't call the rpm functions from within the PXP lock, so we take the +* ref here. Note that we don't want the rpm resume code to actually run +* here as that would call back into this function, but as long as we +* don't enable DPM_FLAG_SMART_SUSPEND (which we currently do not) we're +* guaranteed to not be runtime suspended at this point, so we can +* safely use the get_noresume variant. +*/ +if (pxp->needs_termination_on_resume) { + has_pm = true; + +xe_assert (pxp->xe, !dev_pm_smart_suspend (pxp->xe->drm.dev)); +xe_pm_runtime_get_noresume (pxp->xe); + } +mutex_lock (&pxp->mutex);xe_assert (pxp->xe, pxp->status ==XE_PXP_SUSPENDED ); -if (err) +if (err) { pxp->status =XE_PXP_ERROR ; -else + }else { pxp->status =XE_PXP_NEEDS_TERMINATION ; +if (pxp->needs_termination_on_resume) { + pxp->needs_termination_on_resume = false; + +/* +* We can't call pxp_terminate_hw directly from here +* because we're not allowed to do allocations within +* the rpm resume call, so we defer the termination to +* the worker that we use for the termination irqs. +* However, we do not want any PXP ops to go through +* between the suspend completing and the worker +* starting, so we need to do the termination prep +* immediately, which will mark the termination as in +* progress and stall PXP ops. +*/ +if (pxp_prep_for_termination (pxp)) { + has_pm = false;/* move PM ref ownership to worker */ + +atomic_or (PXP_TERMINATION_REQUEST_ON_RESUME , &pxp->events.pending); +queue_work (pxp->events.wq, &pxp->events.work); + } + } + } +mutex_unlock (&pxp->mutex); + +if (has_pm) +xe_pm_runtime_put (pxp->xe); }
drivers/gpu/drm/xe/xe_pxp_types.h +19 -8
@@ -85,17 +85,20 @@ struct xe_pxp {/** @gsc_res: kernel-owned objects for PXP submissions to the GSCCS */ struct xe_pxp_gsc_client_resources gsc_res; -/** @irq: wrapper for the worker and queue used for PXP irq support */ +/** @events: wrapper for the worker and queue used for PXP event handling */ struct { -/** @irq.work: worker that manages irq events. */ +/** @events.work: worker that manages termination events. */ struct work_struct work; -/** @irq.wq: workqueue on which to queue the irq work. */ +/** @events.wq: workqueue on which to queue the work. */ struct workqueue_struct *wq; -/** @irq.events: pending events, protected with xe->irq.lock. */ -u32 events; -#define PXP_TERMINATION_REQUEST BIT(0) -#define PXP_TERMINATION_COMPLETE BIT(1) - } irq; +/** @events.pending: pending events */ +atomic_t pending; +#define PXP_TERMINATION_REQUEST_IRQ BIT(0) +#define PXP_TERMINATION_REQUEST_ON_RESUME BIT(1) +#define PXP_TERMINATION_REQUEST (PXP_TERMINATION_REQUEST_IRQ | \ + PXP_TERMINATION_REQUEST_ON_RESUME) +#define PXP_TERMINATION_COMPLETE_IRQ BIT(2) + } events;/** @mutex: protects the pxp status and the queue list */ struct mutex mutex;
@@ -130,6 +133,14 @@ struct xe_pxp {* suspend cycles. */ u32 last_suspend_key_instance; +/** +* @needs_termination_on_resume: indicates if PXP termination is needed +* on resume. This is set if PXP was active when we suspend and it is +* cleared when we queue the termination on resume. Since the suspend +* and resume calls cannot execute at the same time, this variable does +* not need to be protected by the PXP lock. +*/ + bool needs_termination_on_resume; };#endif /* __XE_PXP_TYPES_H__ */
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 220/228 drm/xe/oa: Fix sync entry leak on OA config emit failure
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit 8d33c4987cd162527375a3905017ae129ba7c3fe ]
xe_oa_emit_oa_config() releases the sync entries and the syncs array only on its success path. When it fails before the point of no return (fence allocation, config buffer allocation or batch submission), it returns without touching stream->syncs.
The stream open path handles such failures in the caller, but xe_oa_config_locked() propagates the error without any cleanup, so the syncs array and the fence references held by the parsed entries are leaked. The next config ioctl overwrites stream->syncs, making the memory unreachable for good.
Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching the cleanup done by the stream open error path.
--- drivers/gpu/drm/xe/xe_oa.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/xe/xe_oa.c +4 -0
@@ -1568,6 +1568,10 @@ static long xe_oa_config_locked(struct xe_oa_stream *stream, u64 arg) config =xchg (&stream->oa_config, config);drm_dbg (&stream->oa->xe->drm,"changed to oa config uuid=%s\n" , stream->oa_config->uuid); + }else { +while (param.num_syncs--) +xe_sync_entry_cleanup (¶m.syncs[param.num_syncs]); +kfree (param.syncs); } err_config_put:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 221/228 drm/xe/oa: Check managed mutex initialization errors
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <[email protected]>
[ Upstream commit f110dbbfa2a94c91704bf19806907a98fd73ca14 ]
drmm_mutex_init() can fail while registering its managed cleanup action. On failure, the reset path destroys the mutex, so continuing OA setup leaves an unusable lock that later paths may acquire.
Return the error from per-GT OA initialization and abort device-wide OA initialization if the metrics lock cannot be initialized.
--- drivers/gpu/drm/xe/xe_oa.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/xe/xe_oa.c +5 -4
@@ -2695,9 +2695,7 @@ static int xe_oa_init_gt(struct xe_gt *gt)__xe_oa_init_oa_units (gt); -drmm_mutex_init (>_to_xe (gt)->drm, >->oa.gt_lock); - -return 0 ; +return drmm_mutex_init (>_to_xe (gt)->drm, >->oa.gt_lock); }static void xe_oa_print_gt_oa_units (struct xe_gt *gt)
@@ -2837,7 +2835,10 @@ int xe_oa_init(struct xe_device *xe) oa->xe = xe; oa->oa_formats = oa_formats; -drmm_mutex_init (&oa->xe->drm, &oa->metrics_lock); + ret =drmm_mutex_init (&oa->xe->drm, &oa->metrics_lock); +if (ret) + goto exit; +idr_init_base (&oa->metrics_idr,1 ); ret =xe_oa_init_oa_units (oa);
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 222/228 drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nareshkumar Gollakoti <[email protected]>
[ Upstream commit d0672008cde3a8616c517d53d657300dce3c36a7 ]
While previously applied only to both tiles GT0(Graphics) and Media(GT1) the BMG G21(Battle image) platform via workaround Wa_14022085890, this 1.2 GHz minimum is now the default for GT0(Graphics) tile of BMG and CRI platforms.
Setting this frequency floor(1.2GHz) default is critical in multi GPU environment for supporting effective Peer-to-Peer(P2P) transactions.
v2:
- Fix Indentation(Thomas)
- Add comment about power impact(Stuart)
v3:(Thomas/Ankur/Matt Roper)
- Add setting frequency to only GT0(Graphics) Tile of BMG/CRI
v4:(Stuart)
- Move WA check to pc_needs_min_freq_change function
Stable-dep-of: 5cf82c8cec90 ("drm/xe: Fix a bug in pc_adjust_freq_bounds()")
--- drivers/gpu/drm/xe/xe_guc_pc.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_guc_pc.c +30 -2
@@ -890,9 +890,26 @@ void xe_guc_pc_init_early(struct xe_guc_pc *pc)pc_init_fused_rp_values (pc); } +static bool pc_needs_min_freq_change (struct xe_guc_pc *pc) +{ +struct xe_device *xe =pc_to_xe (pc); +struct xe_gt *gt =pc_to_gt (pc); + +if (XE_DEVICE_WA (xe,14022085890 )) +return true; + +if (xe_gt_is_media_type (gt)) +return false; + +if (xe->info.platform ==XE_BATTLEMAGE || + xe->info.platform ==XE_CRESCENTISLAND ) +return true; + +return false; +} +static int pc_adjust_freq_bounds (struct xe_guc_pc *pc) { -struct xe_tile *tile =gt_to_tile (pc_to_gt (pc));int ret;lockdep_assert_held (&pc->freq_lock);
@@ -919,7 +936,18 @@ static int pc_adjust_freq_bounds(struct xe_guc_pc *pc)if (pc_get_min_freq (pc) > pc->rp0_freq) ret =pc_set_min_freq (pc, pc->rp0_freq); -if (XE_DEVICE_WA (tile_to_xe (tile),14022085890 )) +/* +* Setting GT RP min frequency to 1.2GHz by default for +* GT0(Graphics) Tile of BMG and CRI. +* +* While BMG G21 WA will apply min frequency for +* both GT0(Graphics) and GT1(Media) Tile. +* +* This is an active frequency, so if the device is idle +* we aren't expecting high power output across board +* +*/ +if (pc_needs_min_freq_change (pc)) ret =pc_set_min_freq (pc,max (BMG_MIN_FREQ ,pc_get_min_freq (pc))); out:
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 223/228 drm/xe: Fix a bug in pc_adjust_freq_bounds()
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinay Belgaumkar <[email protected]>
[ Upstream commit 5cf82c8cec90056511eb881a267aab6101eaf57a ]
In cases where min frequency was actually greater than BMG_MIN_FREQ, we were not using the updated min frequency as there was a missing call to pc_action_query_task_state() between the two settings of min frequency. Since we know what min_freq was last set, use that cached value while comparing to BMG_MIN_FREQ to fix this issue.
v2: pc->freq_ready is not set until after pc_adjust_freq_bounds(). Stay with pc_action_query_task_state() instead.
v3: Update commit message (Stuart)
--- drivers/gpu/drm/xe/xe_guc_pc.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/gpu/drm/xe/xe_guc_pc.c +10 -3
@@ -911,6 +911,7 @@ static bool pc_needs_min_freq_change(struct xe_guc_pc *pc)static int pc_adjust_freq_bounds (struct xe_guc_pc *pc) {int ret; +u32 min_freq;lockdep_assert_held (&pc->freq_lock);
@@ -933,8 +934,14 @@ static int pc_adjust_freq_bounds(struct xe_guc_pc *pc)* Same thing happens for Server platforms where min is listed as * RPMax */ -if (pc_get_min_freq (pc) > pc->rp0_freq) + min_freq =pc_get_min_freq (pc); +if (min_freq > pc->rp0_freq) { ret =pc_set_min_freq (pc, pc->rp0_freq); +if (ret) + goto out; + + min_freq = pc->rp0_freq; + }/* * Setting GT RP min frequency to 1.2GHz by default for
@@ -947,8 +954,8 @@ static int pc_adjust_freq_bounds(struct xe_guc_pc *pc)* we aren't expecting high power output across board * */ -if (pc_needs_min_freq_change (pc)) - ret =pc_set_min_freq (pc,max (BMG_MIN_FREQ ,pc_get_min_freq (pc))); +if (pc_needs_min_freq_change (pc) && min_freq <BMG_MIN_FREQ ) + ret =pc_set_min_freq (pc,BMG_MIN_FREQ ); out:return ret;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 224/228 drm/log: Fix division by zero when scale module parameter is 0
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shixiong Ou <[email protected]>
[ Upstream commit 921ac6cb066d09b5765db892d0db0ffaffa98767 ]
The scale module parameter can be set to 0 via kernel command line. When scale is 0, scaled_font_h and scaled_font_w become 0, causing a division by zero in the rows/columns calculation.
Since the scale module parameter is read-only (0444 permissions), it cannot be changed at runtime via sysfs. Clamp it to 1 once in drm_log_register().
--- drivers/gpu/drm/clients/drm_log.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/clients/drm_log.c +3 -0
@@ -419,6 +419,9 @@ void drm_log_register(struct drm_device *dev) {struct drm_log *new; +if (!scale) + scale =1 ; + new =kzalloc_obj (*new);if (!new) goto err_warn;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 225/228 drm/log: Fix out-of-bounds read on empty message length
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shixiong Ou <[email protected]>
[ Upstream commit 60baa179ed1333535f6e2da4133511db55278ee4 ]
drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read.
Add an early return when len is 0.
--- drivers/gpu/drm/clients/drm_log.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/clients/drm_log.c +3 -0
@@ -160,6 +160,9 @@ static void drm_log_draw_kmsg_record(struct drm_log_scanout *scanout, {u32 prefix_len =0 ; +if (!len) +return ; +if (len >TS_PREFIX_LEN && s[0 ] =='[' && s[6 ] =='.' && s[TS_PREFIX_LEN ] ==']' ) prefix_len =TS_PREFIX_LEN +1 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 226/228 drm/log: Fix infinite loop when scale is too large for display
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shixiong Ou <[email protected]>
[ Upstream commit f4f2bba28df9b9aaa00262a462139dbbcdc38d9f ]
When scale is large enough that scaled_font exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in drm_log_draw_kmsg_record() because the loop never decrements len.
Check for zero rows/columns in drm_log_setup_modeset() and return an error, cleaning up the already allocated buffer to avoid a leak.
--- drivers/gpu/drm/clients/drm_log.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/clients/drm_log.c +6 -0
@@ -218,6 +218,12 @@ static int drm_log_setup_modeset(struct drm_client_dev *client, scanout->scaled_font_w = scanout->font->width * scale; scanout->rows = height / scanout->scaled_font_h; scanout->columns = width / scanout->scaled_font_w; +if (!scanout->rows || !scanout->columns) { +drm_client_buffer_delete (scanout->buffer); + scanout->buffer =NULL ; + mode_set->fb =NULL ; +return -EINVAL ; + } scanout->front_color =drm_draw_color_from_xrgb8888 (0xffffff , format); scanout->prefix_color =drm_draw_color_from_xrgb8888 (0x4e9a06 , format);return 0 ;
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 227/228 spi: virtio: mark device ready before registering the controller
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jasper Wise <[email protected]>
[ Upstream commit 11058bd3d47d57eb3473935feae53868d6d168b7 ]
virtio_spi_probe() registers the SPI controller with devm_spi_register_controller(). spi_register_controller() binds a child inline unless its driver has asked for asynchronous probing, so a peripheral that performs a transfer during its own probe reaches virtio_spi_transfer_one(), which kicks the virtqueue before probe has returned.
The driver never calls virtio_device_ready(), so DRIVER_OK is set on its behalf by virtio_dev_probe(), only once probe has returned. The virtio spec is explicit about that ordering in 3.1 Device Initialization:
| The driver MUST NOT send any buffer available notifications to the | device before setting DRIVER_OK.
A device that waits for DRIVER_OK before servicing the queue therefore leaves the transfer unanswered, and virtio_spi_transfer_one() waits for its completion with no timeout, so probe never returns.
Mark the device ready before registering the controller, as done for the same reason in commit f5866db64f34 ("virtio_console: enable VQs early") and commit 1d774589f924 ("i2c: virtio: mark device ready before registering the adapter").
--- drivers/spi/spi-virtio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-virtio.c +2 -0
@@ -358,6 +358,8 @@ static int virtio_spi_probe(struct virtio_device *vdev)if (ret)return dev_err_probe (&vdev->dev, ret,"Cannot register virtqueue cleanup\n" ); +virtio_device_ready (vdev); +/* Use devm version to register controller */ ret =devm_spi_register_controller (&vdev->dev, ctrl);if (ret)
Signature · 1 line
2.53.0
Greg Kroah-Hartman
maintainerPATCH 228/228 erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
In reply to Greg Kroah-Hartman7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
[ Upstream commit a64d500b0078e16e9abb25baca4dee1dbc9054fc ]
CONFIG_NR_CPUS doesn't define on some UP platforms (e.g. arm), so this can cause make oldconfig to loop indefinitely when CONFIG_SMP=n:
$ make ARCH=arm allmodconfig $ sed -i "/CONFIG_SMP=y/d" .config $ sed -i "/CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS.*/d" .config
EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW) EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW)
...
Let's guard NR_CPUS with SMP instead of using a hardcoded arbitrary CPU uplimit here, similar to commit a3344078101c ("mm: make SPLIT_PTE_PTLOCKS depend on SMP").
The initial report from SJ Park was for m68k [1] (m68k is the only arch without NR_CPUS in Kconfig), and that got fixed in commit 1fd495ef09ee ("m68k: Define NR_CPUS to 1")
--- fs/erofs/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/erofs/Kconfig +2 -1
@@ -134,7 +134,8 @@ config EROFS_FS_ZIP_LZMA config EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS int "EROFS LZMA default maximum decompression streams" depends on EROFS_FS_ZIP_LZMA - range 1 NR_CPUS + range 1 NR_CPUS if SMP + range 1 1 if !SMP default 16 help By default EROFS allocates one LZMA decompression stream per CPU.
Signature · 1 line
2.53.0
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 7.1.10-rc1-g02db8575a623 #1 SMP PREEMPT_DYNAMIC Thu Aug 20 15:17:07 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Hi
kernel build / boot test on x86_64 (Intel).
No regressions here.
Thanks
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-7.1.y
Best regards,
Pavel
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.10-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-7.1.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 8 lines · On Thu, 20 Aug 2026 16:52:22 +0200 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64 and arm32:
Thanks!
Cheers,
Miguel
Hi Greg
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.10-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-7.1.y
and the diffstat can be found below.thanks,
greg k-h
Linux version 7.1.10-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 7.1.10-rc1rv-g02db8575a623
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 16.2.1 20260810, GNU ld (GNU Binutils) 2.47) #1 SMP PREEMPT_DYNAMIC Fri Aug 21 19:13:06 JST 2026
Thanks
Am 20.08.2026 um 16:52 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.10-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-7.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 Aug 2026 14:51:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.10-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-7.1.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
hello,
Compiled and booted 7.1.10-rc1 (using qemu-system-x86_64)
No new typical dmesg regressions .
--
software engineer
rajagiri school of engineering and technology
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 7.1.10 release. There are 228 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.