5.12.5-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.12.5-rc1 review
This is the start of the stable review cycle for the 5.12.5 release. There are 363 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 19 May 2021 14:02:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.12.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.12.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.12.5-rc1
Kuninori Morimoto <[email protected]>
ASoC: rsnd: check all BUSIF status when error
Christoph Hellwig <[email protected]>
nvme: do not try to reconfigure APST when the controller is not live
Arnd Bergmann <[email protected]>
ext4: fix debug format string warning
Kees Cook <[email protected]>
debugfs: Make debugfs_allow RO after init
Geert Uytterhoeven <[email protected]>
dt-bindings: PCI: rcar-pci-host: Document missing R-Car H1 support
Zhen Lei <[email protected]>
dt-bindings: serial: 8250: Remove duplicated compatible strings
Dmitry Baryshkov <[email protected]>
dt-bindings: phy: qcom,qmp-usb3-dp-phy: move usb3 compatibles back to qcom,qmp-phy.yaml
Geert Uytterhoeven <[email protected]>
arm64: dts: renesas: falcon: Move console config to CPU board DTS
Niklas Söderlund <[email protected]>
dt-bindings: thermal: rcar-gen3-thermal: Support five TSC nodes on r8a779a0
Geert Uytterhoeven <[email protected]>
dt-bindings: media: renesas,vin: Make resets optional on R-Car Gen1
Qii Wang <[email protected]>
i2c: mediatek: Fix send master code at more than 1MHz
Fabio Estevam <[email protected]>
media: rkvdec: Remove of_match_ptr()
Enric Balletbo i Serra <[email protected]>
soc: mediatek: pm-domains: Add a power domain names for mt8192
Enric Balletbo i Serra <[email protected]>
soc: mediatek: pm-domains: Add a power domain names for mt8183
Enric Balletbo i Serra <[email protected]>
soc: mediatek: pm-domains: Add a meaningful power domain name
Paweł Chmiel <[email protected]>
clk: exynos7: Mark aclk_fsys1_200 as critical
Stéphane Marchesin <[email protected]>
drm/i915: Fix crash in auto_retire
Tvrtko Ursulin <[email protected]>
drm/i915/overlay: Fix active retire callback alignment
Ville Syrjälä <[email protected]>
drm/i915: Read C0DRB3/C1DRB3 as 16 bits again
Kuogee Hsieh <[email protected]>
drm/msm/dp: check sink_count before update is_connected status
Lv Yunlong <[email protected]>
drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp
Greg Kroah-Hartman <[email protected]>
kobject_uevent: remove warning in init_uevent_argv()
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Fix error while calculating PPS out values
Tony Lindgren <[email protected]>
clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940
Tony Lindgren <[email protected]>
clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue
Maciej W. Rozycki <[email protected]>
MIPS: Avoid handcoded DIVU in `__div64_32' altogether
Maciej W. Rozycki <[email protected]>
MIPS: Avoid DIVU in `__div64_32' is result would be zero
Maciej W. Rozycki <[email protected]>
MIPS: Reinstate platform `__div64_32' handler
Matthew Wilcox (Oracle) <[email protected]>
mm: fix struct page layout on 32-bit systems
Sean Christopherson <[email protected]>
KVM: VMX: Disable preemption when probing user return MSRs
Sean Christopherson <[email protected]>
KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported
Vitaly Kuznetsov <[email protected]>
KVM: nVMX: Always make an attempt to map eVMCS after migration
Sean Christopherson <[email protected]>
KVM: x86: Add support for RDPID without RDTSCP
Sean Christopherson <[email protected]>
KVM: x86: Move RDPID emulation intercept to its own enum
Sean Christopherson <[email protected]>
KVM: x86: Emulate RDPID only if RDTSCP is supported
Juergen Gross <[email protected]>
xen/gntdev: fix gntdev_mmap() error exit path
Alexandre Belloni <[email protected]>
alarmtimer: Check RTC features instead of ops
Oliver Neukum <[email protected]>
cdc-wdm: untangle a circular dependency between callback and softint
Colin Ian King <[email protected]>
iio: tsl2583: Fix division by a zero lux_val
Dmitry Osipenko <[email protected]>
iio: gyro: mpu3050: Fix reported temperature value
Tomasz Duszynski <[email protected]>
iio: core: fix ioctl handlers removal
Sandeep Singh <[email protected]>
xhci: Add reset resume quirk for AMD xhci controller.
Christophe JAILLET <[email protected]>
xhci: Do not use GFP_KERNEL in (potentially) atomic context
Mathias Nyman <[email protected]>
xhci: Fix giving back cancelled URBs even if halted endpoint can't reset
Abhijeet Rao <[email protected]>
xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI
Andy Shevchenko <[email protected]>
usb: typec: ucsi: Put fwnode in any case during ->probe()
Jack Pham <[email protected]>
usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4
Kyle Tso <[email protected]>
usb: typec: tcpm: Fix wrong handling in GET_SINK_CAP
Wesley Cheng <[email protected]>
usb: dwc3: gadget: Return success always for kick transfer in ep queue
Jack Pham <[email protected]>
usb: dwc3: gadget: Enable suspend events
Zhen Lei <[email protected]>
usb: dwc3: imx8mp: fix error return code in dwc3_imx8mp_probe()
Chunfeng Yun <[email protected]>
usb: core: hub: fix race condition about TRSMRCY of resume
Phil Elwell <[email protected]>
usb: dwc2: Fix gadget DMA unmap direction
Maximilian Luz <[email protected]>
usb: xhci: Increase timeout for HC halt
Ferry Toth <[email protected]>
usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield
Marcel Hamer <[email protected]>
usb: dwc3: omap: improve extcon initialization
Bart Van Assche <[email protected]>
blk-mq: Swap two calls in blk_mq_exit_queue()
Ming Lei <[email protected]>
blk-mq: plug request for shared sbitmap
Nicholas Piggin <[email protected]>
powerpc/64s: Make NMI record implicitly soft-masked code as irqs disabled
Sun Ke <[email protected]>
nbd: Fix NULL pointer in flush_workqueue
Gautham R. Shenoy <[email protected]>
sched/fair: Fix clearing of has_idle_cores flag in select_idle_cpu()
Chao Yu <[email protected]>
f2fs: compress: fix to assign cc.cluster_idx correctly
Chao Yu <[email protected]>
f2fs: compress: fix race condition of overwrite vs truncate
Chao Yu <[email protected]>
f2fs: compress: fix to free compress page correctly
Michal Kalderon <[email protected]>
nvmet-rdma: Fix NULL deref when SEND is completed with error
Chaitanya Kulkarni <[email protected]>
nvmet: fix inline bio check for passthru
Chaitanya Kulkarni <[email protected]>
nvmet: fix inline bio check for bdev-ns
Omar Sandoval <[email protected]>
kyber: fix out of bounds access when preempted
Christophe JAILLET <[email protected]>
ACPI: scan: Fix a memory leak in an error handling path
Andy Shevchenko <[email protected]>
hwmon: (ltc2992) Put fwnode in error case during ->probe()
Christophe JAILLET <[email protected]>
usb: musb: Fix an error message
Kyle Tso <[email protected]>
usb: typec: tcpm: Fix wrong handling for Not_Supported in VDM AMS
Eddie James <[email protected]>
hwmon: (occ) Fix poll rate limiting
Christophe JAILLET <[email protected]>
usb: fotg210-hcd: Fix an error message
Alexandru Ardelean <[email protected]>
iio: core: return ENODEV if ioctl is unknown
Alexandru Ardelean <[email protected]>
iio: hid-sensors: select IIO_TRIGGERED_BUFFER under HID_SENSOR_IIO_TRIGGER
Dinghao Liu <[email protected]>
iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
Dinghao Liu <[email protected]>
iio: light: gp2ap002: Fix rumtime PM imbalance on error
Jack Pham <[email protected]>
usb: dwc3: gadget: Free gadget structure only after freeing endpoints
Jiri Olsa <[email protected]>
perf tools: Fix dynamic libbpf link
Zhen Lei <[email protected]>
xen/unpopulated-alloc: fix error return code in fill_list()
Vivek Goyal <[email protected]>
dax: Wake up all waiters after invalidating dax entry
Vivek Goyal <[email protected]>
dax: Add a wakeup mode parameter to put_unlocked_entry()
Vivek Goyal <[email protected]>
dax: Add an enum for specifying dax wakup mode
Tom Lendacky <[email protected]>
KVM: SVM: Move GHCB unmapping to fix RCU warning
Thomas Gleixner <[email protected]>
KVM: x86: Prevent deadlock against tk_core.seq
Thomas Gleixner <[email protected]>
KVM: x86: Cancel pvclock_gtod_work on module removal
Kuogee Hsieh <[email protected]>
drm/msm/dp: initialize audio_comp when audio starts
Wanpeng Li <[email protected]>
KVM: LAPIC: Accurately guarantee busy wait for timer to expire when using hv_timer
Jonathan Marek <[email protected]>
drm/msm: fix LLC not being enabled for mmu500 targets
Benjamin Segall <[email protected]>
kvm: exit halt polling on need_resched() as well
Kai-Heng Feng <[email protected]>
drm/i915/dp: Use slow and wide link training for everything
Ville Syrjälä <[email protected]>
drm/i915: Avoid div-by-zero on gen2
David Ward <[email protected]>
drm/amd/display: Initialize attribute for hdcp_srm sysfs file
Kai-Heng Feng <[email protected]>
drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected
Naohiro Aota <[email protected]>
btrfs: zoned: sanity check zone type
Tom Rix <[email protected]>
btrfs: initialize return variable in cleanup_free_space_cache_v1
Filipe Manana <[email protected]>
btrfs: fix race leading to unpersisted data and metadata on fsync
Filipe Manana <[email protected]>
btrfs: zoned: fix silent data loss after failure splitting ordered extent
Filipe Manana <[email protected]>
btrfs: fix deadlock when cloning inline extents and using qgroups
Catalin Marinas <[email protected]>
arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache()
Peter Collingbourne <[email protected]>
arm64: mte: initialize RGSR_EL1.SEED in __cpu_setup
Huang Rui <[email protected]>
x86, sched: Fix the AMD CPPC maximum performance value on certain AMD Ryzen generations
Tejun Heo <[email protected]>
blk-iocost: fix weight updates of inner active iocgs
Peter Xu <[email protected]>
mm/hugetlb: fix cow where page writtable in child
Peter Xu <[email protected]>
mm/hugetlb: fix F_SEAL_FUTURE_WRITE
Peter Collingbourne <[email protected]>
kasan: fix unit tests with CONFIG_UBSAN_LOCAL_BOUNDS enabled
Axel Rasmussen <[email protected]>
userfaultfd: release page in error path to avoid BUG_ON
Phillip Lougher <[email protected]>
squashfs: fix divide error in calculate_skip()
Jouni Roivas <[email protected]>
hfsplus: prevent corruption in shrinking truncate
Michael Ellerman <[email protected]>
powerpc/64s: Fix crashes when toggling entry flush barrier
Michael Ellerman <[email protected]>
powerpc/64s: Fix crashes when toggling stf barrier
Eric Dumazet <[email protected]>
sh: Remove unused variable
Vladimir Isaev <[email protected]>
ARC: mm: Use max_high_pfn as a HIGHMEM zone border
Vladimir Isaev <[email protected]>
ARC: mm: PAE: use 40-bit physical page mask
Vineet Gupta <[email protected]>
ARC: entry: fix off-by-one error in syscall number validation
Paolo Abeni <[email protected]>
mptcp: fix splat when closing unaccepted socket
Arkadiusz Kubalewski <[email protected]>
i40e: Remove LLDP frame filters
Mateusz Palczewski <[email protected]>
i40e: Fix PHY type identifiers for 2.5G and 5G adapters
Jaroslaw Gawin <[email protected]>
i40e: fix the restart auto-negotiation after FEC modified
Yunjian Wang <[email protected]>
i40e: Fix use-after-free in i40e_client_subtask()
Magnus Karlsson <[email protected]>
i40e: fix broken XDP support
Eric Dumazet <[email protected]>
netfilter: nftables: avoid overflows in nft_hash_buckets()
David Hildenbrand <[email protected]>
kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM resources
David Hildenbrand <[email protected]>
kernel/resource: make walk_system_ram_res() find all busy IORESOURCE_SYSTEM_RAM resources
Jia-Ju Bai <[email protected]>
kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
Colin Ian King <[email protected]>
fs/proc/generic.c: fix incorrect pde_is_permanent check
Alex Elder <[email protected]>
net: ipa: fix inter-EE IRQ register definitions
Odin Ugedal <[email protected]>
sched/fair: Fix unfairness caused by missing load decay
Quentin Perret <[email protected]>
sched: Fix out-of-bound access in uclamp
Marc Kleine-Budde <[email protected]>
can: m_can: m_can_tx_work_queue(): fix tx_skb race condition
Frieder Schrempf <[email protected]>
can: mcp251x: fix resume from sleep before interface was brought up
Marc Kleine-Budde <[email protected]>
can: mcp251xfd: mcp251xfd_probe(): add missing can_rx_offload_del() in error path
Dan Carpenter <[email protected]>
can: mcp251xfd: mcp251xfd_probe(): fix an error pointer dereference in probe
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: Fix a memleak from userdata error path in new objects
Pablo Neira Ayuso <[email protected]>
netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check
Cong Wang <[email protected]>
smc: disallow TCP_ULP in smc_setsockopt()
Maciej Żenczykowski <[email protected]>
net: fix nla_strcmp to handle more then one trailing null character
Fernando Fernandez Mancera <[email protected]>
ethtool: fix missing NLM_F_MULTI flag when dumping
Marco Elver <[email protected]>
kfence: await for allocation using wait_event
Pavel Tatashin <[email protected]>
mm/gup: check for isolation errors
Pavel Tatashin <[email protected]>
mm/gup: return an error on migration failure
Pavel Tatashin <[email protected]>
mm/gup: check every subpage of a compound page during isolation
Miaohe Lin <[email protected]>
ksm: fix potential missing rmap_item for stable_node
Miaohe Lin <[email protected]>
mm/migrate.c: fix potential indeterminate pte entry in migrate_vma_insert_page()
Miaohe Lin <[email protected]>
mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts()
Miaohe Lin <[email protected]>
khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate()
Sasha Levin <[email protected]>
arm64: entry: always set GIC_PRIO_PSR_I_SET during entry
Marc Zyngier <[email protected]>
arm64: entry: factor irq triage logic into macros
Kees Cook <[email protected]>
drm/radeon: Avoid power table parsing memory leaks
Kees Cook <[email protected]>
drm/radeon: Fix off-by-one power_state index heap overwrite
Ramesh Babu B <[email protected]>
net: stmmac: Clear receive all(RA) bit when promiscuous mode is off
Sandipan Das <[email protected]>
powerpc/powernv/memtrace: Fix dcache flushing
Xuan Zhuo <[email protected]>
xsk: Fix for xp_aligned_validate_desc() when len == chunk_size
Pablo Neira Ayuso <[email protected]>
netfilter: xt_SECMARK: add new revision to fix structure layout
Xin Long <[email protected]>
sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
Lv Yunlong <[email protected]>
ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
Jim Quinlan <[email protected]>
PCI: brcmstb: Use reset/rearm instead of deassert/assert
Jim Quinlan <[email protected]>
ata: ahci_brcm: Fix use of BCM7216 reset controller
Md Haris Iqbal <[email protected]>
block/rnbd-clt: Check the return value of the function rtrs_clt_query
Md Haris Iqbal <[email protected]>
block/rnbd-clt: Change queue_depth type in rnbd_clt_session to size_t
Brendan Jackman <[email protected]>
libbpf: Fix signed overflow in ringbuf_process_ring
Baptiste Lepers <[email protected]>
sunrpc: Fix misplaced barrier in call_decode
Anup Patel <[email protected]>
RISC-V: Fix error code returned by riscv_hartid_to_cpuid()
Xin Long <[email protected]>
sctp: do asoc update earlier in sctp_sf_do_dupcook_a
Yufeng Mo <[email protected]>
net: hns3: disable phy loopback setting in hclge_mac_start_phy
Peng Li <[email protected]>
net: hns3: use netif_tx_disable to stop the transmit queue
Hao Chen <[email protected]>
net: hns3: fix for vxlan gpe tx checksum bug
Mark Rutland <[email protected]>
arm64: stacktrace: restore terminal records
Jian Shen <[email protected]>
net: hns3: add check for HNS3_NIC_STATE_INITED in hns3_reset_notify_up_enet()
Yufeng Mo <[email protected]>
net: hns3: initialize the message content in hclge_get_link_mode()
Yufeng Mo <[email protected]>
net: hns3: fix incorrect configuration for igu_egu_hw_err
Nobuhiro Iwamatsu <[email protected]>
rtc: ds1307: Fix wday settings for rx8130
Can Guo <[email protected]>
scsi: ufs: core: Narrow down fast path in system suspend path
Can Guo <[email protected]>
scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend
Can Guo <[email protected]>
scsi: ufs: core: Do not put UFS power into LPM if link is broken
Anastasia Kovaleva <[email protected]>
scsi: qla2xxx: Prevent PRLI in target mode
Jeff Layton <[email protected]>
ceph: fix inode leak on getattr error in __fh_to_dentry
Claire Chang <[email protected]>
swiotlb: Fix the type of index
Nathan Chancellor <[email protected]>
riscv: Select HAVE_DYNAMIC_FTRACE when -fpatchable-function-entry is available
Chuck Lever <[email protected]>
xprtrdma: rpcrdma_mr_pop() already does list_del_init()
Chuck Lever <[email protected]>
xprtrdma: Fix cwnd update ordering
Chuck Lever <[email protected]>
xprtrdma: Avoid Receive Queue wrapping
Uwe Kleine-König <[email protected]>
pwm: atmel: Fix duty cycle calculation in .get_state()
Yunjian Wang <[email protected]>
SUNRPC: Fix null pointer dereference in svc_rqst_free()
Dan Carpenter <[email protected]>
SUNRPC: fix ternary sign expansion bug in tracing
Dave Jiang <[email protected]>
dmaengine: idxd: fix cdev setup and free device lifetime issues
Dave Jiang <[email protected]>
dmaengine: idxd: fix group conf_dev lifetime
Dave Jiang <[email protected]>
dmaengine: idxd: fix engine conf_dev lifetime
Dave Jiang <[email protected]>
dmaengine: idxd: fix wq conf_dev 'struct device' lifetime
Dave Jiang <[email protected]>
dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime
Dave Jiang <[email protected]>
dmaengine: idxd: use ida for device instance enumeration
Dave Jiang <[email protected]>
dmaengine: idxd: removal of pcim managed mmio mapping
Dave Jiang <[email protected]>
dmaengine: idxd: cleanup pci interrupt vector allocation management
Dave Jiang <[email protected]>
dmaengine: idxd: fix dma device lifetime
Colin Ian King <[email protected]>
dmaengine: idxd: Fix potential null dereference on pointer status
Michael Walle <[email protected]>
rtc: fsl-ftm-alarm: add MODULE_TABLE()
J. Bruce Fields <[email protected]>
nfsd: ensure new clients break delegations
Trond Myklebust <[email protected]>
NFSv4.x: Don't return NFS4ERR_NOMATCHING_LAYOUT if we're unmounting
Guangqing Zhu <[email protected]>
thermal/drivers/tsens: Fix missing put_device error
Trond Myklebust <[email protected]>
NFSv42: Copy offload should update the file size when appropriate
Chris Dion <[email protected]>
SUNRPC: Handle major timeout in xprt_adjust_timeout()
Chuck Lever <[email protected]>
SUNRPC: Remove trace_xprt_transmit_queued
Chuck Lever <[email protected]>
SUNRPC: Move fault injection call sites
Olga Kornievskaia <[email protected]>
NFSv4.2 fix handling of sr_eof in SEEK's reply
Nikola Livic <[email protected]>
pNFS/flexfiles: fix incorrect size check in decode_nfs_fh()
Suman Anna <[email protected]>
remoteproc: pru: Fix and cleanup firmware interrupt mapping logic
Suman Anna <[email protected]>
remoteproc: pru: Fix wrong success return value for fw events
Suman Anna <[email protected]>
remoteproc: pru: Fixup interrupt-parent logic for fw events
Yang Yingliang <[email protected]>
PCI: endpoint: Fix missing destroy_workqueue()
Trond Myklebust <[email protected]>
NFS: Deal correctly with attribute generation counter overflow
Trond Myklebust <[email protected]>
NFSv4.2: Always flush out writes in nfs42_proc_fallocate()
Trond Myklebust <[email protected]>
NFS: Fix attribute bitmask in _nfs42_proc_fallocate()
Trond Myklebust <[email protected]>
NFS: nfs4_bitmask_adjust() must not change the server global bitmasks
Jia-Ju Bai <[email protected]>
rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()
Chao Yu <[email protected]>
f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block()
Trond Myklebust <[email protected]>
NFS: Only change the cookie verifier if the directory page cache is empty
Trond Myklebust <[email protected]>
NFS: Fix handling of cookie verifier in uncached_readdir()
Nagendra S Tomar <[email protected]>
nfs: Subsequent READDIR calls should carry non-zero cookieverifier
Yi Zhuang <[email protected]>
f2fs: Fix a hungtask problem in atomic write
Chao Yu <[email protected]>
f2fs: fix to restrict mount condition on readonly block device
Yang Yingliang <[email protected]>
fs: 9p: fix v9fs_file_open writeback fid error check
Chao Yu <[email protected]>
f2fs: fix to cover __allocate_new_section() with curseg_lock
Chao Yu <[email protected]>
f2fs: fix to avoid touching checkpointed data in get_victim()
Shradha Todi <[email protected]>
PCI: endpoint: Fix NULL pointer dereference for ->get_features()
Chao Yu <[email protected]>
f2fs: fix to update last i_size if fallocate partially succeeds
Chao Yu <[email protected]>
f2fs: fix to align to section for fallocate() on pinned file
Zhen Lei <[email protected]>
ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook
Dmitry Baryshkov <[email protected]>
PCI: Release OF node in pci_scan_device()'s error path
Wei Yongjun <[email protected]>
PCI: brcmstb: Fix error return code in brcm_pcie_probe()
Pali Rohár <[email protected]>
PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc()
Bjorn Andersson <[email protected]>
remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader
Arnd Bergmann <[email protected]>
rtc: tps65910: include linux/property.h
Colin Ian King <[email protected]>
f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
Chao Yu <[email protected]>
f2fs: fix panic during f2fs_resize_fs()
Chao Yu <[email protected]>
f2fs: fix to allow migrating fully valid segment
Qiuxu Zhuo <[email protected]>
PCI/RCEC: Fix RCiEP device to RCEC association
Jia-Ju Bai <[email protected]>
thermal: thermal_of: Fix error return code of thermal_of_populate_bind_params()
Arnd Bergmann <[email protected]>
leds: lgm: fix gpiolib dependency
David Ward <[email protected]>
ASoC: rt286: Make RT286_SET_GPIO_* readable and writable
Petr Mladek <[email protected]>
watchdog: cleanup handling of false positives
Petr Mladek <[email protected]>
watchdog: fix barriers when printing backtraces from all CPUs
Petr Mladek <[email protected]>
watchdog/softlockup: remove logic that tried to prevent repeated reports
Petr Mladek <[email protected]>
watchdog/softlockup: report the overall time of softlockups
Petr Mladek <[email protected]>
watchdog: explicitly update timestamp when reporting softlockup
Petr Mladek <[email protected]>
watchdog: rename __touch_watchdog() to a better descriptive name
Sergei Trofimovich <[email protected]>
ia64: module: fix symbolizer crash on fdescr
Michael Chan <[email protected]>
bnxt_en: Add PCI IDs for Hyper-V VF devices.
Masahiro Yamada <[email protected]>
kbuild: generate Module.symvers only when vmlinux exists
Petr Machata <[email protected]>
selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test
Petr Machata <[email protected]>
selftests: mlxsw: Increase the tolerance of backlog buildup
Felix Fietkau <[email protected]>
net: ethernet: mtk_eth_soc: fix RX VLAN offload
Stefan Assmann <[email protected]>
iavf: remove duplicate free resources calls
Alexey Kardashevskiy <[email protected]>
powerpc/iommu: Annotate nested lock for lockdep
Lee Gibson <[email protected]>
qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth
Gustavo A. R. Silva <[email protected]>
wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join
Gustavo A. R. Silva <[email protected]>
wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt
Sean Christopherson <[email protected]>
crypto: ccp: Free SEV device if SEV init fails
Felix Fietkau <[email protected]>
mt76: mt7615: fix entering driver-own state on mt7663
Jinzhou Su <[email protected]>
drm/amdgpu: Add mem sync flag for IB allocated by SA
Dingchen (David) Zhang <[email protected]>
drm/amd/display: add handling for hdcp2 rx id list validation
Robin Singh <[email protected]>
drm/amd/display: fixed divide by zero kernel crash during dsc enablement
Michael Ellerman <[email protected]>
powerpc/pseries: Stop calling printk in rtas_stop_self()
Yaqi Chen <[email protected]>
samples/bpf: Fix broken tracex1 due to kprobe argument change
Du Cheng <[email protected]>
net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule
Gustavo A. R. Silva <[email protected]>
ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user()
David Ward <[email protected]>
ASoC: rt286: Generalize support for ALC3263 codec
Emmanuel Grumbach <[email protected]>
mac80211: properly drop the connection in case of invalid CSA IE
David Mosberger-Tang <[email protected]>
wilc1000: Bring MAC address setting in line with typical Linux behavior
Srikar Dronamraju <[email protected]>
powerpc/smp: Set numa node before updating mask
Cédric Le Goater <[email protected]>
powerpc/xive: Use the "ibm, chip-id" property only under PowerNV
Gustavo A. R. Silva <[email protected]>
flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target()
Gustavo A. R. Silva <[email protected]>
sctp: Fix out-of-bounds warning in sctp_process_asconf_param()
Jarkko Nikula <[email protected]>
i2c: i801: Add support for Intel Alder Lake PCH-M
Kai Vehmanen <[email protected]>
ALSA: hda/hdmi: fix race in handling acomp ELD notification at resume
Vamshi Krishna Gopal <[email protected]>
ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo Ideapad S740
Mihai Moldovan <[email protected]>
kconfig: nconf: stop endless search loops
Yonghong Song <[email protected]>
selftests: Set CC to clang in lib.mk if LLVM is set
Anthony Wang <[email protected]>
drm/amd/display: Force vsync flip when reconfiguring MPCC
Suravee Suthikulpanit <[email protected]>
iommu/amd: Remove performance counter pre-initialization test
Paul Menzel <[email protected]>
Revert "iommu/amd: Fix performance counter initialization"
Florian Fainelli <[email protected]>
net: bridge: propagate error code and extack from br_mc_disabled_update
Kuninori Morimoto <[email protected]>
ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init()
Vaibhav Jain <[email protected]>
powerpc/mm: Add cond_resched() while removing hpte mappings
Johannes Berg <[email protected]>
iwlwifi: trans/pcie: defer transport initialisation
Mordechay Goodstein <[email protected]>
iwlwifi: queue: avoid memory leak in reset flow
Johannes Berg <[email protected]>
iwlwifi: pcie: make cfg vs. trans_cfg more robust
Miklos Szeredi <[email protected]>
cuse: prevent clone
Miklos Szeredi <[email protected]>
virtiofs: fix userns
Vivek Goyal <[email protected]>
fuse: invalidate attrs when page writeback completes
Ye Weihua <[email protected]>
i2c: imx: Fix PM reference leak in i2c_imx_reg_slave()
Ryder Lee <[email protected]>
mt76: mt7915: add wifi subsystem reset
Lorenzo Bianconi <[email protected]>
mt76: mt7921: fix key set/delete issue
Shayne Chen <[email protected]>
mt76: mt7915: fix txpower init for TSSI off chips
Felix Fietkau <[email protected]>
mt76: mt7915: fix key set/delete issue
Lorenzo Bianconi <[email protected]>
mt76: mt7915: always check return value from mt7915_mcu_alloc_wtbl_req
Lorenzo Bianconi <[email protected]>
mt76: connac: always check return value from mt76_connac_mcu_alloc_wtbl_req
David Bauer <[email protected]>
mt76: mt76x0: disable GTK offloading
Sander Vanheule <[email protected]>
mt76: mt7615: support loading EEPROM for MT7613BE
Felix Fietkau <[email protected]>
mt76: mt7615: fix key set/delete issues
Po-Hao Huang <[email protected]>
rtw88: 8822c: add LC calibration for RTL8822C
Krzysztof Kozlowski <[email protected]>
pinctrl: samsung: use 'int' for register masks in Exynos
Heiner Kallweit <[email protected]>
net: fec: use mac-managed PHY PM
Heiner Kallweit <[email protected]>
net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM
Gyeongtaek Lee <[email protected]>
ASoC: soc-compress: lock pcm_mutex to resolve lockdep error
Emmanuel Grumbach <[email protected]>
mac80211: clear the beacon's CRC after channel switch
Johan Almbladh <[email protected]>
mac80211: Set priority and queue mapping for injected frames
Mike Marciniszyn <[email protected]>
IB/hfi1: Correct oversized ring allocation
Suzuki K Poulose <[email protected]>
coresight: Do not scan for graph if none is present
Tiezhu Yang <[email protected]>
MIPS: Loongson64: Use _CACHE_UNCACHED instead of _CACHE_UNCACHED_ACCELERATED
Daniel Winkler <[email protected]>
Bluetooth: Do not set cur_adv_instance in adv param MGMT request
Bence Csókás <[email protected]>
i2c: Add I2C_AQ_NO_REP_START adapter quirk
Matthieu Baerts <[email protected]>
selftests: mptcp: launch mptcp_connect with timeout
Hans de Goede <[email protected]>
ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055
mark-yw.chen <[email protected]>
Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip.
Paul M Stillwell Jr <[email protected]>
ice: handle increasing Tx or Rx ring sizes
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet
Xiang Chen <[email protected]>
iommu/arm-smmu-v3: Add a check to avoid invalid iotlb sync
Marc Kleine-Budde <[email protected]>
can: dev: can_free_echo_skb(): don't crash the kernel if can_priv::echo_skb is accessed out of bounds
Eric Dumazet <[email protected]>
ip6_vti: proper dev_{hold|put} in ndo_[un]init methods
Yunsheng Lin <[email protected]>
net: hns3: add handling for xmit skb with recursive fraglist
Guangbin Huang <[email protected]>
net: hns3: remediate a potential overflow risk of bd_num_list
Christophe Leroy <[email protected]>
powerpc/32: Statically initialise first emergency context
Kai Vehmanen <[email protected]>
ALSA: hda/hdmi: fix max DP-MST dev_num for Intel TGL+ platforms
Russell Currey <[email protected]>
selftests/powerpc: Fix L1D flushing tests for Power10
Archie Pusaka <[email protected]>
Bluetooth: check for zapped sk before connecting
Nikolay Aleksandrov <[email protected]>
net: bridge: when suppression is enabled exclude RARP packets
Vladimir Oltean <[email protected]>
net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports
Tetsuo Handa <[email protected]>
Bluetooth: initialize skb_queue_head at l2cap_chan_create()
Archie Pusaka <[email protected]>
Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
Takashi Sakamoto <[email protected]>
ALSA: bebob: enable to deliver MIDI messages for multiple ports
Tong Zhang <[email protected]>
ALSA: rme9652: don't disable if not enabled
Tong Zhang <[email protected]>
ALSA: hdspm: don't disable if not enabled
Tong Zhang <[email protected]>
ALSA: hdsp: don't disable if not enabled
Wolfram Sang <[email protected]>
i2c: bail out early when RDWR parameters are wrong
Ayush Garg <[email protected]>
Bluetooth: Fix incorrect status handling in LE PHY UPDATE event
Mikhail Durnev <[email protected]>
ASoC: rsnd: core: Check convert rate in rsnd_hw_params
Jonathan McDowell <[email protected]>
net: stmmac: Set FIFO sizes for ipq806x
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Use net_prefetchw instead of prefetchw in MPWQE TX datapath
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF
Hoang Le <[email protected]>
tipc: convert dest node's address to network order
Alexander Aring <[email protected]>
fs: dlm: add shutdown hook
Alexander Aring <[email protected]>
fs: dlm: flush swork on shutdown
Alexander Aring <[email protected]>
fs: dlm: check on minimum msglen size
Alexander Aring <[email protected]>
fs: dlm: change allocation limits
Alexander Aring <[email protected]>
fs: dlm: add check if dlm is currently running
Alexander Aring <[email protected]>
fs: dlm: add errno handling to check callback
Alexander Aring <[email protected]>
fs: dlm: fix mark setting deadlock
Alexander Aring <[email protected]>
fs: dlm: fix debugfs dump
Nicolas MURE <[email protected]>
ALSA: usb-audio: Add Pioneer DJM-850 to quirks-table
Pradeep Kumar Chitrapu <[email protected]>
ath11k: fix thermal temperature read
David Matlack <[email protected]>
kvm: Cap halt polling at kvm->max_halt_poll_ns
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Use HWP if enabled by platform firmware
Tony Lindgren <[email protected]>
PM: runtime: Fix unpaired parent child_count for force_resume
Sumeet Pawnikar <[email protected]>
ACPI: PM: Add ACPI ID of Alder Lake Fan
Lai Jiangshan <[email protected]>
KVM/VMX: Invoke NMI non-IST entry instead of IST entry
Tom Lendacky <[email protected]>
KVM: SVM: Make sure GHCB is mapped before updating
Anand Jain <[email protected]>
btrfs: fix unmountable seed device after fstrim
Jarkko Sakkinen <[email protected]>
tpm, tpm_tis: Reserve locality in tpm_tis_resume()
Jarkko Sakkinen <[email protected]>
tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt()
Zhen Lei <[email protected]>
tpm: fix error return code in tpm2_get_cc_attrs_tbl()
Colin Ian King <[email protected]>
KEYS: trusted: Fix memory leak on object td
-------------
Diffstat:
.gitignore | 1 + .../devicetree/bindings/media/renesas,vin.yaml | 46 +- .../devicetree/bindings/pci/rcar-pci-host.yaml | 12 +- .../devicetree/bindings/phy/qcom,qmp-phy.yaml | 2 + .../bindings/phy/qcom,qmp-usb3-dp-phy.yaml | 2 - Documentation/devicetree/bindings/serial/8250.yaml | 5 - .../bindings/thermal/rcar-gen3-thermal.yaml | 43 +- Documentation/dontdiff | 1 + Makefile | 6 +- arch/arc/include/asm/page.h | 12 + arch/arc/include/asm/pgtable.h | 12 +- arch/arc/include/uapi/asm/page.h | 1 - arch/arc/kernel/entry.S | 4 +- arch/arc/mm/init.c | 11 +- arch/arc/mm/ioremap.c | 5 +- arch/arc/mm/tlb.c | 2 +- arch/arm/boot/dts/dra7-l4.dtsi | 4 +- arch/arm/boot/dts/dra7.dtsi | 20 + arch/arm/kernel/hw_breakpoint.c | 2 +- .../boot/dts/renesas/r8a779a0-falcon-cpu.dtsi | 8 + arch/arm64/boot/dts/renesas/r8a779a0-falcon.dts | 5 - arch/arm64/include/asm/daifflags.h | 3 + arch/arm64/kernel/entry-common.c | 17 - arch/arm64/kernel/entry.S | 91 ++-- arch/arm64/kernel/stacktrace.c | 10 +- arch/arm64/mm/flush.c | 4 +- arch/arm64/mm/proc.S | 12 + arch/ia64/include/asm/module.h | 6 +- arch/ia64/kernel/module.c | 29 +- arch/mips/include/asm/div64.h | 55 ++- arch/mips/kernel/cpu-probe.c | 3 - arch/powerpc/include/asm/interrupt.h | 7 + arch/powerpc/kernel/head_32.h | 6 +- arch/powerpc/kernel/iommu.c | 4 +- arch/powerpc/kernel/setup_32.c | 2 +- arch/powerpc/kernel/smp.c | 6 +- arch/powerpc/lib/feature-fixups.c | 35 +- arch/powerpc/mm/book3s64/hash_utils.c | 13 +- arch/powerpc/platforms/powernv/memtrace.c | 4 +- arch/powerpc/platforms/pseries/hotplug-cpu.c | 3 - arch/powerpc/sysdev/xive/common.c | 9 +- arch/powerpc/sysdev/xive/native.c | 6 + arch/powerpc/sysdev/xive/xive-internal.h | 1 + arch/riscv/Kconfig | 2 +- arch/riscv/kernel/smp.c | 2 +- arch/sh/kernel/traps.c | 1 - arch/x86/include/asm/idtentry.h | 15 + arch/x86/include/asm/kvm_host.h | 1 + arch/x86/include/asm/processor.h | 2 + arch/x86/kernel/cpu/amd.c | 16 + arch/x86/kernel/nmi.c | 10 + arch/x86/kernel/smpboot.c | 2 +- arch/x86/kvm/cpuid.c | 3 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/kvm_emulate.h | 1 + arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/svm/sev.c | 8 +- arch/x86/kvm/svm/svm.c | 11 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/vmx/nested.c | 29 +- arch/x86/kvm/vmx/vmx.c | 57 ++- arch/x86/kvm/x86.c | 42 +- block/bfq-iosched.c | 3 +- block/blk-iocost.c | 14 +- block/blk-mq-sched.c | 8 +- block/blk-mq.c | 11 +- block/kyber-iosched.c | 5 +- block/mq-deadline.c | 3 +- drivers/acpi/device_pm.c | 1 + drivers/acpi/scan.c | 1 + drivers/ata/ahci_brcm.c | 46 +- drivers/base/power/runtime.c | 10 +- drivers/block/nbd.c | 3 +- drivers/block/rnbd/rnbd-clt.c | 12 +- drivers/block/rnbd/rnbd-clt.h | 2 +- drivers/bluetooth/btusb.c | 4 +- drivers/char/tpm/tpm2-cmd.c | 1 + drivers/char/tpm/tpm_tis_core.c | 22 +- drivers/clk/samsung/clk-exynos7.c | 7 +- drivers/clocksource/timer-ti-dm-systimer.c | 144 +++++- drivers/cpufreq/acpi-cpufreq.c | 6 +- drivers/cpufreq/intel_pstate.c | 14 +- drivers/crypto/ccp/sev-dev.c | 4 +- drivers/dma/idxd/cdev.c | 129 ++---- drivers/dma/idxd/device.c | 25 +- drivers/dma/idxd/dma.c | 77 +++- drivers/dma/idxd/idxd.h | 89 +++- drivers/dma/idxd/init.c | 349 ++++++++++----- drivers/dma/idxd/irq.c | 10 +- drivers/dma/idxd/sysfs.c | 324 ++++++-------- drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 2 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 + drivers/gpu/drm/amd/display/dc/core/dc.c | 4 + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 15 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 2 + drivers/gpu/drm/i915/display/intel_dp.c | 59 +-- drivers/gpu/drm/i915/display/intel_overlay.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- drivers/gpu/drm/i915/gt/gen8_ppgtt.c | 1 - drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c | 4 +- drivers/gpu/drm/i915/i915_active.c | 3 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 9 +- drivers/gpu/drm/msm/dp/dp_audio.c | 1 + drivers/gpu/drm/msm/dp/dp_display.c | 26 +- drivers/gpu/drm/msm/dp/dp_display.h | 1 + drivers/gpu/drm/radeon/radeon.h | 1 + drivers/gpu/drm/radeon/radeon_atombios.c | 26 +- drivers/gpu/drm/radeon/radeon_pm.c | 8 + drivers/gpu/drm/radeon/si_dpm.c | 3 + drivers/hwmon/ltc2992.c | 8 +- drivers/hwmon/occ/common.c | 5 +- drivers/hwmon/occ/common.h | 2 +- drivers/hwtracing/coresight/coresight-platform.c | 6 + drivers/i2c/busses/i2c-i801.c | 4 + drivers/i2c/busses/i2c-imx.c | 2 +- drivers/i2c/busses/i2c-mt65xx.c | 9 +- drivers/i2c/i2c-dev.c | 9 +- drivers/iio/accel/Kconfig | 1 - drivers/iio/common/hid-sensors/Kconfig | 1 + drivers/iio/gyro/Kconfig | 1 - drivers/iio/gyro/mpu3050-core.c | 13 +- drivers/iio/humidity/Kconfig | 1 - drivers/iio/industrialio-core.c | 9 +- drivers/iio/light/Kconfig | 2 - drivers/iio/light/gp2ap002.c | 5 +- drivers/iio/light/tsl2583.c | 8 + drivers/iio/magnetometer/Kconfig | 1 - drivers/iio/orientation/Kconfig | 2 - drivers/iio/pressure/Kconfig | 1 - drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 1 + drivers/iio/temperature/Kconfig | 1 - drivers/infiniband/hw/hfi1/ipoib.h | 3 +- drivers/infiniband/hw/hfi1/ipoib_tx.c | 14 +- drivers/iommu/amd/init.c | 49 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 3 + drivers/leds/blink/Kconfig | 1 + drivers/net/can/dev/skb.c | 6 +- drivers/net/can/m_can/m_can.c | 3 +- drivers/net/can/spi/mcp251x.c | 35 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 8 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 +- drivers/net/ethernet/cisco/enic/enic_main.c | 7 +- drivers/net/ethernet/freescale/fec_main.c | 3 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 127 ++++-- drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 + drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 2 + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 3 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_err.h | 3 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 27 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 2 + drivers/net/ethernet/intel/i40e/i40e.h | 1 - drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 6 +- drivers/net/ethernet/intel/i40e/i40e_client.c | 1 + drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 8 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 42 -- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 8 +- drivers/net/ethernet/intel/i40e/i40e_type.h | 7 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 2 - drivers/net/ethernet/intel/ice/ice_lib.c | 123 ++++-- drivers/net/ethernet/intel/ice/ice_txrx.h | 2 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 1 + drivers/net/ipa/gsi.c | 4 +- drivers/net/ipa/gsi_reg.h | 18 +- drivers/net/phy/phy_device.c | 6 + drivers/net/wireless/ath/ath11k/wmi.c | 53 +-- drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 91 ++-- drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 1 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 39 +- .../net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 4 +- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 30 +- drivers/net/wireless/intel/iwlwifi/queue/tx.h | 3 +- drivers/net/wireless/mediatek/mt76/mt76.h | 1 + drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c | 1 + drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 97 ++-- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 15 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 3 + drivers/net/wireless/mediatek/mt76/mt76x02_util.c | 4 + drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 19 +- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 58 ++- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 25 +- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 27 +- drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 13 + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 25 +- drivers/net/wireless/microchip/wilc1000/netdev.c | 25 +- drivers/net/wireless/quantenna/qtnfmac/event.c | 6 +- drivers/net/wireless/realtek/rtw88/main.h | 2 + drivers/net/wireless/realtek/rtw88/phy.c | 14 + drivers/net/wireless/realtek/rtw88/phy.h | 1 + drivers/net/wireless/realtek/rtw88/reg.h | 5 + drivers/net/wireless/realtek/rtw88/rtw8822c.c | 27 +- drivers/net/wireless/wl3501.h | 47 +- drivers/net/wireless/wl3501_cs.c | 54 +-- drivers/nvme/host/core.c | 3 +- drivers/nvme/target/io-cmd-bdev.c | 2 +- drivers/nvme/target/nvmet.h | 6 + drivers/nvme/target/passthru.c | 2 +- drivers/nvme/target/rdma.c | 4 +- drivers/pci/controller/pcie-brcmstb.c | 20 +- drivers/pci/controller/pcie-iproc-msi.c | 2 +- drivers/pci/endpoint/functions/pci-epf-test.c | 20 +- drivers/pci/pcie/rcec.c | 2 +- drivers/pci/probe.c | 1 + drivers/pinctrl/samsung/pinctrl-exynos.c | 10 +- drivers/pwm/pwm-atmel.c | 2 +- drivers/remoteproc/pru_rproc.c | 41 +- drivers/remoteproc/qcom_q6v5_mss.c | 18 + drivers/rpmsg/qcom_glink_native.c | 1 + drivers/rtc/rtc-ds1307.c | 12 +- drivers/rtc/rtc-fsl-ftm-alarm.c | 1 + drivers/rtc/rtc-tps65910.c | 1 + drivers/scsi/qla2xxx/qla_init.c | 3 + drivers/scsi/ufs/ufshcd.c | 7 +- drivers/soc/mediatek/mt8173-pm-domains.h | 10 + drivers/soc/mediatek/mt8183-pm-domains.h | 15 + drivers/soc/mediatek/mt8192-pm-domains.h | 21 + drivers/soc/mediatek/mtk-pm-domains.c | 6 +- drivers/soc/mediatek/mtk-pm-domains.h | 2 + drivers/staging/media/rkvdec/rkvdec.c | 2 +- drivers/thermal/qcom/tsens.c | 6 +- drivers/thermal/thermal_of.c | 7 +- drivers/usb/class/cdc-wdm.c | 30 +- drivers/usb/core/hub.c | 6 +- drivers/usb/dwc2/core.h | 2 + drivers/usb/dwc2/gadget.c | 3 +- drivers/usb/dwc3/dwc3-imx8mp.c | 1 + drivers/usb/dwc3/dwc3-omap.c | 5 + drivers/usb/dwc3/dwc3-pci.c | 1 + drivers/usb/dwc3/gadget.c | 11 +- drivers/usb/host/fotg210-hcd.c | 4 +- drivers/usb/host/xhci-ext-caps.h | 5 +- drivers/usb/host/xhci-pci.c | 8 +- drivers/usb/host/xhci-ring.c | 16 +- drivers/usb/host/xhci.c | 6 +- drivers/usb/musb/mediatek.c | 2 +- drivers/usb/typec/tcpm/tcpm.c | 22 +- drivers/usb/typec/ucsi/ucsi.c | 46 +- drivers/usb/typec/ucsi/ucsi.h | 6 +- drivers/xen/gntdev.c | 4 +- drivers/xen/unpopulated-alloc.c | 4 +- fs/9p/vfs_file.c | 4 +- fs/btrfs/ctree.h | 2 +- fs/btrfs/extent-tree.c | 6 +- fs/btrfs/file.c | 35 +- fs/btrfs/free-space-cache.c | 2 +- fs/btrfs/inode.c | 4 +- fs/btrfs/ioctl.c | 2 +- fs/btrfs/ordered-data.c | 2 +- fs/btrfs/qgroup.c | 2 +- fs/btrfs/send.c | 4 +- fs/btrfs/tree-log.c | 3 +- fs/btrfs/zoned.c | 5 + fs/ceph/export.c | 4 +- fs/dax.c | 35 +- fs/debugfs/inode.c | 2 +- fs/dlm/config.c | 86 ++-- fs/dlm/config.h | 1 - fs/dlm/debug_fs.c | 1 + fs/dlm/lockspace.c | 20 +- fs/dlm/lowcomms.c | 104 +++-- fs/dlm/lowcomms.h | 5 + fs/dlm/midcomms.c | 7 +- fs/ext4/fast_commit.c | 2 +- fs/f2fs/compress.c | 55 +-- fs/f2fs/data.c | 6 +- fs/f2fs/f2fs.h | 7 +- fs/f2fs/file.c | 42 +- fs/f2fs/gc.c | 62 ++- fs/f2fs/inline.c | 3 +- fs/f2fs/segment.c | 86 ++-- fs/f2fs/segment.h | 14 +- fs/f2fs/super.c | 18 +- fs/fuse/cuse.c | 2 + fs/fuse/file.c | 9 + fs/fuse/virtio_fs.c | 3 +- fs/hfsplus/extents.c | 7 +- fs/hugetlbfs/inode.c | 5 + fs/jbd2/recovery.c | 5 +- fs/nfs/callback_proc.c | 17 +- fs/nfs/dir.c | 22 +- fs/nfs/flexfilelayout/flexfilelayout.c | 2 +- fs/nfs/inode.c | 8 +- fs/nfs/nfs42proc.c | 72 ++- fs/nfs/nfs4proc.c | 56 ++- fs/nfsd/nfs4state.c | 24 +- fs/proc/generic.c | 2 +- fs/squashfs/file.c | 6 +- include/linux/cpuhotplug.h | 1 + include/linux/elevator.h | 2 +- include/linux/i2c.h | 2 + include/linux/mm.h | 32 ++ include/linux/mm_types.h | 4 +- include/linux/nfs_xdr.h | 11 +- include/linux/phy.h | 2 + include/linux/pm.h | 1 + include/net/page_pool.h | 12 +- include/trace/events/sunrpc.h | 1 - include/uapi/linux/netfilter/xt_SECMARK.h | 6 + kernel/dma/swiotlb.c | 3 +- kernel/kexec_file.c | 4 +- kernel/resource.c | 4 +- kernel/sched/core.c | 2 +- kernel/sched/fair.c | 14 +- kernel/time/alarmtimer.c | 2 +- kernel/watchdog.c | 88 ++-- lib/Kconfig.kfence | 1 + lib/kobject_uevent.c | 9 +- lib/nlattr.c | 2 +- lib/test_kasan.c | 29 +- mm/gup.c | 94 ++-- mm/hugetlb.c | 12 +- mm/kfence/core.c | 45 +- mm/khugepaged.c | 18 +- mm/ksm.c | 1 + mm/migrate.c | 7 + mm/shmem.c | 34 +- net/bluetooth/hci_event.c | 2 +- net/bluetooth/l2cap_core.c | 4 + net/bluetooth/l2cap_sock.c | 8 + net/bluetooth/mgmt.c | 1 - net/bridge/br_arp_nd_proxy.c | 4 +- net/bridge/br_multicast.c | 28 +- net/bridge/br_netlink.c | 4 +- net/bridge/br_private.h | 3 +- net/bridge/br_sysfs_br.c | 8 +- net/core/flow_dissector.c | 6 +- net/core/page_pool.c | 12 +- net/ethtool/ioctl.c | 2 +- net/ethtool/netlink.c | 3 +- net/ipv6/ip6_vti.c | 2 +- net/mac80211/mlme.c | 12 +- net/mac80211/tx.c | 20 +- net/mptcp/subflow.c | 3 +- net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nfnetlink_osf.c | 2 + net/netfilter/nft_set_hash.c | 10 +- net/netfilter/xt_SECMARK.c | 88 +++- net/sched/cls_flower.c | 36 +- net/sched/sch_taprio.c | 6 + net/sctp/sm_make_chunk.c | 2 +- net/sctp/sm_statefuns.c | 28 +- net/smc/af_smc.c | 4 +- net/sunrpc/clnt.c | 12 +- net/sunrpc/svc.c | 3 +- net/sunrpc/svcsock.c | 2 +- net/sunrpc/xprt.c | 12 +- net/sunrpc/xprtrdma/frwr_ops.c | 2 +- net/sunrpc/xprtrdma/rpc_rdma.c | 3 +- net/sunrpc/xprtrdma/transport.c | 6 +- net/sunrpc/xprtrdma/verbs.c | 10 +- net/sunrpc/xprtrdma/xprt_rdma.h | 2 +- net/tipc/netlink_compat.c | 2 +- net/xdp/xsk_queue.h | 7 +- samples/bpf/tracex1_kern.c | 4 +- scripts/Makefile.modpost | 15 +- scripts/kconfig/nconf.c | 2 +- scripts/mod/modpost.c | 15 +- security/keys/trusted-keys/trusted_tpm1.c | 8 +- sound/firewire/bebob/bebob_stream.c | 12 +- sound/pci/hda/ideapad_s740_helper.c | 492 +++++++++++++++++++++ sound/pci/hda/patch_hdmi.c | 29 +- sound/pci/hda/patch_realtek.c | 11 + sound/pci/rme9652/hdsp.c | 3 +- sound/pci/rme9652/hdspm.c | 3 +- sound/pci/rme9652/rme9652.c | 3 +- sound/soc/codecs/rt286.c | 23 +- sound/soc/codecs/rt5670.c | 12 + sound/soc/intel/boards/bytcr_rt5640.c | 20 + sound/soc/intel/boards/sof_sdw.c | 11 + sound/soc/sh/rcar/core.c | 69 ++- sound/soc/sh/rcar/ssi.c | 16 +- sound/soc/soc-compress.c | 4 + sound/usb/quirks-table.h | 63 +++ tools/lib/bpf/ringbuf.c | 30 +- tools/perf/Makefile.config | 1 + tools/perf/util/Build | 7 + .../drivers/net/mlxsw/mirror_gre_scale.sh | 3 +- .../selftests/drivers/net/mlxsw/sch_red_core.sh | 4 +- tools/testing/selftests/lib.mk | 4 + .../testing/selftests/net/forwarding/mirror_lib.sh | 19 +- tools/testing/selftests/net/mptcp/diag.sh | 55 ++- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 15 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 22 +- tools/testing/selftests/net/mptcp/simult_flows.sh | 13 +- .../selftests/powerpc/security/entry_flush.c | 2 +- .../selftests/powerpc/security/flush_utils.h | 4 + .../testing/selftests/powerpc/security/rfi_flush.c | 2 +- virt/kvm/kvm_main.c | 7 +- 394 files changed, 4512 insertions(+), 2167 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 2/363 tpm: fix error return code in tpm2_get_cc_attrs_tbl()
From: Zhen Lei <[email protected]>
commit 1df83992d977355177810c2b711afc30546c81ce upstream.
If the total number of commands queried through TPM2_CAP_COMMANDS is different from that queried through TPM2_CC_GET_CAPABILITY, it indicates an unknown error. In this case, an appropriate error code -EFAULT should be returned. However, we currently do not explicitly assign this error code to 'rc'. As a result, 0 was incorrectly returned.
--- drivers/char/tpm/tpm2-cmd.c | 1 + 1 file changed, 1 insertion(+)
drivers/char/tpm/tpm2-cmd.c +1 -0
@@ -656,6 +656,7 @@ int tpm2_get_cc_attrs_tbl(struct tpm_chiif (nr_commands !=be32_to_cpup ((__be32 *)&buf.data[TPM_HEADER_SIZE +5 ])) { + rc = -EFAULT ;tpm_buf_destroy (&buf); goto out; }
Greg Kroah-Hartman
maintainerPATCH 11/363 kvm: Cap halt polling at kvm->max_halt_poll_ns
In reply to Greg Kroah-HartmanFrom: David Matlack <[email protected]>
commit 258785ef08b323bddd844b4926a32c2b2045a1b0 upstream.
When growing halt-polling, there is no check that the poll time exceeds the per-VM limit. It's possible for vcpu->halt_poll_ns to grow past kvm->max_halt_poll_ns and stay there until a halt which takes longer than kvm->halt_poll_ns.
Message-Id: <[email protected]>
--- virt/kvm/kvm_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
virt/kvm/kvm_main.c +2 -2
@@ -2758,8 +2758,8 @@ static void grow_halt_poll_ns(struct kvmif (val < grow_start) val = grow_start; -if (val > halt_poll_ns) - val = halt_poll_ns; +if (val > vcpu->kvm->max_halt_poll_ns) + val = vcpu->kvm->max_halt_poll_ns; vcpu->halt_poll_ns = val; out:
Greg Kroah-Hartman
maintainerPATCH 12/363 ath11k: fix thermal temperature read
In reply to Greg Kroah-HartmanFrom: Pradeep Kumar Chitrapu <[email protected]>
[ Upstream commit e3de5bb7ac1a4cb262f8768924fd3ef6182b10bb ]
Fix dangling pointer in thermal temperature event which causes incorrect temperature read.
Tested-on: IPQ8074 AHB WLAN.HK.2.4.0.1-00041-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/wmi.c | 53 +++++++++++---------------- 1 file changed, 21 insertions(+), 32 deletions(-)
drivers/net/wireless/ath/ath11k/wmi.c +21 -32
@@ -5417,31 +5417,6 @@ int ath11k_wmi_pull_fw_stats(struct ath11k_base *ab, struct sk_buff *skb,return 0 ; } -static int -ath11k_pull_pdev_temp_ev (struct ath11k_base *ab,u8 *evt_buf, -u32 len,const struct wmi_pdev_temperature_event *ev) -{ -const void **tb; -int ret; - - tb =ath11k_wmi_tlv_parse_alloc (ab, evt_buf, len,GFP_ATOMIC ); -if (IS_ERR (tb)) { - ret =PTR_ERR (tb); -ath11k_warn (ab,"failed to parse tlv: %d\n" , ret); -return ret; - } - - ev = tb[WMI_TAG_PDEV_TEMPERATURE_EVENT ]; -if (!ev) { -ath11k_warn (ab,"failed to fetch pdev temp ev" ); -kfree (tb); -return -EPROTO ; - } - -kfree (tb); -return 0 ; -} -size_t ath11k_wmi_fw_stats_num_vdevs (struct list_head *head) {struct ath11k_fw_stats_vdev *i;
@@ -6849,23 +6824,37 @@ ath11k_wmi_pdev_temperature_event(struct ath11k_base *ab, struct sk_buff *skb) {struct ath11k *ar; -struct wmi_pdev_temperature_event ev = {0 }; +const void **tb; +const struct wmi_pdev_temperature_event *ev; +int ret; + + tb =ath11k_wmi_tlv_parse_alloc (ab, skb->data, skb->len,GFP_ATOMIC ); +if (IS_ERR (tb)) { + ret =PTR_ERR (tb); +ath11k_warn (ab,"failed to parse tlv: %d\n" , ret); +return ; + } -if (ath11k_pull_pdev_temp_ev (ab, skb->data, skb->len, &ev) !=0 ) { -ath11k_warn (ab,"failed to extract pdev temperature event" ); + ev = tb[WMI_TAG_PDEV_TEMPERATURE_EVENT ]; +if (!ev) { +ath11k_warn (ab,"failed to fetch pdev temp ev" ); +kfree (tb);return ; }ath11k_dbg (ab,ATH11K_DBG_WMI , -"pdev temperature ev temp %d pdev_id %d\n" , ev.temp, ev.pdev_id); +"pdev temperature ev temp %d pdev_id %d\n" , ev->temp, ev->pdev_id); - ar =ath11k_mac_get_ar_by_pdev_id (ab, ev.pdev_id); + ar =ath11k_mac_get_ar_by_pdev_id (ab, ev->pdev_id);if (!ar) { -ath11k_warn (ab,"invalid pdev id in pdev temperature ev %d" , ev.pdev_id); +ath11k_warn (ab,"invalid pdev id in pdev temperature ev %d" , ev->pdev_id); +kfree (tb);return ; } -ath11k_thermal_event_temperature (ar, ev.temp); +ath11k_thermal_event_temperature (ar, ev->temp); + +kfree (tb); } static void ath11k_fils_discovery_event(struct ath11k_base *ab,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 13/363 ALSA: usb-audio: Add Pioneer DJM-850 to quirks-table
In reply to Greg Kroah-HartmanFrom: Nicolas MURE <[email protected]>
[ Upstream commit a3c30b0cb6d05f5bf66d1a5d42e876f31753a447 ]
Declare the Pioneer DJM-850 interfaces for capture and playback.
See https://github.com/nm2107/Pioneer-DJM-850-driver-reverse-engineering/blob/172fb9a61055960c88c67b7c416fe5bf3609807b/doc/usb-device-specifications.md
for the complete device spec.
--- sound/usb/quirks-table.h | 63 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+)
sound/usb/quirks-table.h +63 -0
@@ -3827,6 +3827,69 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), } } }, +{ +/* +* Pioneer DJ DJM-850 +* 8 channels playback and 8 channels capture @ 44.1/48/96kHz S24LE +* Playback on EP 0x05 +* Capture on EP 0x86 +*/ + USB_DEVICE_VENDOR_SPEC(0x08e4, 0x0163), + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = (const struct snd_usb_audio_quirk []) { + { + .ifnum =0 , + .type =QUIRK_AUDIO_FIXED_ENDPOINT , + .data = &(const struct audioformat ) { + .formats =SNDRV_PCM_FMTBIT_S24_3LE , + .channels =8 , + .iface =0 , + .altsetting =1 , + .altset_idx =1 , + .endpoint =0x05 , + .ep_attr =USB_ENDPOINT_XFER_ISOC | +USB_ENDPOINT_SYNC_ASYNC | +USB_ENDPOINT_USAGE_DATA , + .rates =SNDRV_PCM_RATE_44100 | +SNDRV_PCM_RATE_48000 | +SNDRV_PCM_RATE_96000 , + .rate_min =44100 , + .rate_max =96000 , + .nr_rates =3 , + .rate_table = (unsigned int []) {44100 ,48000 ,96000 } + } + }, + { + .ifnum =0 , + .type =QUIRK_AUDIO_FIXED_ENDPOINT , + .data = &(const struct audioformat ) { + .formats =SNDRV_PCM_FMTBIT_S24_3LE , + .channels =8 , + .iface =0 , + .altsetting =1 , + .altset_idx =1 , + .endpoint =0x86 , + .ep_idx =1 , + .ep_attr =USB_ENDPOINT_XFER_ISOC | +USB_ENDPOINT_SYNC_ASYNC | +USB_ENDPOINT_USAGE_DATA , + .rates =SNDRV_PCM_RATE_44100 | +SNDRV_PCM_RATE_48000 | +SNDRV_PCM_RATE_96000 , + .rate_min =44100 , + .rate_max =96000 , + .nr_rates =3 , + .rate_table = (unsigned int []) {44100 ,48000 ,96000 } + } + }, + { + .ifnum =-1 + } + } + } +}, {/* * Pioneer DJ DJM-450
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 14/363 fs: dlm: fix debugfs dump
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 92c48950b43f4a767388cf87709d8687151a641f ]
This patch fixes the following message which randomly pops up during glocktop call:
seq_file: buggy .next function table_seq_next did not update position index
The issue is that seq_read_iter() in fs/seq_file.c also needs an increment of the index in an non next record case as well which this patch fixes otherwise seq_read_iter() will print out the above message.
--- fs/dlm/debug_fs.c | 1 + 1 file changed, 1 insertion(+)
fs/dlm/debug_fs.c +1 -0
@@ -542,6 +542,7 @@ static void *table_seq_next(struct seq_file *seq, void *iter_ptr, loff_t *pos)if (bucket >= ls->ls_rsbtbl_size) {kfree (ri); + ++*pos;return NULL ; } tree = toss ? &ls->ls_rsbtbl[bucket].toss : &ls->ls_rsbtbl[bucket].keep;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 15/363 fs: dlm: fix mark setting deadlock
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit e125fbeb538e5e35a00c6c8150a5361bef34814c ]
This patch fixes an deadlock issue when dlm_lowcomms_close() is called. When dlm_lowcomms_close() is called the clusters_root.subsys.su_mutex is held to remove configfs items. At this time we flushing (e.g. cancel_work_sync()) the workers of send and recv workqueue. Due the fact that we accessing configfs items (mark values), these workers will lock clusters_root.subsys.su_mutex as well which are already hold by dlm_lowcomms_close() and ends in a deadlock situation.
[67170.703046] ======================================================
[67170.703965] WARNING: possible circular locking dependency detected
[67170.704758] 5.11.0-rc4+ #22 Tainted: G W
[67170.705433] ------------------------------------------------------
[67170.706228] dlm_controld/280 is trying to acquire lock:
[67170.706915] ffff9f2f475a6948 ((wq_completion)dlm_recv){+.+.}-{0:0}, at: __flush_work+0x203/0x4c0
[67170.708026]
but task is already holding lock:
[67170.708758] ffffffffa132f878 (&clusters_root.subsys.su_mutex){+.+.}-{3:3}, at: configfs_rmdir+0x29b/0x310
[67170.710016]
which lock already depends on the new lock.The new behaviour adds the mark value to the node address configuration which doesn't require to held the clusters_root.subsys.su_mutex by accessing mark values in a separate datastructure. However the mark values can be set now only after a node address was set which is the case when the user is using dlm_controld.
--- fs/dlm/config.c | 29 ++++++++++------------------ fs/dlm/config.h | 1 - fs/dlm/lowcomms.c | 49 ++++++++++++++++++++++++++++++++--------------- fs/dlm/lowcomms.h | 1 + 4 files changed, 45 insertions(+), 35 deletions(-)
fs/dlm/config.c +10 -19
@@ -688,6 +688,7 @@ static ssize_t comm_mark_show(struct config_item *item, char *buf)static ssize_t comm_mark_store (struct config_item *item,const char *buf,size_t len) { +struct dlm_comm *comm;unsigned int mark;int rc;
@@ -695,7 +696,15 @@ static ssize_t comm_mark_store(struct config_item *item, const char *buf,if (rc)return rc; -config_item_to_comm (item)->mark = mark; +if (mark ==0 ) + mark = dlm_config.ci_mark; + + comm =config_item_to_comm (item); + rc =dlm_lowcomms_nodes_set_mark (comm->nodeid, mark); +if (rc) +return rc; + + comm->mark = mark;return len; }
@@ -870,24 +879,6 @@ int dlm_comm_seq(int nodeid, uint32_t *seq)return 0 ; } -void dlm_comm_mark (int nodeid,unsigned int *mark) -{ -struct dlm_comm *cm; - - cm =get_comm (nodeid); -if (!cm) { - *mark = dlm_config.ci_mark; -return ; - } - -if (cm->mark) - *mark = cm->mark; -else - *mark = dlm_config.ci_mark; - -put_comm (cm); -} -int dlm_our_nodeid (void ) {return local_comm ? local_comm->nodeid :0 ;
fs/dlm/config.h +0 -1
@@ -48,7 +48,6 @@ void dlm_config_exit(void);int dlm_config_nodes (char *lsname,struct dlm_config_node **nodes_out,int *count_out);int dlm_comm_seq (int nodeid,uint32_t *seq); -void dlm_comm_mark (int nodeid,unsigned int *mark);int dlm_our_nodeid (void );int dlm_our_addr (struct sockaddr_storage *addr,int num);
fs/dlm/lowcomms.c +34 -15
143 lines not on this page · raw message
fs/dlm/lowcomms.h +1 -0
@@ -21,6 +21,7 @@ int dlm_lowcomms_close(int nodeid);void *dlm_lowcomms_get_buffer (int nodeid,int len,gfp_t allocation,char **ppc);void dlm_lowcomms_commit_buffer (void *mh);int dlm_lowcomms_connect_node (int nodeid); +int dlm_lowcomms_nodes_set_mark (int nodeid,unsigned int mark);int dlm_lowcomms_addr (int nodeid,struct sockaddr_storage *addr,int len);#endif /* __LOWCOMMS_DOT_H__ */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 16/363 fs: dlm: add errno handling to check callback
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 8aa9540b49e0833feba75dbf4f45babadd0ed215 ]
This allows to return individual errno values for the config attribute check callback instead of returning invalid argument only.
--- fs/dlm/config.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
fs/dlm/config.c +16 -7
@@ -125,7 +125,7 @@ static ssize_t cluster_cluster_name_store(struct config_item *item,CONFIGFS_ATTR (cluster_, cluster_name);static ssize_t cluster_set (struct dlm_cluster *cl,unsigned int *cl_field, -int *info_field,bool (*check_cb)(unsigned int x), +int *info_field,int (*check_cb)(unsigned int x),const char *buf,size_t len) {unsigned int x;
@@ -137,8 +137,11 @@ static ssize_t cluster_set(struct dlm_cluster *cl, unsigned int *cl_field,if (rc)return rc; -if (check_cb &&check_cb (x)) -return -EINVAL ; +if (check_cb) { + rc =check_cb (x); +if (rc) +return rc; + } *cl_field = x; *info_field = x;
@@ -161,14 +164,20 @@ static ssize_t cluster_##name##_show(struct config_item *item, char *buf) \ } \CONFIGFS_ATTR (cluster_, name); -static bool dlm_check_zero (unsigned int x) +static int dlm_check_zero (unsigned int x) { -return !x; +if (!x) +return -EINVAL ; + +return 0 ; } -static bool dlm_check_buffer_size (unsigned int x) +static int dlm_check_buffer_size (unsigned int x) { -return (x <DEFAULT_BUFFER_SIZE ); +if (x <DEFAULT_BUFFER_SIZE ) +return -EINVAL ; + +return 0 ; }CLUSTER_ATTR (tcp_port, dlm_check_zero);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 17/363 fs: dlm: add check if dlm is currently running
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 517461630d1c25ee4dfc1dee80973a64189d6ccf ]
This patch adds checks for dlm config attributes regarding to protocol parameters as it makes only sense to change them when dlm is not running. It also adds a check for valid protocol specifiers and return invalid argument if they are not supported.
--- fs/dlm/config.c | 34 ++++++++++++++++++++++++++++++++-- fs/dlm/lowcomms.c | 2 +- fs/dlm/lowcomms.h | 3 +++ 3 files changed, 36 insertions(+), 3 deletions(-)
fs/dlm/config.c +32 -2
@@ -164,6 +164,36 @@ static ssize_t cluster_##name##_show(struct config_item *item, char *buf) \ } \CONFIGFS_ATTR (cluster_, name); +static int dlm_check_protocol_and_dlm_running (unsigned int x) +{ +switch (x) { +case 0 : +/* TCP */ +break ; +case 1 : +/* SCTP */ +break ; +default : +return -EINVAL ; + } + +if (dlm_allow_conn) +return -EBUSY ; + +return 0 ; +} + +static int dlm_check_zero_and_dlm_running (unsigned int x) +{ +if (!x) +return -EINVAL ; + +if (dlm_allow_conn) +return -EBUSY ; + +return 0 ; +} +static int dlm_check_zero (unsigned int x) {if (!x)
@@ -180,7 +210,7 @@ static int dlm_check_buffer_size(unsigned int x)return 0 ; } -CLUSTER_ATTR (tcp_port, dlm_check_zero); +CLUSTER_ATTR (tcp_port, dlm_check_zero_and_dlm_running);CLUSTER_ATTR (buffer_size, dlm_check_buffer_size);CLUSTER_ATTR (rsbtbl_size, dlm_check_zero);CLUSTER_ATTR (recover_timer, dlm_check_zero);
@@ -188,7 +218,7 @@ CLUSTER_ATTR(toss_secs, dlm_check_zero);CLUSTER_ATTR (scan_secs, dlm_check_zero);CLUSTER_ATTR (log_debug,NULL );CLUSTER_ATTR (log_info,NULL ); -CLUSTER_ATTR (protocol,NULL ); +CLUSTER_ATTR (protocol, dlm_check_protocol_and_dlm_running);CLUSTER_ATTR (mark,NULL );CLUSTER_ATTR (timewarn_cs, dlm_check_zero);CLUSTER_ATTR (waitwarn_us,NULL );
fs/dlm/lowcomms.c +1 -1
@@ -135,7 +135,7 @@ static DEFINE_SPINLOCK(dlm_node_addrs_spin);static struct listen_connection listen_con;static struct sockaddr_storage *dlm_local_addr[DLM_MAX_ADDR_COUNT ];static int dlm_local_count; -static int dlm_allow_conn; +int dlm_allow_conn;/* Work queues */ static struct workqueue_struct *recv_workqueue;
fs/dlm/lowcomms.h +3 -0
@@ -14,6 +14,9 @@#define LOWCOMMS_MAX_TX_BUFFER_LEN 4096 +/* switch to check if dlm is running */ +extern int dlm_allow_conn; +int dlm_lowcomms_start (void );void dlm_lowcomms_stop (void );void dlm_lowcomms_exit (void );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 18/363 fs: dlm: change allocation limits
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit c45674fbdda138814ca21138475219c96fa5aa1f ]
While running tcpkill I experienced invalid header length values while receiving to check that a node doesn't try to send a invalid dlm message we also check on applications minimum allocation limit. Also use DEFAULT_BUFFER_SIZE as maximum allocation limit. The define LOWCOMMS_MAX_TX_BUFFER_LEN is to calculate maximum buffer limits on application layer, future midcomms layer will subtract their needs from this define.
--- fs/dlm/lowcomms.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/dlm/lowcomms.c +4 -2
@@ -1375,9 +1375,11 @@ void *dlm_lowcomms_get_buffer(int nodeid, int len, gfp_t allocation, char **ppc)struct writequeue_entry *e;int offset =0 ; -if (len >LOWCOMMS_MAX_TX_BUFFER_LEN ) { -BUILD_BUG_ON (PAGE_SIZE <LOWCOMMS_MAX_TX_BUFFER_LEN ); +if (len >DEFAULT_BUFFER_SIZE || + len <sizeof (struct dlm_header )) { +BUILD_BUG_ON (PAGE_SIZE <DEFAULT_BUFFER_SIZE );log_print ("failed to allocate a buffer of size %d" , len); +WARN_ON (1 );return NULL ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 19/363 fs: dlm: check on minimum msglen size
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 710176e8363f269c6ecd73d203973b31ace119d3 ]
This patch adds an additional check for minimum dlm header size which is an invalid dlm message and signals a broken stream. A msglen field cannot be less than the dlm header size because the field is inclusive header lengths.
--- fs/dlm/midcomms.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/dlm/midcomms.c +4 -3
@@ -49,9 +49,10 @@ int dlm_process_incoming_buffer(int nodeid, unsigned char *buf, int len)* cannot deliver this message to upper layers */ msglen =get_unaligned_le16 (&hd->h_length); -if (msglen >DEFAULT_BUFFER_SIZE ) { -log_print ("received invalid length header: %u, will abort message parsing" , - msglen); +if (msglen >DEFAULT_BUFFER_SIZE || + msglen <sizeof (struct dlm_header )) { +log_print ("received invalid length header: %u from node %d, will abort message parsing" , + msglen, nodeid);return -EBADMSG ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 20/363 fs: dlm: flush swork on shutdown
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit eec054b5a7cfe6d1f1598a323b05771ee99857b5 ]
This patch fixes the flushing of send work before shutdown. The function cancel_work_sync() is not the right workqueue functionality to use here as it would cancel the work if the work queues itself. In cases of EAGAIN in send() for dlm message we need to be sure that everything is send out before. The function flush_work() will ensure that every send work is be done inclusive in EAGAIN cases.
--- fs/dlm/lowcomms.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
fs/dlm/lowcomms.c +1 -4
@@ -709,10 +709,7 @@ static void shutdown_connection(struct connection *con) {int ret; -if (cancel_work_sync (&con->swork)) { -log_print ("canceled swork for node %d" , con->nodeid); -clear_bit (CF_WRITE_PENDING , &con->flags); - } +flush_work (&con->swork);mutex_lock (&con->sock_mutex);/* nothing to shutdown */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 21/363 fs: dlm: add shutdown hook
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 9d232469bcd772dbedb9e75a165c681b920524ee ]
This patch fixes issues which occurs when dlm lowcomms synchronize their workqueues but dlm application layer already released the lockspace. In such cases messages like:
dlm: gfs2: release_lockspace final free
dlm: invalid lockspace 3841231384 from 1 cmd 1 type 11
are printed on the kernel log. This patch is solving this issue by introducing a new "shutdown" hook before calling "stop" hook when the lockspace is going to be released finally. This should pretend any dlm messages sitting in the workqueues during or after lockspace removal.
It's necessary to call dlm_scand_stop() as I instrumented dlm_lowcomms_get_buffer() code to report a warning after it's called after dlm_midcomms_shutdown() functionality, see below:
WARNING: CPU: 1 PID: 3794 at fs/dlm/midcomms.c:1003 dlm_midcomms_get_buffer+0x167/0x180 Modules linked in: joydev iTCO_wdt intel_pmc_bxt iTCO_vendor_support drm_ttm_helper ttm pcspkr serio_raw i2c_i801 i2c_smbus drm_kms_helper virtio_scsi lpc_ich virtio_balloon virtio_console xhci_pci xhci_pci_renesas cec qemu_fw_cfg drm [last unloaded: qxl] CPU: 1 PID: 3794 Comm: dlm_scand Tainted: G W 5.11.0+ #26 Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014 RIP: 0010:dlm_midcomms_get_buffer+0x167/0x180 Code: 5d 41 5c 41 5d 41 5e 41 5f c3 0f 0b 45 31 e4 5b 5d 4c 89 e0 41 5c 41 5d 41 5e 41 5f c3 4c 89 e7 45 31 e4 e8 3b f1 ec ff eb 86 <0f> 0b 4c 89 e7 45 31 e4 e8 2c f1 ec ff e9 74 ff ff ff 0f 1f 80 00 RSP: 0018:ffffa81503f8fe60 EFLAGS: 00010202 RAX: 0000000000000008 RBX: ffff8f969827f200 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffffad1e89a0 RDI: ffff8f96a5294160 RBP: 0000000000000001 R08: 0000000000000000 R09: ffff8f96a250bc60 R10: 00000000000045d3 R11: 0000000000000000 R12: ffff8f96a250bc60 R13: ffffa81503f8fec8 R14: 0000000000000070 R15: 0000000000000c40 FS: 0000000000000000(0000) GS:ffff8f96fbc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aa3351c000 CR3: 000000010bf22000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: dlm_scan_rsbs+0x420/0x670 ? dlm_uevent+0x20/0x20 dlm_scand+0xbf/0xe0 kthread+0x13a/0x150 ? __kthread_bind_mask+0x60/0x60 ret_from_fork+0x22/0x30
To synchronize all dlm scand messages we stop it right before shutdown hook.
--- fs/dlm/lockspace.c | 20 +++++++++++--------- fs/dlm/lowcomms.c | 42 +++++++++++++++++++++++------------------- fs/dlm/lowcomms.h | 1 + 3 files changed, 35 insertions(+), 28 deletions(-)
fs/dlm/lockspace.c +11 -9
@@ -404,12 +404,6 @@ static int threads_start(void)return error; } -static void threads_stop (void ) -{ -dlm_scand_stop (); -dlm_lowcomms_stop (); -} - static int new_lockspace(const char *name, const char *cluster, uint32_t flags, int lvblen, const struct dlm_lockspace_ops *ops, void *ops_arg,
@@ -702,8 +696,11 @@ int dlm_new_lockspace(const char *name, const char *cluster, ls_count++;if (error >0 ) error =0 ; -if (!ls_count) -threads_stop (); +if (!ls_count) { +dlm_scand_stop (); +dlm_lowcomms_shutdown (); +dlm_lowcomms_stop (); + } out:mutex_unlock (&ls_lock);return error;
@@ -788,6 +785,11 @@ static int release_lockspace(struct dlm_ls *ls, int force)dlm_recoverd_stop (ls); +if (ls_count ==1 ) { +dlm_scand_stop (); +dlm_lowcomms_shutdown (); + } +dlm_callback_stop (ls);remove_lockspace (ls);
@@ -880,7 +882,7 @@ int dlm_release_lockspace(void *lockspace, int force)if (!error) ls_count--;if (!ls_count) -threads_stop (); +dlm_lowcomms_stop ();mutex_unlock (&ls_lock);return error;
fs/dlm/lowcomms.c +23 -19
60 lines not on this page · raw message
fs/dlm/lowcomms.h +1 -0
@@ -18,6 +18,7 @@extern int dlm_allow_conn;int dlm_lowcomms_start (void ); +void dlm_lowcomms_shutdown (void );void dlm_lowcomms_stop (void );void dlm_lowcomms_exit (void );int dlm_lowcomms_close (int nodeid);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 3/363 tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt()
In reply to Greg Kroah-HartmanFrom: Jarkko Sakkinen <[email protected]>
commit e630af7dfb450d1c00c30077314acf33032ff9e4 upstream.
The earlier fix (linked) only partially fixed the locality handling bug in tpm_tis_gen_interrupt(), i.e. only for TPM 1.x.
Extend the locality handling to cover TPM2.
--- drivers/char/tpm/tpm_tis_core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/char/tpm/tpm_tis_core.c +4 -6
@@ -709,16 +709,14 @@ static int tpm_tis_gen_interrupt(structcap_t cap;int ret; -/* TPM 2.0 */ -if (chip->flags &TPM_CHIP_FLAG_TPM2 ) -return tpm2_get_tpm_pt (chip,0x100 , &cap2, desc); - -/* TPM 1.2 */ ret =request_locality (chip,0 );if (ret <0 )return ret; - ret =tpm1_getcap (chip,TPM_CAP_PROP_TIS_TIMEOUT , &cap, desc,0 ); +if (chip->flags &TPM_CHIP_FLAG_TPM2 ) + ret =tpm2_get_tpm_pt (chip,0x100 , &cap2, desc); +else + ret =tpm1_getcap (chip,TPM_CAP_PROP_TIS_TIMEOUT , &cap, desc,0 );release_locality (chip,0 );
Greg Kroah-Hartman
maintainerPATCH 22/363 tipc: convert dest nodes address to network order
In reply to Greg Kroah-HartmanFrom: Hoang Le <[email protected]>
[ Upstream commit 1980d37565061ab44bdc2f9e4da477d3b9752e81 ]
(struct tipc_link_info)->dest is in network order (__be32), so we must convert the value to network order before assigning. The problem detected by sparse:
net/tipc/netlink_compat.c:699:24: warning: incorrect type in assignment (different base types)net/tipc/netlink_compat.c:699:24: expected restricted __be32 [usertype] destnet/tipc/netlink_compat.c:699:24: got int
--- net/tipc/netlink_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/netlink_compat.c +1 -1
@@ -696,7 +696,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,if (err)return err; - link_info.dest =nla_get_flag (link[TIPC_NLA_LINK_DEST ]); + link_info.dest =htonl (nla_get_flag (link[TIPC_NLA_LINK_DEST ])); link_info.up =htonl (nla_get_flag (link[TIPC_NLA_LINK_UP ]));nla_strscpy (link_info.str, link[TIPC_NLA_LINK_NAME ],TIPC_MAX_LINK_NAME );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 23/363 ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit b7c7203a1f751348f35fc4bcb157572d303f7573 ]
The Asus T100TAF uses the same jack-detect settings as the T100TA, this has been confirmed on actual hardware.
Add these settings to the T100TAF quirks to enable jack-detect support on the T100TAF.
--- sound/soc/intel/boards/bytcr_rt5640.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +3 -0
@@ -482,6 +482,9 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TAF"), }, .driver_data = (void *)(BYT_RT5640_IN1_MAP | + BYT_RT5640_JD_SRC_JD2_IN4N | + BYT_RT5640_OVCD_TH_2000UA | + BYT_RT5640_OVCD_SF_0P75 | BYT_RT5640_MONO_SPEAKER | BYT_RT5640_DIFF_MIC | BYT_RT5640_SSP0_AIF2 |
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 24/363 net/mlx5e: Use net_prefetchw instead of prefetchw in MPWQE TX datapath
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit 991b2654605b455a94dac73e14b23480e7e20991 ]
Commit e20f0dbf204f ("net/mlx5e: RX, Add a prefetch command for small L1_CACHE_BYTES") switched to using net_prefetchw at all places in mlx5e. In the same time frame, commit 5af75c747e2a ("net/mlx5e: Enhanced TX MPWQE for SKBs") added one more usage of prefetchw. When these two changes were merged, this new occurrence of prefetchw wasn't replaced with net_prefetchw.
This commit fixes this last occurrence of prefetchw in mlx5e_tx_mpwqe_session_start, making the same change that was done in mlx5e_xdp_mpwqe_session_start.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +1 -1
@@ -576,7 +576,7 @@ static void mlx5e_tx_mpwqe_session_start(struct mlx5e_txqsq *sq, pi =mlx5e_txqsq_get_next_pi (sq,MLX5E_TX_MPW_MAX_WQEBBS ); wqe =MLX5E_TX_FETCH_WQE (sq, pi); -prefetchw (wqe->data); +net_prefetchw (wqe->data); *session = (struct mlx5e_tx_mpwqe ) { .wqe = wqe,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 5/363 btrfs: fix unmountable seed device after fstrim
In reply to Greg Kroah-HartmanFrom: Anand Jain <[email protected]>
commit 5e753a817b2d5991dfe8a801b7b1e8e79a1c5a20 upstream.
The following test case reproduces an issue of wrongly freeing in-use blocks on the readonly seed device when fstrim is called on the rw sprout device. As shown below.
Create a seed device and add a sprout device to it:
$ mkfs.btrfs -fq -dsingle -msingle /dev/loop0 $ btrfstune -S 1 /dev/loop0 $ mount /dev/loop0 /btrfs $ btrfs dev add -f /dev/loop1 /btrfs BTRFS info (device loop0): relocating block group 290455552 flags system BTRFS info (device loop0): relocating block group 1048576 flags system BTRFS info (device loop0): disk added /dev/loop1 $ umount /btrfs
Mount the sprout device and run fstrim:
$ mount /dev/loop1 /btrfs $ fstrim /btrfs $ umount /btrfs
Now try to mount the seed device, and it fails:
$ mount /dev/loop0 /btrfs mount: /btrfs: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error.
Block 5292032 is missing on the readonly seed device:
$ dmesg -kt | tail <snip> BTRFS error (device loop0): bad tree block start, want 5292032 have 0 BTRFS warning (device loop0): couldn't read-tree root BTRFS error (device loop0): open_ctree failed
Quoted 1 line
From the dump-tree of the seed device (taken before the fstrim). Block
5292032 belonged to the block group starting at 5242880:
$ btrfs inspect dump-tree -e /dev/loop0 | grep -A1 BLOCK_GROUP <snip> item 3 key (5242880 BLOCK_GROUP_ITEM 8388608) itemoff 16169 itemsize 24 block group used 114688 chunk_objectid 256 flags METADATA <snip>
Quoted 1 line
From the dump-tree of the sprout device (taken before the fstrim).
fstrim used block-group 5242880 to find the related free space to free:
$ btrfs inspect dump-tree -e /dev/loop1 | grep -A1 BLOCK_GROUP <snip> item 1 key (5242880 BLOCK_GROUP_ITEM 8388608) itemoff 16226 itemsize 24 block group used 32768 chunk_objectid 256 flags METADATA <snip>
BPF kernel tracing the fstrim command finds the missing block 5292032 within the range of the discarded blocks as below:
kprobe:btrfs_discard_extent {
printf("freeing start %llu end %llu num_bytes %llu:\n",
arg1, arg1+arg2, arg2);
} freeing start 5259264 end 5406720 num_bytes 147456 <snip>
Fix this by avoiding the discard command to the readonly seed device.
--- fs/btrfs/extent-tree.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/btrfs/extent-tree.c +5 -1
@@ -1340,12 +1340,16 @@ int btrfs_discard_extent(struct btrfs_fs stripe = bbio->stripes;for (i =0 ; i < bbio->num_stripes; i++, stripe++) {u64 bytes; +struct btrfs_device *device = stripe->dev; -if (!stripe->dev->bdev) { +if (!device->bdev) {ASSERT (btrfs_test_opt (fs_info,DEGRADED ));continue ; } +if (!test_bit (BTRFS_DEV_STATE_WRITEABLE , &device->dev_state)) +continue ; + ret =do_discard_extent (stripe, &bytes);if (!ret) { discarded_bytes += bytes;
Greg Kroah-Hartman
maintainerPATCH 4/363 tpm, tpm_tis: Reserve locality in tpm_tis_resume()
In reply to Greg Kroah-HartmanFrom: Jarkko Sakkinen <[email protected]>
commit 8a2d296aaebadd68d9c1f6908667df1d1c84c051 upstream.
Reserve locality in tpm_tis_resume(), as it could be unsert after waking up from a sleep state.
--- drivers/char/tpm/tpm_tis_core.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +10 -2
@@ -1125,12 +1125,20 @@ int tpm_tis_resume(struct device *dev)if (ret)return ret; -/* TPM 1.2 requires self-test on resume. This function actually returns +/* +* TPM 1.2 requires self-test on resume. This function actually returns * an error code but for unknown reason it isn't handled. */ -if (!(chip->flags &TPM_CHIP_FLAG_TPM2 )) +if (!(chip->flags &TPM_CHIP_FLAG_TPM2 )) { + ret =request_locality (chip,0 ); +if (ret <0 ) +return ret; +tpm1_do_selftest (chip); +release_locality (chip,0 ); + } +return 0 ; }EXPORT_SYMBOL_GPL (tpm_tis_resume);
Greg Kroah-Hartman
maintainerPATCH 7/363 KVM/VMX: Invoke NMI non-IST entry instead of IST entry
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
commit a217a6593cec8b315d4c2f344bae33660b39b703 upstream.
In VMX, the host NMI handler needs to be invoked after NMI VM-Exit. Before commit 1a5488ef0dcf6 ("KVM: VMX: Invoke NMI handler via indirect call instead of INTn"), this was done by INTn ("int $2"). But INTn microcode is relatively expensive, so the commit reworked NMI VM-Exit handling to invoke the kernel handler by function call.
But this missed a detail. The NMI entry point for direct invocation is fetched from the IDT table and called on the kernel stack. But on 64-bit the NMI entry installed in the IDT expects to be invoked on the IST stack. It relies on the "NMI executing" variable on the IST stack to work correctly, which is at a fixed position in the IST stack. When the entry point is unexpectedly called on the kernel stack, the RSP-addressed "NMI executing" variable is obviously also on the kernel stack and is "uninitialized" and can cause the NMI entry code to run in the wrong way.
Provide a non-ist entry point for VMX which shares the C-function with the regular NMI entry and invoke the new asm entry point instead.
On 32-bit this just maps to the regular NMI entry point as 32-bit has no ISTs and is not affected.
[ tglx: Made it independent for backporting, massaged changelog ]
--- arch/x86/include/asm/idtentry.h | 15 +++++++++++++++ arch/x86/kernel/nmi.c | 10 ++++++++++ arch/x86/kvm/vmx/vmx.c | 16 +++++++++------- 3 files changed, 34 insertions(+), 7 deletions(-)
arch/x86/include/asm/idtentry.h +15 -0
@@ -588,6 +588,21 @@ DECLARE_IDTENTRY_RAW(X86_TRAP_MC, xenpv_#endif /* NMI */ + +#if defined(CONFIG_X86_64 ) &&IS_ENABLED (CONFIG_KVM_INTEL ) +/* +* Special NOIST entry point for VMX which invokes this on the kernel +* stack. asm_exc_nmi() requires an IST to work correctly vs. the NMI +* 'executing' marker. +* +* On 32bit this just uses the regular NMI entry point because 32-bit does +* not have ISTs. +*/ +DECLARE_IDTENTRY (X86_TRAP_NMI , exc_nmi_noist); +#else +#define asm_exc_nmi_noist asm_exc_nmi +#endif +DECLARE_IDTENTRY_NMI (X86_TRAP_NMI , exc_nmi);#ifdef CONFIG_XEN_PV DECLARE_IDTENTRY_RAW (X86_TRAP_NMI , xenpv_exc_nmi);
arch/x86/kernel/nmi.c +10 -0
@@ -524,6 +524,16 @@ nmi_restart:mds_user_clear_cpu_buffers (); } +#if defined(CONFIG_X86_64 ) &&IS_ENABLED (CONFIG_KVM_INTEL ) +DEFINE_IDTENTRY_RAW (exc_nmi_noist) +{ +exc_nmi (regs); +} +#endif +#if IS_MODULE (CONFIG_KVM_INTEL ) +EXPORT_SYMBOL_GPL (asm_exc_nmi_noist); +#endif +void stop_nmi (void ) { ignore_nmis++;
arch/x86/kvm/vmx/vmx.c +9 -7
@@ -36,6 +36,7 @@#include <asm/debugreg.h> #include <asm/desc.h> #include <asm/fpu/internal.h> +#include <asm/idtentry.h> #include <asm/io.h> #include <asm/irq_remapping.h> #include <asm/kexec.h>
@@ -6394,18 +6395,17 @@ static void vmx_apicv_post_state_restorevoid vmx_do_interrupt_nmi_irqoff (unsigned long entry); -static void handle_interrupt_nmi_irqoff (struct kvm_vcpu *vcpu,u32 intr_info) +static void handle_interrupt_nmi_irqoff (struct kvm_vcpu *vcpu, +unsigned long entry) { -unsigned int vector = intr_info &INTR_INFO_VECTOR_MASK ; -gate_desc *desc = (gate_desc *)host_idt_base + vector; -kvm_before_interrupt (vcpu); -vmx_do_interrupt_nmi_irqoff (gate_offset (desc)); +vmx_do_interrupt_nmi_irqoff (entry);kvm_after_interrupt (vcpu); }static void handle_exception_nmi_irqoff (struct vcpu_vmx *vmx) { +const unsigned long nmi_entry = (unsigned long )asm_exc_nmi_noist;u32 intr_info =vmx_get_intr_info (&vmx->vcpu);/* if exit due to PF check for async PF */
@@ -6416,18 +6416,20 @@ static void handle_exception_nmi_irqoff(kvm_machine_check ();/* We need to handle NMIs before interrupts are enabled */ else if (is_nmi(intr_info)) - handle_interrupt_nmi_irqoff(&vmx->vcpu, intr_info); + handle_interrupt_nmi_irqoff(&vmx->vcpu, nmi_entry); }static void handle_external_interrupt_irqoff (struct kvm_vcpu *vcpu) {u32 intr_info =vmx_get_intr_info (vcpu); +unsigned int vector = intr_info &INTR_INFO_VECTOR_MASK ; +gate_desc *desc = (gate_desc *)host_idt_base + vector;if (WARN_ONCE (!is_external_intr (intr_info),"KVM: unexpected VM-Exit interrupt info: 0x%x" , intr_info))return ; -handle_interrupt_nmi_irqoff (vcpu, intr_info); +handle_interrupt_nmi_irqoff (vcpu,gate_offset (desc)); }static void vmx_handle_exit_irqoff (struct kvm_vcpu *vcpu)
Greg Kroah-Hartman
maintainerPATCH 9/363 PM: runtime: Fix unpaired parent child_count for force_resume
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
commit c745253e2a691a40c66790defe85c104a887e14a upstream.
As pm_runtime_need_not_resume() relies also on usage_count, it can return a different value in pm_runtime_force_suspend() compared to when called in pm_runtime_force_resume(). Different return values can happen if anything calls PM runtime functions in between, and causes the parent child_count to increase on every resume.
So far I've seen the issue only for omapdrm that does complicated things with PM runtime calls during system suspend for legacy reasons:
omap_atomic_commit_tail() for omapdrm.0
dispc_runtime_get()
wakes up 58000000.dss as it's the dispc parent
dispc_runtime_resume()
rpm_resume() increases parent child_count
dispc_runtime_put() won't idle, PM runtime suspend blockedpm_runtime_force_suspend() for 58000000.dss, !pm_runtime_need_not_resume()
__update_runtime_status()
system suspendedpm_runtime_force_resume() for 58000000.dss, pm_runtime_need_not_resume()
pm_runtime_enable() only called because of pm_runtime_need_not_resume()omap_atomic_commit_tail() for omapdrm.0
dispc_runtime_get()
wakes up 58000000.dss as it's the dispc parent
dispc_runtime_resume()
rpm_resume() increases parent child_count
dispc_runtime_put() won't idle, PM runtime suspend blocked
...rpm_suspend for 58000000.dss but parent child_count is now unbalanced
Let's fix the issue by adding a flag for needs_force_resume and use it in pm_runtime_force_resume() instead of pm_runtime_need_not_resume().
Additionally omapdrm system suspend could be simplified later on to avoid lots of unnecessary PM runtime calls and the complexity it adds. The driver can just use internal functions that are shared between the PM runtime and system suspend related functions.
--- drivers/base/power/runtime.c | 10 +++++++--- include/linux/pm.h | 1 + 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/base/power/runtime.c +7 -3
@@ -1637,6 +1637,7 @@ void pm_runtime_init(struct device *dev) dev->power.request_pending = false; dev->power.request =RPM_REQ_NONE ; dev->power.deferred_resume = false; + dev->power.needs_force_resume =0 ;INIT_WORK (&dev->power.work, pm_runtime_work); dev->power.timer_expires =0 ;
@@ -1804,10 +1805,12 @@ int pm_runtime_force_suspend(struct devi* its parent, but set its status to RPM_SUSPENDED anyway in case this * function will be called again for it in the meantime. */ -if (pm_runtime_need_not_resume (dev)) +if (pm_runtime_need_not_resume (dev)) {pm_runtime_set_suspended (dev); -else + }else {__update_runtime_status (dev,RPM_SUSPENDED ); + dev->power.needs_force_resume =1 ; + }return 0 ;
@@ -1834,7 +1837,7 @@ int pm_runtime_force_resume(struct devicint (*callback)(struct device *);int ret =0 ; -if (!pm_runtime_status_suspended (dev) ||pm_runtime_need_not_resume (dev)) +if (!pm_runtime_status_suspended (dev) || !dev->power.needs_force_resume) goto out;/*
@@ -1853,6 +1856,7 @@ int pm_runtime_force_resume(struct devicpm_runtime_mark_last_busy (dev); out: + dev->power.needs_force_resume =0 ;pm_runtime_enable (dev);return ret; }
include/linux/pm.h +1 -0
@@ -602,6 +602,7 @@ struct dev_pm_info { unsigned int idle_notification:1; unsigned int request_pending:1; unsigned int deferred_resume:1; + unsigned int needs_force_resume:1; unsigned int runtime_auto:1; bool ignore_children:1; unsigned int no_callbacks:1;
Greg Kroah-Hartman
maintainerPATCH 8/363 ACPI: PM: Add ACPI ID of Alder Lake Fan
In reply to Greg Kroah-HartmanFrom: Sumeet Pawnikar <[email protected]>
commit 2404b8747019184002823dba7d2f0ecf89d802b7 upstream.
Add a new unique fan ACPI device ID for Alder Lake to support it in acpi_dev_pm_attach() function.
--- drivers/acpi/device_pm.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/device_pm.c +1 -0
@@ -1310,6 +1310,7 @@ int acpi_dev_pm_attach(struct device *de {"PNP0C0B", }, /* Generic ACPI fan */ {"INT3404", }, /* Fan */ {"INTC1044", }, /* Fan for Tiger Lake generation */ + {"INTC1048", }, /* Fan for Alder Lake generation */ {} };struct acpi_device *adev =ACPI_COMPANION (dev);
Greg Kroah-Hartman
maintainerPATCH 10/363 cpufreq: intel_pstate: Use HWP if enabled by platform firmware
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit e5af36b2adb858e982d78d41d7363d05d951a19a upstream.
It turns out that there are systems where HWP is enabled during initialization by the platform firmware (BIOS), but HWP EPP support is not advertised.
After commit 7aa1031223bc ("cpufreq: intel_pstate: Avoid enabling HWP if EPP is not supported") intel_pstate refuses to use HWP on those systems, but the fallback PERF_CTL interface does not work on them either because of enabled HWP, and once enabled, HWP cannot be disabled. Consequently, the users of those systems cannot control CPU performance scaling.
Address this issue by making intel_pstate use HWP unconditionally if it is enabled already when the driver starts.
--- drivers/cpufreq/intel_pstate.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/cpufreq/intel_pstate.c +13 -1
@@ -3054,6 +3054,14 @@ static const struct x86_cpu_id hwp_suppo {} }; +static bool intel_pstate_hwp_is_enabled (void ) +{ +u64 value; + +rdmsrl (MSR_PM_ENABLE , value); +return !!(value &0x1 ); +} +static int __init intel_pstate_init (void ) {const struct x86_cpu_id *id;
@@ -3072,8 +3080,12 @@ static int __init intel_pstate_init(void* Avoid enabling HWP for processors without EPP support, * because that means incomplete HWP implementation which is a * corner case and supporting it is generally problematic. +* +* If HWP is enabled already, though, there is no choice but to +* deal with it. */ -if (!no_hwp &&boot_cpu_has (X86_FEATURE_HWP_EPP )) { +if ((!no_hwp &&boot_cpu_has (X86_FEATURE_HWP_EPP )) || +intel_pstate_hwp_is_enabled ()) { hwp_active++; hwp_mode_bdw = id->driver_data; intel_pstate.attr = hwp_cpufreq_attrs;
Greg Kroah-Hartman
maintainerPATCH 1/363 KEYS: trusted: Fix memory leak on object td
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 83a775d5f9bfda95b1c295f95a3a041a40c7f321 upstream.
Two error return paths are neglecting to free allocated object td, causing a memory leak. Fix this by returning via the error return path that securely kfree's td.
Fixes clang scan-build warning:security/keys/trusted-keys/trusted_tpm1.c:496:10: warning: Potential memory leak [unix.Malloc]
--- security/keys/trusted-keys/trusted_tpm1.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
security/keys/trusted-keys/trusted_tpm1.c +5 -3
@@ -500,10 +500,12 @@ static int tpm_seal(struct tpm_buf *tb, ret =tpm_get_random (chip, td->nonceodd,TPM_NONCE_SIZE );if (ret <0 ) -return ret; + goto out; -if (ret !=TPM_NONCE_SIZE ) -return -EIO ; +if (ret !=TPM_NONCE_SIZE ) { + ret = -EIO ; + goto out; + } ordinal =htonl (TPM_ORD_SEAL ); datsize =htonl (datalen);
Greg Kroah-Hartman
maintainerPATCH 6/363 KVM: SVM: Make sure GHCB is mapped before updating
In reply to Greg Kroah-HartmanFrom: Tom Lendacky <[email protected]>
commit a3ba26ecfb569f4aa3f867e80c02aa65f20aadad upstream.
Access to the GHCB is mainly in the VMGEXIT path and it is known that the GHCB will be mapped. But there are two paths where it is possible the GHCB might not be mapped.
The sev_vcpu_deliver_sipi_vector() routine will update the GHCB to inform the caller of the AP Reset Hold NAE event that a SIPI has been delivered. However, if a SIPI is performed without a corresponding AP Reset Hold, then the GHCB might not be mapped (depending on the previous VMEXIT), which will result in a NULL pointer dereference.
The svm_complete_emulated_msr() routine will update the GHCB to inform the caller of a RDMSR/WRMSR operation about any errors. While it is likely that the GHCB will be mapped in this situation, add a safe guard in this path to be certain a NULL pointer dereference is not encountered.
Message-Id: <a5d3ebb600a91170fc88599d5a575452b3e31036.1617979121.git.thomas.lendacky@amd.com>
--- arch/x86/kvm/svm/sev.c | 3 +++ arch/x86/kvm/svm/svm.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)
arch/x86/kvm/svm/sev.c +3 -0
@@ -2106,5 +2106,8 @@ void sev_vcpu_deliver_sipi_vector(struct* the guest will set the CS and RIP. Set SW_EXIT_INFO_2 to a * non-zero value. */ +if (!svm->ghcb) +return ; +ghcb_set_sw_exit_info_2 (svm->ghcb,1 ); }
arch/x86/kvm/svm/svm.c +1 -1
@@ -2811,7 +2811,7 @@ static int svm_get_msr(struct kvm_vcpu *static int svm_complete_emulated_msr (struct kvm_vcpu *vcpu,int err) {struct vcpu_svm *svm =to_svm (vcpu); -if (!sev_es_guest (svm->vcpu.kvm) || !err) +if (!err || !sev_es_guest (vcpu->kvm) ||WARN_ON_ONCE (!svm->ghcb))return kvm_complete_insn_gp (&svm->vcpu, err);ghcb_set_sw_exit_info_1 (svm->ghcb,1 );
Greg Kroah-Hartman
maintainerPATCH 26/363 ASoC: rsnd: core: Check convert rate in rsnd_hw_params
In reply to Greg Kroah-HartmanFrom: Mikhail Durnev <[email protected]>
[ Upstream commit 19c6a63ced5e07e40f3a5255cb1f0fe0d3be7b14 ]
snd_pcm_hw_params_set_rate_near can return incorrect sample rate in some cases, e.g. when the backend output rate is set to some value higher than 48000 Hz and the input rate is 8000 Hz. So passing the value returned by snd_pcm_hw_params_set_rate_near to snd_pcm_hw_params will result in "FSO/FSI ratio error" and playing no audio at all while the userland is not properly notified about the issue.
If SRC is unable to convert the requested sample rate to the sample rate the backend is using, then the requested sample rate should be adjusted in rsnd_hw_params. The userland will be notified about that change in the returned hw_params structure.
--- sound/soc/sh/rcar/core.c | 69 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 68 insertions(+), 1 deletion(-)
sound/soc/sh/rcar/core.c +68 -1
@@ -1428,8 +1428,75 @@ static int rsnd_hw_params(struct snd_soc_component *component, }if (io->converted_chan)dev_dbg (dev,"convert channels = %d\n" , io->converted_chan); -if (io->converted_rate) +if (io->converted_rate) { +/* +* SRC supports convert rates from params_rate(hw_params)/k_down +* to params_rate(hw_params)*k_up, where k_up is always 6, and +* k_down depends on number of channels and SRC unit. +* So all SRC units can upsample audio up to 6 times regardless +* its number of channels. And all SRC units can downsample +* 2 channel audio up to 6 times too. +*/ +int k_up =6 ; +int k_down =6 ; +int channel; +struct rsnd_mod *src_mod =rsnd_io_to_mod_src (io); +dev_dbg (dev,"convert rate = %d\n" , io->converted_rate); + + channel = io->converted_chan ? io->converted_chan : +params_channels (hw_params); + +switch (rsnd_mod_id (src_mod)) { +/* +* SRC0 can downsample 4, 6 and 8 channel audio up to 4 times. +* SRC1, SRC3 and SRC4 can downsample 4 channel audio +* up to 4 times. +* SRC1, SRC3 and SRC4 can downsample 6 and 8 channel audio +* no more than twice. +*/ +case 1 : +case 3 : +case 4 : +if (channel >4 ) { + k_down =2 ; +break ; + } + fallthrough; +case 0 : +if (channel >2 ) + k_down =4 ; +break ; + +/* Other SRC units do not support more than 2 channels */ +default : +if (channel >2 ) +return -EINVAL ; + } + +if (params_rate (hw_params) > io->converted_rate * k_down) { +hw_param_interval (hw_params,SNDRV_PCM_HW_PARAM_RATE )->min = + io->converted_rate * k_down; +hw_param_interval (hw_params,SNDRV_PCM_HW_PARAM_RATE )->max = + io->converted_rate * k_down; + hw_params->cmask |=SNDRV_PCM_HW_PARAM_RATE ; + }else if (params_rate (hw_params) * k_up < io->converted_rate) { +hw_param_interval (hw_params,SNDRV_PCM_HW_PARAM_RATE )->min = + (io->converted_rate + k_up -1 ) / k_up; +hw_param_interval (hw_params,SNDRV_PCM_HW_PARAM_RATE )->max = + (io->converted_rate + k_up -1 ) / k_up; + hw_params->cmask |=SNDRV_PCM_HW_PARAM_RATE ; + } + +/* +* TBD: Max SRC input and output rates also depend on number +* of channels and SRC unit: +* SRC1, SRC3 and SRC4 do not support more than 128kHz +* for 6 channel and 96kHz for 8 channel audio. +* Perhaps this function should return EINVAL if the input or +* the output rate exceeds the limitation. +*/ + } }return rsnd_dai_call (hw_params, io, substream, hw_params);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 35/363 net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 6215afcb9a7e35cef334dc0ae7f998cc72c8465f ]
A make W=1 build complains that:
net/sched/cls_flower.c:214:20: warning: cast from restricted __be16 net/sched/cls_flower.c:214:20: warning: incorrect type in argument 1 (different base types)net/sched/cls_flower.c:214:20: expected unsigned short [usertype] valnet/sched/cls_flower.c:214:20: got restricted __be16 [usertype] dst
This is because we use htons on struct flow_dissector_key_ports members src and dst, which are defined as __be16, so they are already in network byte order, not host. The byte swap function for the other direction should have been used.
Because htons and ntohs do the same thing (either both swap, or none does), this change has no functional effect except to silence the warnings.
--- net/sched/cls_flower.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-)
net/sched/cls_flower.c +18 -18
@@ -209,16 +209,16 @@ static bool fl_range_port_dst_cmp(struct cls_fl_filter *filter,struct fl_flow_key *key, struct fl_flow_key *mkey) { - __be16 min_mask, max_mask, min_val, max_val; + u16 min_mask, max_mask, min_val, max_val; - min_mask =htons (filter->mask->key.tp_range.tp_min.dst); - max_mask =htons (filter->mask->key.tp_range.tp_max.dst); - min_val =htons (filter->key.tp_range.tp_min.dst); - max_val =htons (filter->key.tp_range.tp_max.dst); + min_mask =ntohs (filter->mask->key.tp_range.tp_min.dst); + max_mask =ntohs (filter->mask->key.tp_range.tp_max.dst); + min_val =ntohs (filter->key.tp_range.tp_min.dst); + max_val =ntohs (filter->key.tp_range.tp_max.dst);if (min_mask && max_mask) { -if (htons (key->tp_range.tp.dst) < min_val || -htons (key->tp_range.tp.dst) > max_val) +if (ntohs (key->tp_range.tp.dst) < min_val || +ntohs (key->tp_range.tp.dst) > max_val)return false;/* skb does not have min and max values */
@@ -232,16 +232,16 @@ static bool fl_range_port_src_cmp(struct cls_fl_filter *filter,struct fl_flow_key *key, struct fl_flow_key *mkey) { - __be16 min_mask, max_mask, min_val, max_val; + u16 min_mask, max_mask, min_val, max_val; - min_mask =htons (filter->mask->key.tp_range.tp_min.src); - max_mask =htons (filter->mask->key.tp_range.tp_max.src); - min_val =htons (filter->key.tp_range.tp_min.src); - max_val =htons (filter->key.tp_range.tp_max.src); + min_mask =ntohs (filter->mask->key.tp_range.tp_min.src); + max_mask =ntohs (filter->mask->key.tp_range.tp_max.src); + min_val =ntohs (filter->key.tp_range.tp_min.src); + max_val =ntohs (filter->key.tp_range.tp_max.src);if (min_mask && max_mask) { -if (htons (key->tp_range.tp.src) < min_val || -htons (key->tp_range.tp.src) > max_val) +if (ntohs (key->tp_range.tp.src) < min_val || +ntohs (key->tp_range.tp.src) > max_val)return false;/* skb does not have min and max values */
@@ -783,16 +783,16 @@ static int fl_set_key_port_range(struct nlattr **tb, struct fl_flow_key *key, TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src));if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst && -htons (key->tp_range.tp_max.dst) <= -htons (key->tp_range.tp_min.dst)) { +ntohs (key->tp_range.tp_max.dst) <= +ntohs (key->tp_range.tp_min.dst)) {NL_SET_ERR_MSG_ATTR (extack, tb[TCA_FLOWER_KEY_PORT_DST_MIN ],"Invalid destination port range (min must be strictly smaller than max)" );return -EINVAL ; }if (mask->tp_range.tp_min.src && mask->tp_range.tp_max.src && -htons (key->tp_range.tp_max.src) <= -htons (key->tp_range.tp_min.src)) { +ntohs (key->tp_range.tp_max.src) <= +ntohs (key->tp_range.tp_min.src)) {NL_SET_ERR_MSG_ATTR (extack, tb[TCA_FLOWER_KEY_PORT_SRC_MIN ],"Invalid source port range (min must be strictly smaller than max)" );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 36/363 net: bridge: when suppression is enabled exclude RARP packets
In reply to Greg Kroah-HartmanFrom: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 0353b4a96b7a9f60fe20d1b3ebd4931a4085f91c ]
Recently we had an interop issue where RARP packets got suppressed with bridge neigh suppression enabled, but the check in the code was meant to suppress GARP. Exclude RARP packets from it which would allow some VMWare setups to work, to quote the report:
"Those RARP packets usually get generated by vMware to notify physical switches when vMotion occurs. vMware may use random sip/tip or just use sip=tip=0. So the RARP packet sometimes get properly flooded by the vtep and other times get dropped by the logic"
--- net/bridge/br_arp_nd_proxy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/bridge/br_arp_nd_proxy.c +3 -1
@@ -160,7 +160,9 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,if (br_opt_get (br,BROPT_NEIGH_SUPPRESS_ENABLED )) {if (p && (p->flags &BR_NEIGH_SUPPRESS ))return ; -if (ipv4_is_zeronet (sip) || sip == tip) { +if (parp->ar_op !=htons (ARPOP_RREQUEST ) && + parp->ar_op !=htons (ARPOP_RREPLY ) && + (ipv4_is_zeronet (sip) || sip == tip)) {/* prevent flooding to neigh suppress ports */ BR_INPUT_SKB_CB (skb)->proxyarp_replied =1 ;return ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 37/363 Bluetooth: check for zapped sk before connecting
In reply to Greg Kroah-HartmanFrom: Archie Pusaka <[email protected]>
[ Upstream commit 3af70b39fa2d415dc86c370e5b24ddb9fdacbd6f ]
There is a possibility of receiving a zapped sock on l2cap_sock_connect(). This could lead to interesting crashes, one such case is tearing down an already tore l2cap_sock as is happened with this call trace:
__dump_stack lib/dump_stack.c:15 [inline] dump_stack+0xc4/0x118 lib/dump_stack.c:56 register_lock_class kernel/locking/lockdep.c:792 [inline] register_lock_class+0x239/0x6f6 kernel/locking/lockdep.c:742 __lock_acquire+0x209/0x1e27 kernel/locking/lockdep.c:3105 lock_acquire+0x29c/0x2fb kernel/locking/lockdep.c:3599 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:137 [inline] _raw_spin_lock_bh+0x38/0x47 kernel/locking/spinlock.c:175 spin_lock_bh include/linux/spinlock.h:307 [inline] lock_sock_nested+0x44/0xfa net/core/sock.c:2518 l2cap_sock_teardown_cb+0x88/0x2fb net/bluetooth/l2cap_sock.c:1345 l2cap_chan_del+0xa3/0x383 net/bluetooth/l2cap_core.c:598 l2cap_chan_close+0x537/0x5dd net/bluetooth/l2cap_core.c:756 l2cap_chan_timeout+0x104/0x17e net/bluetooth/l2cap_core.c:429 process_one_work+0x7e3/0xcb0 kernel/workqueue.c:2064 worker_thread+0x5a5/0x773 kernel/workqueue.c:2196 kthread+0x291/0x2a6 kernel/kthread.c:211 ret_from_fork+0x4e/0x80 arch/x86/entry/entry_64.S:604
--- net/bluetooth/l2cap_sock.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/bluetooth/l2cap_sock.c +8 -0
@@ -179,9 +179,17 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,struct l2cap_chan *chan =l2cap_pi (sk)->chan;struct sockaddr_l2 la;int len, err =0 ; +bool zapped;BT_DBG ("sk %p" , sk); +lock_sock (sk); + zapped =sock_flag (sk,SOCK_ZAPPED ); +release_sock (sk); + +if (zapped) +return -EINVAL ; + if (!addr || alen < offsetofend(struct sockaddr, sa_family) || addr->sa_family !=AF_BLUETOOTH )return -EINVAL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 38/363 selftests/powerpc: Fix L1D flushing tests for Power10
In reply to Greg Kroah-HartmanFrom: Russell Currey <[email protected]>
[ Upstream commit 3a72c94ebfb1f171eba0715998010678a09ec796 ]
The rfi_flush and entry_flush selftests work by using the PM_LD_MISS_L1 perf event to count L1D misses. The value of this event has changed over time:
- Power7 uses 0x400f0
- Power8 and Power9 use both 0x400f0 and 0x3e054
- Power10 uses only 0x3e054
Rather than relying on raw values, configure perf to count L1D read misses in the most explicit way available.
This fixes the selftests to work on systems without 0x400f0 as PM_LD_MISS_L1, and should change no behaviour for systems that the tests already worked on.
The only potential downside is that referring to a specific perf event requires PMU support implemented in the kernel for that platform.
--- tools/testing/selftests/powerpc/security/entry_flush.c | 2 +- tools/testing/selftests/powerpc/security/flush_utils.h | 4 ++++ tools/testing/selftests/powerpc/security/rfi_flush.c | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-)
tools/testing/selftests/powerpc/security/entry_flush.c +1 -1
@@ -53,7 +53,7 @@ int entry_flush_test(void) entry_flush = entry_flush_orig; - fd =perf_event_open_counter (PERF_TYPE_RAW ,/* L1d miss */ 0x400f0 ,-1 ); + fd =perf_event_open_counter (PERF_TYPE_HW_CACHE ,PERF_L1D_READ_MISS_CONFIG ,-1 );FAIL_IF (fd <0 ); p = (char *)memalign (zero_size,CACHELINE_SIZE );
tools/testing/selftests/powerpc/security/flush_utils.h +4 -0
@@ -9,6 +9,10 @@#define CACHELINE_SIZE 128 +#define PERF_L1D_READ_MISS_CONFIG ((PERF_COUNT_HW_CACHE_L1D) | \ + (PERF_COUNT_HW_CACHE_OP_READ << 8) | \ + (PERF_COUNT_HW_CACHE_RESULT_MISS << 16)) +void syscall_loop (char *p,unsigned long iterations,unsigned long zero_size);
tools/testing/selftests/powerpc/security/rfi_flush.c +1 -1
@@ -54,7 +54,7 @@ int rfi_flush_test(void) rfi_flush = rfi_flush_orig; - fd =perf_event_open_counter (PERF_TYPE_RAW ,/* L1d miss */ 0x400f0 ,-1 ); + fd =perf_event_open_counter (PERF_TYPE_HW_CACHE ,PERF_L1D_READ_MISS_CONFIG ,-1 );FAIL_IF (fd <0 ); p = (char *)memalign (zero_size,CACHELINE_SIZE );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 39/363 ALSA: hda/hdmi: fix max DP-MST dev_num for Intel TGL+ platforms
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit e839fbed26e8b8713803b8ac73da92fd2b0c7594 ]
Increase the device select range to 4 on platforms supporting 4 concurrent displays.
This fixes a problem in scenario where total of 4 displays are active, and 3 of these are audio capable DP receivers and connected to a DP-MST hub. Due to incorrect range for device select, audio could not be played to the 3rd monitor in DP-MST hub.
--- sound/pci/hda/patch_hdmi.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-)
sound/pci/hda/patch_hdmi.c +11 -14
@@ -1848,16 +1848,12 @@ static int hdmi_add_pin(struct hda_codec *codec, hda_nid_t pin_nid)*/ if (spec->intel_hsw_fixup) {/* -* On Intel platforms, device entries number is -* changed dynamically. If there is a DP MST -* hub connected, the device entries number is 3. -* Otherwise, it is 1. -* Here we manually set dev_num to 3, so that -* we can initialize all the device entries when -* bootup statically. +* On Intel platforms, device entries count returned +* by AC_PAR_DEVLIST_LEN is dynamic, and depends on +* the type of receiver that is connected. Allocate pin +* structures based on worst case. */ - dev_num =3 ; - spec->dev_num =3 ; + dev_num = spec->dev_num; }else if (spec->dyn_pcm_assign && codec->dp_mst) { dev_num =snd_hda_get_num_devices (codec, pin_nid) +1 ;/*
@@ -2942,7 +2938,7 @@ static int parse_intel_hdmi(struct hda_codec *codec)/* Intel Haswell and onwards; audio component with eld notifier */ static int intel_hsw_common_init (struct hda_codec *codec,hda_nid_t vendor_nid, -const int *port_map,int port_num) +const int *port_map,int port_num,int dev_num) {struct hdmi_spec *spec;int err;
@@ -2957,6 +2953,7 @@ static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid, spec->port_map = port_map; spec->port_num = port_num; spec->intel_hsw_fixup = true; + spec->dev_num = dev_num;intel_haswell_enable_all_pins (codec, true);intel_haswell_fixup_enable_dp12 (codec);
@@ -2982,12 +2979,12 @@ static int intel_hsw_common_init(struct hda_codec *codec, hda_nid_t vendor_nid,static int patch_i915_hsw_hdmi (struct hda_codec *codec) { -return intel_hsw_common_init (codec,0x08 ,NULL ,0 ); +return intel_hsw_common_init (codec,0x08 ,NULL ,0 ,3 ); }static int patch_i915_glk_hdmi (struct hda_codec *codec) { -return intel_hsw_common_init (codec,0x0b ,NULL ,0 ); +return intel_hsw_common_init (codec,0x0b ,NULL ,0 ,3 ); }static int patch_i915_icl_hdmi (struct hda_codec *codec)
@@ -2998,7 +2995,7 @@ static int patch_i915_icl_hdmi(struct hda_codec *codec)*/ static const int map[] = {0x0 ,0x4 ,0x6 ,0x8 ,0xa ,0xb }; -return intel_hsw_common_init (codec,0x02 , map,ARRAY_SIZE (map)); +return intel_hsw_common_init (codec,0x02 , map,ARRAY_SIZE (map),3 ); }static int patch_i915_tgl_hdmi (struct hda_codec *codec)
@@ -3010,7 +3007,7 @@ static int patch_i915_tgl_hdmi(struct hda_codec *codec)static const int map[] = {0x4 ,0x6 ,0x8 ,0xa ,0xb ,0xc ,0xd ,0xe ,0xf };int ret; - ret =intel_hsw_common_init (codec,0x02 , map,ARRAY_SIZE (map)); + ret =intel_hsw_common_init (codec,0x02 , map,ARRAY_SIZE (map),4 );if (!ret) {struct hdmi_spec *spec = codec->spec;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 40/363 powerpc/32: Statically initialise first emergency context
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit a4719f5bb6d7dc220bffdc1b9f5ce5eaa5543581 ]
The check of the emergency context initialisation in vmap_stack_overflow is buggy for the SMP case, as it compares r1 with 0 while in the SMP case r1 is offseted by the CPU id.
Instead of fixing it, just perform static initialisation of the first emergency context.
--- arch/powerpc/kernel/head_32.h | 6 +----- arch/powerpc/kernel/setup_32.c | 2 +- 2 files changed, 2 insertions(+), 6 deletions(-)
arch/powerpc/kernel/head_32.h +1 -5
@@ -261,11 +261,7 @@ label: lis r1, emergency_ctx@ha#endif lwz r1, emergency_ctx@l(r1) - cmpwi cr1, r1, 0 - bne cr1, 1f - lis r1, init_thread_union@ha - addi r1, r1, init_thread_union@l -1: addi r1, r1, THREAD_SIZE - INT_FRAME_SIZE + addi r1, r1, THREAD_SIZE - INT_FRAME_SIZE EXCEPTION_PROLOG_2 SAVE_NVGPRS(r11) addi r3, r1, STACK_FRAME_OVERHEAD
arch/powerpc/kernel/setup_32.c +1 -1
@@ -164,7 +164,7 @@ void __init irqstack_early_init(void) }#ifdef CONFIG_VMAP_STACK -void *emergency_ctx[NR_CPUS ]__ro_after_init ; +void *emergency_ctx[NR_CPUS ]__ro_after_init = {[0 ] = &init_stack};void __init emergency_stack_init (void ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 41/363 net: hns3: remediate a potential overflow risk of bd_num_list
In reply to Greg Kroah-HartmanFrom: Guangbin Huang <[email protected]>
[ Upstream commit a2ee6fd28a190588e142ad8ea9d40069cd3c9f98 ]
The array size of bd_num_list is a fixed value, it may have potential overflow risk when array size of hclge_dfx_bd_offset_list is greater than that fixed value. So modify bd_num_list as a pointer and allocate memory for it according to array size of hclge_dfx_bd_offset_list.
--- .../hisilicon/hns3/hns3pf/hclge_main.c | 27 ++++++++++++++----- 1 file changed, 20 insertions(+), 7 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +20 -7
@@ -11379,7 +11379,6 @@ static int hclge_get_64_bit_regs(struct hclge_dev *hdev, u32 regs_num,#define REG_LEN_PER_LINE (REG_NUM_PER_LINE * sizeof(u32))#define REG_SEPARATOR_LINE 1#define REG_NUM_REMAIN_MASK 3 -#define BD_LIST_MAX_NUM 30int hclge_query_bd_num_cmd_send (struct hclge_dev *hdev,struct hclge_desc *desc) {
@@ -11473,15 +11472,19 @@ static int hclge_get_dfx_reg_len(struct hclge_dev *hdev, int *len) {u32 dfx_reg_type_num =ARRAY_SIZE (hclge_dfx_bd_offset_list);int data_len_per_desc, bd_num, i; -int bd_num_list[BD_LIST_MAX_NUM ]; +int *bd_num_list;u32 data_len;int ret; + bd_num_list =kcalloc (dfx_reg_type_num,sizeof (int ),GFP_KERNEL ); +if (!bd_num_list) +return -ENOMEM ; + ret =hclge_get_dfx_reg_bd_num (hdev, bd_num_list, dfx_reg_type_num);if (ret) {dev_err (&hdev->pdev->dev,"Get dfx reg bd num fail, status is %d.\n" , ret); -return ret; + goto out; } data_len_per_desc = sizeof_field(struct hclge_desc, data);
@@ -11492,6 +11495,8 @@ static int hclge_get_dfx_reg_len(struct hclge_dev *hdev, int *len) *len += (data_len /REG_LEN_PER_LINE +1 ) *REG_LEN_PER_LINE ; } +out: +kfree (bd_num_list);return ret; }
@@ -11499,16 +11504,20 @@ static int hclge_get_dfx_reg(struct hclge_dev *hdev, void *data) {u32 dfx_reg_type_num =ARRAY_SIZE (hclge_dfx_bd_offset_list);int bd_num, bd_num_max, buf_len, i; -int bd_num_list[BD_LIST_MAX_NUM ];struct hclge_desc *desc_src; +int *bd_num_list;u32 *reg = data;int ret; + bd_num_list =kcalloc (dfx_reg_type_num,sizeof (int ),GFP_KERNEL ); +if (!bd_num_list) +return -ENOMEM ; + ret =hclge_get_dfx_reg_bd_num (hdev, bd_num_list, dfx_reg_type_num);if (ret) {dev_err (&hdev->pdev->dev,"Get dfx reg bd num fail, status is %d.\n" , ret); -return ret; + goto out; } bd_num_max = bd_num_list[0 ];
@@ -11517,8 +11526,10 @@ static int hclge_get_dfx_reg(struct hclge_dev *hdev, void *data) buf_len =sizeof (*desc_src) * bd_num_max; desc_src =kzalloc (buf_len,GFP_KERNEL ); -if (!desc_src) -return -ENOMEM ; +if (!desc_src) { + ret = -ENOMEM ; + goto out; + }for (i =0 ; i < dfx_reg_type_num; i++) { bd_num = bd_num_list[i];
@@ -11534,6 +11545,8 @@ static int hclge_get_dfx_reg(struct hclge_dev *hdev, void *data) }kfree (desc_src); +out: +kfree (bd_num_list);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 42/363 net: hns3: add handling for xmit skb with recursive fraglist
In reply to Greg Kroah-HartmanFrom: Yunsheng Lin <[email protected]>
[ Upstream commit d5d5e0193ee8f88efbbc7f1471087255657bc19a ]
Currently hns3 driver only handle the xmit skb with one level of fraglist skb, add handling for multi level by calling hns3_tx_bd_num() recursively when calculating bd num and calling hns3_fill_skb_to_desc() recursively when filling tx desc.
When the skb has a fraglist level of 24, the skb is simply dropped and stats.max_recursion_level is added to record the error. Move the stat handling from hns3_nic_net_xmit() to hns3_nic_maybe_stop_tx() in order to handle different error stat and add the 'max_recursion_level' and 'hw_limitation' stat.
Note that the max recursive level as 24 is chose according to below:
commit 48a1df65334b ("skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow").
And that we are not able to find a testcase to verify the recursive fraglist case, so Fixes tag is not provided.
--- .../net/ethernet/hisilicon/hns3/hns3_enet.c | 115 +++++++++++------- .../net/ethernet/hisilicon/hns3/hns3_enet.h | 2 + .../ethernet/hisilicon/hns3/hns3_ethtool.c | 2 + 3 files changed, 78 insertions(+), 41 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +74 -41
@@ -1277,23 +1277,21 @@ static unsigned int hns3_skb_bd_num(struct sk_buff *skb, unsigned int *bd_size, }static unsigned int hns3_tx_bd_num (struct sk_buff *skb,unsigned int *bd_size, -u8 max_non_tso_bd_num) +u8 max_non_tso_bd_num,unsigned int bd_num, +unsigned int recursion_level) { +#define HNS3_MAX_RECURSION_LEVEL 24 +struct sk_buff *frag_skb; -unsigned int bd_num =0 ;/* If the total len is within the max bd limit */ -if (likely (skb->len <=HNS3_MAX_BD_SIZE && !skb_has_frag_list (skb) && +if (likely (skb->len <=HNS3_MAX_BD_SIZE && !recursion_level && + !skb_has_frag_list (skb) &&skb_shinfo (skb)->nr_frags < max_non_tso_bd_num))return skb_shinfo (skb)->nr_frags +1U ; -/* The below case will always be linearized, return -* HNS3_MAX_BD_NUM_TSO + 1U to make sure it is linearized. -*/ -if (unlikely (skb->len >HNS3_MAX_TSO_SIZE || - (!skb_is_gso (skb) && skb->len > -HNS3_MAX_NON_TSO_SIZE (max_non_tso_bd_num)))) -return HNS3_MAX_TSO_BD_NUM +1U ; +if (unlikely (recursion_level >=HNS3_MAX_RECURSION_LEVEL )) +return UINT_MAX ; bd_num =hns3_skb_bd_num (skb, bd_size, bd_num);
@@ -1301,7 +1299,8 @@ static unsigned int hns3_tx_bd_num(struct sk_buff *skb, unsigned int *bd_size,return bd_num; skb_walk_frags(skb, frag_skb) { - bd_num =hns3_skb_bd_num (frag_skb, bd_size, bd_num); + bd_num =hns3_tx_bd_num (frag_skb, bd_size, max_non_tso_bd_num, + bd_num, recursion_level +1 );if (bd_num >HNS3_MAX_TSO_BD_NUM )return bd_num; }
@@ -1361,6 +1360,43 @@ void hns3_shinfo_pack(struct skb_shared_info *shinfo, __u32 *size) size[i] =skb_frag_size (&shinfo->frags[i]); } +static int hns3_skb_linearize (struct hns3_enet_ring *ring, +struct sk_buff *skb, +u8 max_non_tso_bd_num, +unsigned int bd_num) +{ +/* 'bd_num == UINT_MAX' means the skb' fraglist has a +* recursion level of over HNS3_MAX_RECURSION_LEVEL. +*/ +if (bd_num ==UINT_MAX ) { +u64_stats_update_begin (&ring->syncp); + ring->stats.over_max_recursion++; +u64_stats_update_end (&ring->syncp); +return -ENOMEM ; + } + +/* The skb->len has exceeded the hw limitation, linearization +* will not help. +*/ +if (skb->len >HNS3_MAX_TSO_SIZE || + (!skb_is_gso (skb) && skb->len > +HNS3_MAX_NON_TSO_SIZE (max_non_tso_bd_num))) { +u64_stats_update_begin (&ring->syncp); + ring->stats.hw_limitation++; +u64_stats_update_end (&ring->syncp); +return -ENOMEM ; + } + +if (__skb_linearize (skb)) { +u64_stats_update_begin (&ring->syncp); + ring->stats.sw_err_cnt++; +u64_stats_update_end (&ring->syncp); +return -ENOMEM ; + } + +return 0 ; +} +static int hns3_nic_maybe_stop_tx (struct hns3_enet_ring *ring,struct net_device *netdev,struct sk_buff *skb)
@@ -1370,7 +1406,7 @@ static int hns3_nic_maybe_stop_tx(struct hns3_enet_ring *ring,unsigned int bd_size[HNS3_MAX_TSO_BD_NUM +1U ];unsigned int bd_num; - bd_num =hns3_tx_bd_num (skb, bd_size, max_non_tso_bd_num); + bd_num =hns3_tx_bd_num (skb, bd_size, max_non_tso_bd_num,0 ,0 ); if (unlikely(bd_num > max_non_tso_bd_num)) { if (bd_num <= HNS3_MAX_TSO_BD_NUM && skb_is_gso(skb) && !hns3_skb_need_linearized(skb, bd_size, bd_num,
@@ -1379,16 +1415,11 @@ static int hns3_nic_maybe_stop_tx(struct hns3_enet_ring *ring, goto out; } -if (__skb_linearize (skb)) +if (hns3_skb_linearize (ring, skb, max_non_tso_bd_num, + bd_num))return -ENOMEM ; bd_num =hns3_tx_bd_count (skb->len); -if ((skb_is_gso (skb) && bd_num >HNS3_MAX_TSO_BD_NUM ) || - (!skb_is_gso (skb) && - bd_num > max_non_tso_bd_num)) { -trace_hns3_over_max_bd (skb); -return -ENOMEM ; - }u64_stats_update_begin (&ring->syncp); ring->stats.tx_copy++;
@@ -1412,6 +1443,10 @@ out:return bd_num; } +u64_stats_update_begin (&ring->syncp); + ring->stats.tx_busy++; +u64_stats_update_end (&ring->syncp); +return -EBUSY ; }
@@ -1459,6 +1494,7 @@ static int hns3_fill_skb_to_desc(struct hns3_enet_ring *ring, struct sk_buff *skb, enum hns_desc_type type) {unsigned int size =skb_headlen (skb); +struct sk_buff *frag_skb;int i, ret, bd_num =0 ;if (size) {
@@ -1483,6 +1519,15 @@ static int hns3_fill_skb_to_desc(struct hns3_enet_ring *ring, bd_num += ret; } + skb_walk_frags(skb, frag_skb) { + ret =hns3_fill_skb_to_desc (ring, frag_skb, +DESC_TYPE_FRAGLIST_SKB ); +if (unlikely (ret <0 )) +return ret; + + bd_num += ret; + } +return bd_num; }
@@ -1513,8 +1558,6 @@ netdev_tx_t hns3_nic_net_xmit(struct sk_buff *skb, struct net_device *netdev)struct hns3_enet_ring *ring = &priv->ring[skb->queue_mapping];struct netdev_queue *dev_queue;int pre_ntu, next_to_use_head; -struct sk_buff *frag_skb; -int bd_num =0 ;bool doorbell;int ret;
@@ -1530,15 +1573,8 @@ netdev_tx_t hns3_nic_net_xmit(struct sk_buff *skb, struct net_device *netdev) ret =hns3_nic_maybe_stop_tx (ring, netdev, skb);if (unlikely (ret <=0 )) {if (ret == -EBUSY ) { -u64_stats_update_begin (&ring->syncp); - ring->stats.tx_busy++; -u64_stats_update_end (&ring->syncp);hns3_tx_doorbell (ring,0 , true);return NETDEV_TX_BUSY ; - }else if (ret == -ENOMEM ) { -u64_stats_update_begin (&ring->syncp); - ring->stats.sw_err_cnt++; -u64_stats_update_end (&ring->syncp); }hns3_rl_err (netdev,"xmit error: %d!\n" , ret);
@@ -1551,21 +1587,14 @@ netdev_tx_t hns3_nic_net_xmit(struct sk_buff *skb, struct net_device *netdev)if (unlikely (ret <0 )) goto fill_err; +/* 'ret < 0' means filling error, 'ret == 0' means skb->len is +* zero, which is unlikely, and 'ret > 0' means how many tx desc +* need to be notified to the hw. +*/ ret =hns3_fill_skb_to_desc (ring, skb,DESC_TYPE_SKB ); -if (unlikely (ret <0 )) +if (unlikely (ret <=0 )) goto fill_err; - bd_num += ret; - - skb_walk_frags(skb, frag_skb) { - ret =hns3_fill_skb_to_desc (ring, frag_skb, -DESC_TYPE_FRAGLIST_SKB ); -if (unlikely (ret <0 )) - goto fill_err; - - bd_num += ret; - } - pre_ntu = ring->next_to_use ? (ring->next_to_use -1 ) : (ring->desc_num -1 ); ring->desc[pre_ntu].tx.bdtp_fe_sc_vld_ra_ri |=
@@ -1576,7 +1605,7 @@ netdev_tx_t hns3_nic_net_xmit(struct sk_buff *skb, struct net_device *netdev) dev_queue =netdev_get_tx_queue (netdev, ring->queue_index); doorbell =__netdev_tx_sent_queue (dev_queue, skb->len,netdev_xmit_more ()); -hns3_tx_doorbell (ring, bd_num, doorbell); +hns3_tx_doorbell (ring, ret, doorbell);return NETDEV_TX_OK ;
@@ -1748,11 +1777,15 @@ static void hns3_nic_get_stats64(struct net_device *netdev, tx_drop += ring->stats.tx_l4_proto_err; tx_drop += ring->stats.tx_l2l3l4_err; tx_drop += ring->stats.tx_tso_err; + tx_drop += ring->stats.over_max_recursion; + tx_drop += ring->stats.hw_limitation; tx_errors += ring->stats.sw_err_cnt; tx_errors += ring->stats.tx_vlan_err; tx_errors += ring->stats.tx_l4_proto_err; tx_errors += ring->stats.tx_l2l3l4_err; tx_errors += ring->stats.tx_tso_err; + tx_errors += ring->stats.over_max_recursion; + tx_errors += ring->stats.hw_limitation; }while (u64_stats_fetch_retry_irq (&ring->syncp, start));/* fetch the rx stats */
drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +2 -0
@@ -376,6 +376,8 @@ struct ring_stats {u64 tx_l4_proto_err;u64 tx_l2l3l4_err;u64 tx_tso_err; +u64 over_max_recursion; +u64 hw_limitation; };struct {u64 rx_pkts;
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +2 -0
@@ -44,6 +44,8 @@ static const struct hns3_stats hns3_txq_stats[] = {HNS3_TQP_STAT ("l4_proto_err" , tx_l4_proto_err),HNS3_TQP_STAT ("l2l3l4_err" , tx_l2l3l4_err),HNS3_TQP_STAT ("tso_err" , tx_tso_err), +HNS3_TQP_STAT ("over_max_recursion" , over_max_recursion), + HNS3_TQP_STAT("hw_limitation", hw_limitation), };#define HNS3_TXQ_STATS_COUNT ARRAY_SIZE(hns3_txq_stats)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 43/363 ip6_vti: proper dev_{hold|put} in ndo_[un]init methods
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 40cb881b5aaa0b69a7d93dec8440d5c62dae299f ]
After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger a warning [1]
Issue here is that:
- all dev_put() should be paired with a corresponding prior dev_hold().
- A driver doing a dev_put() in its ndo_uninit() MUST also do a dev_hold() in its ndo_init(), only when ndo_init() is returning 0.
Otherwise, register_netdevice() would call ndo_uninit() in its error path and release a refcount too soon.
Therefore, we need to move dev_hold() call fromvti6_tnl_create2() to vti6_dev_init_gen()
[1]
WARNING: CPU: 0 PID: 15951 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31 Modules linked in: CPU: 0 PID: 15951 Comm: syz-executor.3 Not tainted 5.12.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31 Code: 1d 6a 5a e8 09 31 ff 89 de e8 8d 1a ab fd 84 db 75 e0 e8 d4 13 ab fd 48 c7 c7 a0 e1 c1 89 c6 05 4a 5a e8 09 01 e8 2e 36 fb 04 <0f> 0b eb c4 e8 b8 13 ab fd 0f b6 1d 39 5a e8 09 31 ff 89 de e8 58 RSP: 0018:ffffc90001eaef28 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815c51f5 RDI: fffff520003d5dd7 RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815bdf8e R11: 0000000000000000 R12: ffff88801bb1c568 R13: ffff88801f69e800 R14: 00000000ffffffff R15: ffff888050889d40 FS: 00007fc79314e700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1c1ff47108 CR3: 0000000020fd5000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_dec include/linux/refcount.h:344 [inline] refcount_dec include/linux/refcount.h:359 [inline] dev_put include/linux/netdevice.h:4135 [inline] vti6_dev_uninit+0x31a/0x360 net/ipv6/ip6_vti.c:297 register_netdevice+0xadf/0x1500 net/core/dev.c:10308 vti6_tnl_create2+0x1b5/0x400 net/ipv6/ip6_vti.c:190 vti6_newlink+0x9d/0xd0 net/ipv6/ip6_vti.c:1020 __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3443 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3491 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x331/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmmsg+0x195/0x470 net/socket.c:2490 __do_sys_sendmmsg net/socket.c:2519 [inline] __se_sys_sendmmsg net/socket.c:2516 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2516
--- net/ipv6/ip6_vti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_vti.c +1 -1
@@ -193,7 +193,6 @@ static int vti6_tnl_create2(struct net_device *dev)strcpy (t->parms.name, dev->name); -dev_hold (dev);vti6_tnl_link (ip6n, t);return 0 ;
@@ -934,6 +933,7 @@ static inline int vti6_dev_init_gen(struct net_device *dev) dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);if (!dev->tstats)return -ENOMEM ; +dev_hold (dev);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 44/363 can: dev: can_free_echo_skb(): dont crash the kernel if can_priv::echo_skb is accessed out of bounds
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit 4168d079aa41498639b2c64b4583375bcdf360d9 ]
A out of bounds access to "struct can_priv::echo_skb" leads to a kernel crash. Better print a sensible warning message instead and try to recover.
This patch is similar to:
| e7a6994d043a ("can: dev: __can_get_echo_skb(): Don't crash the kernel
| if can_priv::echo_skb is accessed out of bounds")
--- drivers/net/can/dev/skb.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/can/dev/skb.c +5 -1
@@ -151,7 +151,11 @@ void can_free_echo_skb(struct net_device *dev, unsigned int idx) {struct can_priv *priv =netdev_priv (dev); -BUG_ON (idx >= priv->echo_skb_max); +if (idx >= priv->echo_skb_max) { +netdev_err (dev,"%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n" , + __func__, idx, priv->echo_skb_max); +return ; + }if (priv->echo_skb[idx]) {dev_kfree_skb_any (priv->echo_skb[idx]);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 27/363 Bluetooth: Fix incorrect status handling in LE PHY UPDATE event
In reply to Greg Kroah-HartmanFrom: Ayush Garg <[email protected]>
[ Upstream commit 87df8bcccd2cede62dfb97dc3d4ca1fe66cb4f83 ]
Skip updation of tx and rx PHYs values, when PHY Update event's status is not successful.
--- net/bluetooth/hci_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/hci_event.c +1 -1
@@ -5912,7 +5912,7 @@ static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)BT_DBG ("%s status 0x%2.2x" , hdev->name, ev->status); -if (!ev->status) +if (ev->status)return ;hci_dev_lock (hdev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 45/363 iommu/arm-smmu-v3: Add a check to avoid invalid iotlb sync
In reply to Greg Kroah-HartmanFrom: Xiang Chen <[email protected]>
[ Upstream commit 6cc7e5a9c6b02507b9be5a99b51e970afa91c85f ]
It may send a invalid tlb sync for smmuv3 if iotlb_gather is not valid (iotlb_gather->pgsize = 0). So add a check to avoid invalid iotlb sync for it.
--- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +3 -0
@@ -2305,6 +2305,9 @@ static void arm_smmu_iotlb_sync(struct iommu_domain *domain, {struct arm_smmu_domain *smmu_domain =to_smmu_domain (domain); +if (!gather->pgsize) +return ; +arm_smmu_tlb_inv_range_domain (gather->start, gather->end - gather->start +1 , gather->pgsize, true, smmu_domain);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 46/363 ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 875c40eadf6ac6644c0f71842a4f30dd9968d281 ]
The Chuwi Hi8 tablet is using an analog mic on IN1 and has its jack-detect connected to JD2_IN4N, instead of using the default IN3 for its internal mic and JD1_IN4P for jack-detect.
It also only has 1 speaker.
Add a quirk applying the correct settings for this configuration.
--- sound/soc/intel/boards/bytcr_rt5640.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +17 -0
@@ -518,6 +518,23 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF1 | BYT_RT5640_MCLK_EN), }, + { +/* Chuwi Hi8 (CWI509) */ + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"Hampoo" ), +DMI_MATCH (DMI_BOARD_NAME ,"BYT-PA03C" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ilife" ), + DMI_MATCH(DMI_PRODUCT_NAME, "S806"), + }, + .driver_data = (void *)(BYT_RT5640_IN1_MAP | +BYT_RT5640_JD_SRC_JD2_IN4N | +BYT_RT5640_OVCD_TH_2000UA | +BYT_RT5640_OVCD_SF_0P75 | +BYT_RT5640_MONO_SPEAKER | +BYT_RT5640_DIFF_MIC | +BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, { .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Circuitco"),
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 47/363 ice: handle increasing Tx or Rx ring sizes
In reply to Greg Kroah-HartmanFrom: Paul M Stillwell Jr <[email protected]>
[ Upstream commit 2ec5638559c13b923250eccf495d2a033fccb3e7 ]
There is an issue when the Tx or Rx ring size increases using 'ethtool -L ...' where the new rings don't get the correct ITR values because when we rebuild the VSI we don't know that some of the rings may be new.
Fix this by looking at the original number of rings and determining if the rings in ice_vsi_rebuild_set_coalesce() were not present in the original rings received in ice_vsi_rebuild_get_coalesce().
Also change the code to return an error if we can't allocate memory for the coalesce data in ice_vsi_rebuild().
--- drivers/net/ethernet/intel/ice/ice_lib.c | 123 ++++++++++++++++------ drivers/net/ethernet/intel/ice/ice_txrx.h | 2 + 2 files changed, 92 insertions(+), 33 deletions(-)
drivers/net/ethernet/intel/ice/ice_lib.c +90 -33
@@ -2818,38 +2818,46 @@ int ice_vsi_release(struct ice_vsi *vsi) }/** -* ice_vsi_rebuild_update_coalesce - set coalesce for a q_vector +* ice_vsi_rebuild_update_coalesce_intrl - set interrupt rate limit for a q_vector * @q_vector: pointer to q_vector which is being updated -* @coalesce: pointer to array of struct with stored coalesce +* @stored_intrl_setting: original INTRL setting * * Set coalesce param in q_vector and update these parameters in HW. */ static void -ice_vsi_rebuild_update_coalesce (struct ice_q_vector *q_vector, -struct ice_coalesce_stored *coalesce) +ice_vsi_rebuild_update_coalesce_intrl (struct ice_q_vector *q_vector, +u16 stored_intrl_setting) { -struct ice_ring_container *rx_rc = &q_vector->rx; -struct ice_ring_container *tx_rc = &q_vector->tx;struct ice_hw *hw = &q_vector->vsi->back->hw; - tx_rc->itr_setting = coalesce->itr_tx; - rx_rc->itr_setting = coalesce->itr_rx; - -/* dynamic ITR values will be updated during Tx/Rx */ -if (!ITR_IS_DYNAMIC (tx_rc->itr_setting)) -wr32 (hw,GLINT_ITR (tx_rc->itr_idx, q_vector->reg_idx), -ITR_REG_ALIGN (tx_rc->itr_setting) >> -ICE_ITR_GRAN_S ); -if (!ITR_IS_DYNAMIC (rx_rc->itr_setting)) -wr32 (hw,GLINT_ITR (rx_rc->itr_idx, q_vector->reg_idx), -ITR_REG_ALIGN (rx_rc->itr_setting) >> -ICE_ITR_GRAN_S ); - - q_vector->intrl = coalesce->intrl; + q_vector->intrl = stored_intrl_setting;wr32 (hw,GLINT_RATE (q_vector->reg_idx),ice_intrl_usec_to_reg (q_vector->intrl, hw->intrl_gran)); } +/** +* ice_vsi_rebuild_update_coalesce_itr - set coalesce for a q_vector +* @q_vector: pointer to q_vector which is being updated +* @rc: pointer to ring container +* @stored_itr_setting: original ITR setting +* +* Set coalesce param in q_vector and update these parameters in HW. +*/ +static void +ice_vsi_rebuild_update_coalesce_itr (struct ice_q_vector *q_vector, +struct ice_ring_container *rc, +u16 stored_itr_setting) +{ +struct ice_hw *hw = &q_vector->vsi->back->hw; + + rc->itr_setting = stored_itr_setting; + +/* dynamic ITR values will be updated during Tx/Rx */ +if (!ITR_IS_DYNAMIC (rc->itr_setting)) +wr32 (hw,GLINT_ITR (rc->itr_idx, q_vector->reg_idx), +ITR_REG_ALIGN (rc->itr_setting) >>ICE_ITR_GRAN_S ); +} +/** * ice_vsi_rebuild_get_coalesce - get coalesce from all q_vectors * @vsi: VSI connected with q_vectors
@@ -2869,6 +2877,11 @@ ice_vsi_rebuild_get_coalesce(struct ice_vsi *vsi, coalesce[i].itr_tx = q_vector->tx.itr_setting; coalesce[i].itr_rx = q_vector->rx.itr_setting; coalesce[i].intrl = q_vector->intrl; + +if (i < vsi->num_txq) + coalesce[i].tx_valid = true; +if (i < vsi->num_rxq) + coalesce[i].rx_valid = true; }return vsi->num_q_vectors;
@@ -2893,17 +2906,59 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi,if ((size && !coalesce) || !vsi)return ; -for (i =0 ; i < size && i < vsi->num_q_vectors; i++) -ice_vsi_rebuild_update_coalesce (vsi->q_vectors[i], - &coalesce[i]); - -/* number of q_vectors increased, so assume coalesce settings were -* changed globally (i.e. ethtool -C eth0 instead of per-queue) and use -* the previous settings from q_vector 0 for all of the new q_vectors +/* There are a couple of cases that have to be handled here: +* 1. The case where the number of queue vectors stays the same, but +* the number of Tx or Rx rings changes (the first for loop) +* 2. The case where the number of queue vectors increased (the +* second for loop) */ -for (; i < vsi->num_q_vectors; i++) -ice_vsi_rebuild_update_coalesce (vsi->q_vectors[i], - &coalesce[0 ]); +for (i =0 ; i < size && i < vsi->num_q_vectors; i++) { +/* There are 2 cases to handle here and they are the same for +* both Tx and Rx: +* if the entry was valid previously (coalesce[i].[tr]x_valid +* and the loop variable is less than the number of rings +* allocated, then write the previous values +* +* if the entry was not valid previously, but the number of +* rings is less than are allocated (this means the number of +* rings increased from previously), then write out the +* values in the first element +*/ +if (i < vsi->alloc_rxq && coalesce[i].rx_valid) +ice_vsi_rebuild_update_coalesce_itr (vsi->q_vectors[i], + &vsi->q_vectors[i]->rx, + coalesce[i].itr_rx); +else if (i < vsi->alloc_rxq) +ice_vsi_rebuild_update_coalesce_itr (vsi->q_vectors[i], + &vsi->q_vectors[i]->rx, + coalesce[0 ].itr_rx); + +if (i < vsi->alloc_txq && coalesce[i].tx_valid) +ice_vsi_rebuild_update_coalesce_itr (vsi->q_vectors[i], + &vsi->q_vectors[i]->tx, + coalesce[i].itr_tx); +else if (i < vsi->alloc_txq) +ice_vsi_rebuild_update_coalesce_itr (vsi->q_vectors[i], + &vsi->q_vectors[i]->tx, + coalesce[0 ].itr_tx); + +ice_vsi_rebuild_update_coalesce_intrl (vsi->q_vectors[i], + coalesce[i].intrl); + } + +/* the number of queue vectors increased so write whatever is in +* the first element +*/ +for (; i < vsi->num_q_vectors; i++) { +ice_vsi_rebuild_update_coalesce_itr (vsi->q_vectors[i], + &vsi->q_vectors[i]->tx, + coalesce[0 ].itr_tx); +ice_vsi_rebuild_update_coalesce_itr (vsi->q_vectors[i], + &vsi->q_vectors[i]->rx, + coalesce[0 ].itr_rx); +ice_vsi_rebuild_update_coalesce_intrl (vsi->q_vectors[i], + coalesce[0 ].intrl); + } }/**
@@ -2932,9 +2987,11 @@ int ice_vsi_rebuild(struct ice_vsi *vsi, bool init_vsi) coalesce =kcalloc (vsi->num_q_vectors,sizeof (struct ice_coalesce_stored ),GFP_KERNEL ); -if (coalesce) - prev_num_q_vectors =ice_vsi_rebuild_get_coalesce (vsi, - coalesce); +if (!coalesce) +return -ENOMEM ; + + prev_num_q_vectors =ice_vsi_rebuild_get_coalesce (vsi, coalesce); +ice_rm_vsi_lan_cfg (vsi->port_info, vsi->idx);ice_vsi_free_q_vectors (vsi);
drivers/net/ethernet/intel/ice/ice_txrx.h +2 -0
@@ -351,6 +351,8 @@ struct ice_coalesce_stored {u16 itr_tx;u16 itr_rx;u8 intrl; +u8 tx_valid; +u8 rx_valid; };/* iterator for handling rings in ring container */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 51/363 i2c: Add I2C_AQ_NO_REP_START adapter quirk
In reply to Greg Kroah-HartmanFrom: Bence Csókás <[email protected]>
[ Upstream commit aca01415e076aa96cca0f801f4420ee5c10c660d ]
This quirk signifies that the adapter cannot do a repeated START, it always issues a STOP condition after transfers.
--- include/linux/i2c.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/i2c.h +2 -0
@@ -687,6 +687,8 @@ struct i2c_adapter_quirks {#define I2C_AQ_NO_ZERO_LEN_READ BIT(5)#define I2C_AQ_NO_ZERO_LEN_WRITE BIT(6)#define I2C_AQ_NO_ZERO_LEN (I2C_AQ_NO_ZERO_LEN_READ | I2C_AQ_NO_ZERO_LEN_WRITE) +/* adapter cannot do repeated START */ +#define I2C_AQ_NO_REP_START BIT(7)/* * i2c_adapter is the structure used to identify a physical i2c bus along
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 50/363 selftests: mptcp: launch mptcp_connect with timeout
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
[ Upstream commit 5888a61cb4e00695075bbacfd86f3fa73af00413 ]
'mptcp_connect' already has a timeout for poll() but in some cases, it is not enough.
With "timeout" tool, we will force the command to fail if it doesn't finish on time. Thanks to that, the script will continue and display details about the current state before marking the test as failed. Displaying this state is very important to be able to understand the issue. Best to have our CI reporting the issue than just "the test hanged".
Note that in mptcp_connect.sh, we were using a long timeout to validate the fact we cannot create a socket if a sysctl is set. We don't need this timeout.
In diag.sh, we want to send signals to mptcp_connect instances that have been started in the netns. But we cannot send this signal to 'timeout' otherwise that will stop the timeout and messages telling us SIGUSR1 has been received will be printed. Instead of trying to find the right PID and storing them in an array, we can simply use the output of 'ip netns pids' which is all the PIDs we want to send signal to.
--- tools/testing/selftests/net/mptcp/diag.sh | 55 ++++++++++++------- .../selftests/net/mptcp/mptcp_connect.sh | 15 +++-- .../testing/selftests/net/mptcp/mptcp_join.sh | 22 ++++++-- .../selftests/net/mptcp/simult_flows.sh | 13 ++++- 4 files changed, 72 insertions(+), 33 deletions(-)
tools/testing/selftests/net/mptcp/diag.sh +35 -20
@@ -5,8 +5,9 @@ rndh=$(printf %x $sec)-$(mktemp -u XXXXXX) ns="ns1-$rndh" ksft_skip=4 test_cnt=1 +timeout_poll=100 +timeout_test=$((timeout_poll * 2 + 1)) ret=0 -pids=() flush_pids() {
@@ -14,18 +15,14 @@ flush_pids() # give it some time sleep 1.1 - for pid in ${pids[@]}; do - [ -d /proc/$pid ] && kill -SIGUSR1 $pid >/dev/null 2>&1 - done - pids=() + ip netns pids "${ns}" | xargs --no-run-if-empty kill -SIGUSR1 &>/dev/null } cleanup() { + ip netns pids "${ns}" | xargs --no-run-if-empty kill -SIGKILL &>/dev/null + ip netns del $ns - for pid in ${pids[@]}; do - [ -d /proc/$pid ] && kill -9 $pid >/dev/null 2>&1 - done } ip -Version > /dev/null 2>&1
@@ -79,39 +76,57 @@ trap cleanup EXIT ip netns add $ns ip -n $ns link set dev lo up -echo "a" | ip netns exec $ns ./mptcp_connect -p 10000 -l 0.0.0.0 -t 100 >/dev/null & +echo "a" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ + ./mptcp_connect -p 10000 -l -t ${timeout_poll} \ + 0.0.0.0 >/dev/null & sleep 0.1 -pids[0]=$! chk_msk_nr 0 "no msk on netns creation" -echo "b" | ip netns exec $ns ./mptcp_connect -p 10000 127.0.0.1 -j -t 100 >/dev/null & +echo "b" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ + ./mptcp_connect -p 10000 -j -t ${timeout_poll} \ + 127.0.0.1 >/dev/null & sleep 0.1 -pids[1]=$! chk_msk_nr 2 "after MPC handshake " chk_msk_remote_key_nr 2 "....chk remote_key" chk_msk_fallback_nr 0 "....chk no fallback" flush_pids -echo "a" | ip netns exec $ns ./mptcp_connect -p 10001 -s TCP -l 0.0.0.0 -t 100 >/dev/null & -pids[0]=$! +echo "a" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ + ./mptcp_connect -p 10001 -l -s TCP -t ${timeout_poll} \ + 0.0.0.0 >/dev/null & sleep 0.1 -echo "b" | ip netns exec $ns ./mptcp_connect -p 10001 127.0.0.1 -j -t 100 >/dev/null & -pids[1]=$! +echo "b" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ + ./mptcp_connect -p 10001 -j -t ${timeout_poll} \ + 127.0.0.1 >/dev/null & sleep 0.1 chk_msk_fallback_nr 1 "check fallback" flush_pids NR_CLIENTS=100 for I in `seq 1 $NR_CLIENTS`; do - echo "a" | ip netns exec $ns ./mptcp_connect -p $((I+10001)) -l 0.0.0.0 -t 100 -w 10 >/dev/null & - pids[$((I*2))]=$! + echo "a" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ + ./mptcp_connect -p $((I+10001)) -l -w 10 \ + -t ${timeout_poll} 0.0.0.0 >/dev/null & done sleep 0.1 for I in `seq 1 $NR_CLIENTS`; do - echo "b" | ip netns exec $ns ./mptcp_connect -p $((I+10001)) 127.0.0.1 -t 100 -w 10 >/dev/null & - pids[$((I*2 + 1))]=$! + echo "b" | \ + timeout ${timeout_test} \ + ip netns exec $ns \ + ./mptcp_connect -p $((I+10001)) -w 10 \ + -t ${timeout_poll} 127.0.0.1 >/dev/null & done sleep 1.5
tools/testing/selftests/net/mptcp/mptcp_connect.sh +11 -4
@@ -11,7 +11,8 @@ cin="" cout="" ksft_skip=4 capture=false -timeout=30 +timeout_poll=30 +timeout_test=$((timeout_poll * 2 + 1)) ipv6=true ethtool_random_on=true tc_delay="$((RANDOM%50))"
@@ -273,7 +274,7 @@ check_mptcp_disabled() ip netns exec ${disabled_ns} sysctl -q net.mptcp.enabled=0 local err=0 - LANG=C ip netns exec ${disabled_ns} ./mptcp_connect -t $timeout -p 10000 -s MPTCP 127.0.0.1 < "$cin" 2>&1 | \ + LANG=C ip netns exec ${disabled_ns} ./mptcp_connect -p 10000 -s MPTCP 127.0.0.1 < "$cin" 2>&1 | \ grep -q "^socket: Protocol not available$" && err=1 ip netns delete ${disabled_ns}
@@ -430,14 +431,20 @@ do_transfer() local stat_cookietx_last=$(get_mib_counter "${listener_ns}" "TcpExtSyncookiesSent") local stat_cookierx_last=$(get_mib_counter "${listener_ns}" "TcpExtSyncookiesRecv") - ip netns exec ${listener_ns} ./mptcp_connect -t $timeout -l -p $port -s ${srv_proto} $extra_args $local_addr < "$sin" > "$sout" & + timeout ${timeout_test} \ + ip netns exec ${listener_ns} \ + ./mptcp_connect -t ${timeout_poll} -l -p $port -s ${srv_proto} \ + $extra_args $local_addr < "$sin" > "$sout" & local spid=$! wait_local_port_listen "${listener_ns}" "${port}" local start start=$(date +%s%3N) - ip netns exec ${connector_ns} ./mptcp_connect -t $timeout -p $port -s ${cl_proto} $extra_args $connect_addr < "$cin" > "$cout" & + timeout ${timeout_test} \ + ip netns exec ${connector_ns} \ + ./mptcp_connect -t ${timeout_poll} -p $port -s ${cl_proto} \ + $extra_args $connect_addr < "$cin" > "$cout" & local cpid=$! wait $cpid
tools/testing/selftests/net/mptcp/mptcp_join.sh +16 -6
@@ -8,7 +8,8 @@ cin="" cinsent="" cout="" ksft_skip=4 -timeout=30 +timeout_poll=30 +timeout_test=$((timeout_poll * 2 + 1)) mptcp_connect="" capture=0 do_all_tests=1
@@ -245,17 +246,26 @@ do_transfer() local_addr="0.0.0.0" fi - ip netns exec ${listener_ns} $mptcp_connect -t $timeout -l -p $port \ - -s ${srv_proto} ${local_addr} < "$sin" > "$sout" & + timeout ${timeout_test} \ + ip netns exec ${listener_ns} \ + $mptcp_connect -t ${timeout_poll} -l -p $port -s ${srv_proto} \ + ${local_addr} < "$sin" > "$sout" & spid=$! sleep 1 if [ "$test_link_fail" -eq 0 ];then - ip netns exec ${connector_ns} $mptcp_connect -t $timeout -p $port -s ${cl_proto} $connect_addr < "$cin" > "$cout" & + timeout ${timeout_test} \ + ip netns exec ${connector_ns} \ + $mptcp_connect -t ${timeout_poll} -p $port -s ${cl_proto} \ + $connect_addr < "$cin" > "$cout" & else - ( cat "$cin" ; sleep 2; link_failure $listener_ns ; cat "$cin" ) | tee "$cinsent" | \ - ip netns exec ${connector_ns} $mptcp_connect -t $timeout -p $port -s ${cl_proto} $connect_addr > "$cout" & + ( cat "$cin" ; sleep 2; link_failure $listener_ns ; cat "$cin" ) | \ + tee "$cinsent" | \ + timeout ${timeout_test} \ + ip netns exec ${connector_ns} \ + $mptcp_connect -t ${timeout_poll} -p $port -s ${cl_proto} \ + $connect_addr > "$cout" & fi cpid=$!
tools/testing/selftests/net/mptcp/simult_flows.sh +10 -3
@@ -7,7 +7,8 @@ ns2="ns2-$rndh" ns3="ns3-$rndh" capture=false ksft_skip=4 -timeout=30 +timeout_poll=30 +timeout_test=$((timeout_poll * 2 + 1)) test_cnt=1 ret=0 bail=0
@@ -157,14 +158,20 @@ do_transfer() sleep 1 fi - ip netns exec ${ns3} ./mptcp_connect -jt $timeout -l -p $port 0.0.0.0 < "$sin" > "$sout" & + timeout ${timeout_test} \ + ip netns exec ${ns3} \ + ./mptcp_connect -jt ${timeout_poll} -l -p $port \ + 0.0.0.0 < "$sin" > "$sout" & local spid=$! wait_local_port_listen "${ns3}" "${port}" local start start=$(date +%s%3N) - ip netns exec ${ns1} ./mptcp_connect -jt $timeout -p $port 10.0.3.3 < "$cin" > "$cout" & + timeout ${timeout_test} \ + ip netns exec ${ns1} \ + ./mptcp_connect -jt ${timeout_poll} -p $port \ + 10.0.3.3 < "$cin" > "$cout" & local cpid=$! wait $cpid
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 48/363 Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip.
In reply to Greg Kroah-HartmanFrom: mark-yw.chen <[email protected]>
[ Upstream commit 27e554a4fcd84e499bf0a82122b8c4c3f1de38b6 ]
Adding support LE scatternet and WBS for Mediatek Chip
--- drivers/bluetooth/btusb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +3 -1
@@ -399,7 +399,9 @@ static const struct usb_device_id blacklist_table[] = {/* MediaTek Bluetooth devices */ { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01), - .driver_info = BTUSB_MEDIATEK }, + .driver_info =BTUSB_MEDIATEK | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, /* Additional MediaTek MT7615E Bluetooth devices */ { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK},
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 49/363 ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 84cb0d5581b6a7bd5d96013f67e9f2eb0c7b4378 ]
Add a quirk with the jack-detect and dmic settings necessary to make jack-detect and the builtin mic work on Dell Venue 10 Pro 5055 tablets.
--- sound/soc/codecs/rt5670.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/soc/codecs/rt5670.c +12 -0
@@ -2980,6 +2980,18 @@ static const struct dmi_system_id dmi_platform_intel_quirks[] = {RT5670_GPIO1_IS_IRQ | RT5670_JD_MODE3), }, + { + .callback = rt5670_quirk_cb, + .ident = "Dell Venue 10 Pro 5055", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Venue 10 Pro 5055"), + }, + .driver_data = (unsigned long *)(RT5670_DMIC_EN | +RT5670_DMIC2_INR | +RT5670_GPIO1_IS_IRQ | + RT5670_JD_MODE1), + }, { .callback = rt5670_quirk_cb, .ident = "Aegex 10 tablet (RU2)",
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 52/363 Bluetooth: Do not set cur_adv_instance in adv param MGMT request
In reply to Greg Kroah-HartmanFrom: Daniel Winkler <[email protected]>
[ Upstream commit b6f1b79deabd32f89adbf24ef7b30f82d029808a ]
We set hdev->cur_adv_instance in the adv param MGMT request to allow the callback to the hci param request to set the tx power to the correct instance. Now that the callbacks use the advertising handle from the hci request (as they should), this workaround is no longer necessary.
Furthermore, this change resolves a race condition that is more prevalent when using the extended advertising MGMT calls - if hdev->cur_adv_instance is set in the params request, then when the data request is called, we believe our new instance is already active. This treats it as an update and immediately schedules the instance with the controller, which has a potential race with the software rotation adv update. By not setting hdev->cur_adv_instance too early, the new instance is queued as it should be, to be used when the rotation comes around again.
This change is tested on harrison peak to confirm that it resolves the race condition on registration, and that there is no regression in single- and multi-advertising automated tests.
--- net/bluetooth/mgmt.c | 1 - 1 file changed, 1 deletion(-)
net/bluetooth/mgmt.c +0 -1
@@ -7976,7 +7976,6 @@ static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, goto unlock; } - hdev->cur_adv_instance = cp->instance;/* Submit request for advertising params if ext adv available */ if (ext_adv_capable (hdev)) {hci_req_init (&req, hdev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 53/363 MIPS: Loongson64: Use _CACHE_UNCACHED instead of _CACHE_UNCACHED_ACCELERATED
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit 5e65c52ec716af6e8f51dacdaeb4a4d872249af1 ]
Loongson64 processors have a writecombine issue that maybe failed to write back framebuffer used with ATI Radeon or AMD GPU at times, after commit 8a08e50cee66 ("drm: Permit video-buffers writecombine mapping for MIPS"), there exists some errors such as blurred screen and lockup, and so on.
[ 60.958721] radeon 0000:03:00.0: ring 0 stalled for more than 10079msec [ 60.965315] radeon 0000:03:00.0: GPU lockup (current fence id 0x0000000000000112 last fence id 0x000000000000011d on ring 0) [ 60.976525] radeon 0000:03:00.0: ring 3 stalled for more than 10086msec [ 60.983156] radeon 0000:03:00.0: GPU lockup (current fence id 0x0000000000000374 last fence id 0x00000000000003a8 on ring 3)
As discussed earlier [1], it might be better to disable writecombine on the CPU detection side because the root cause is unknown now.
Actually, this patch is a temporary solution to just make it work well, it is not a proper and final solution, I hope someone will have a better solution to fix this issue in the future.
[1] https://lore.kernel.org/patchwork/patch/1285542/
--- arch/mips/kernel/cpu-probe.c | 3 --- 1 file changed, 3 deletions(-)
arch/mips/kernel/cpu-probe.c +0 -3
@@ -1752,7 +1752,6 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)set_isa (c,MIPS_CPU_ISA_M64R2 );break ; } - c->writecombine = _CACHE_UNCACHED_ACCELERATED; c->ases |= (MIPS_ASE_LOONGSON_MMI |MIPS_ASE_LOONGSON_EXT |MIPS_ASE_LOONGSON_EXT2 );break ;
@@ -1782,7 +1781,6 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)* register, we correct it here. */ c->options |=MIPS_CPU_FTLB |MIPS_CPU_TLBINV |MIPS_CPU_LDPTE ; - c->writecombine = _CACHE_UNCACHED_ACCELERATED; c->ases |= (MIPS_ASE_LOONGSON_MMI |MIPS_ASE_LOONGSON_CAM |MIPS_ASE_LOONGSON_EXT |MIPS_ASE_LOONGSON_EXT2 ); c->ases &= ~MIPS_ASE_VZ ;/* VZ of Loongson-3A2000/3000 is incomplete */
@@ -1793,7 +1791,6 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)set_elf_platform (cpu,"loongson3a" );set_isa (c,MIPS_CPU_ISA_M64R2 );decode_cpucfg (c); - c->writecombine = _CACHE_UNCACHED_ACCELERATED;break ;default :panic ("Unknown Loongson Processor ID!" );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 54/363 coresight: Do not scan for graph if none is present
In reply to Greg Kroah-HartmanFrom: Suzuki K Poulose <[email protected]>
[ Upstream commit 2b921b671a8d29c2adb255a86409aad1e3267309 ]
If a graph node is not found for a given node, of_get_next_endpoint() will emit the following error message :
OF: graph: no port node found in /<node_name>
If the given component doesn't have any explicit connections (e.g, ETE) we could simply ignore the graph parsing. As for any legacy component where this is mandatory, the device will not be usable as before this patch. Updating the DT bindings to Yaml and enabling the schema checks can detect such issues with the DT.
--- drivers/hwtracing/coresight/coresight-platform.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hwtracing/coresight/coresight-platform.c +6 -0
@@ -90,6 +90,12 @@ static void of_coresight_get_ports_legacy(const struct device_node *node,struct of_endpoint endpoint;int in =0 , out =0 ; +/* +* Avoid warnings in of_graph_get_next_endpoint() +* if the device doesn't have any graph connections +*/ +if (!of_graph_is_present (node)) +return ; do { ep = of_graph_get_next_endpoint(node, ep); if (!ep)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 28/363 i2c: bail out early when RDWR parameters are wrong
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 71581562ee36032d2d574a9b23ad4af6d6a64cf7 ]
The buggy parameters currently get caught later, but emit a noisy WARN. Userspace should not be able to trigger this, so add similar checks much earlier. Also avoids some unneeded code paths, of course. Apply kernel coding stlye to a comment while here.
--- drivers/i2c/i2c-dev.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/i2c/i2c-dev.c +7 -2
@@ -440,8 +440,13 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) sizeof(rdwr_arg)))return -EFAULT ; -/* Put an arbitrary limit on the number of messages that can -* be sent at once */ +if (!rdwr_arg.msgs || rdwr_arg.nmsgs ==0 ) +return -EINVAL ; + +/* +* Put an arbitrary limit on the number of messages that can +* be sent at once +*/ if (rdwr_arg.nmsgs >I2C_RDWR_IOCTL_MAX_MSGS )return -EINVAL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 56/363 mac80211: Set priority and queue mapping for injected frames
In reply to Greg Kroah-HartmanFrom: Johan Almbladh <[email protected]>
[ Upstream commit 96a7109a16665255b65d021e24141c2edae0e202 ]
Some drivers, for example mt76, use the skb priority field, and expects that to be consistent with the skb queue mapping. On some frame injection code paths that was not true, and it broke frame injection. Now the skb queue mapping is set according to the skb priority value when the frame is injected. The skb priority value is also derived from the frame data for all frame types, as it was done prior to commit dbd50a851c50 (only allocate one queue when using iTXQs). Fixes frame injection with the mt76 driver on MT7610E chipset.
--- net/mac80211/tx.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
net/mac80211/tx.c +9 -11
@@ -2267,17 +2267,6 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb, payload[7]); } -/* Initialize skb->priority for QoS frames. If the DONT_REORDER flag -* is set, stick to the default value for skb->priority to assure -* frames injected with this flag are not reordered relative to each -* other. -*/ -if (ieee80211_is_data_qos (hdr->frame_control) && - !(info->control.flags &IEEE80211_TX_CTRL_DONT_REORDER )) { -u8 *p =ieee80211_get_qos_ctl (hdr); - skb->priority = *p &IEEE80211_QOS_CTL_TAG1D_MASK ; - } -rcu_read_lock ();/*
@@ -2341,6 +2330,15 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb, info->band = chandef->chan->band; +/* Initialize skb->priority according to frame type and TID class, +* with respect to the sub interface that the frame will actually +* be transmitted on. If the DONT_REORDER flag is set, the original +* skb-priority is preserved to assure frames injected with this +* flag are not reordered relative to each other. +*/ +ieee80211_select_queue_80211 (sdata, skb, hdr); +skb_set_queue_mapping (skb,ieee80211_ac_from_tid (skb->priority)); +/* remove the injection radiotap header */ skb_pull (skb, len_rthdr);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 55/363 IB/hfi1: Correct oversized ring allocation
In reply to Greg Kroah-HartmanFrom: Mike Marciniszyn <[email protected]>
[ Upstream commit b536d4b2a279733f440c911dc831764690b90050 ]
The completion ring for tx is using the wrong size to size the ring, oversizing the ring by two orders of magniture.
Correct the allocation size and use kcalloc_node() to allocate the ring. Fix mistaken GFP defines in similar allocations.
--- drivers/infiniband/hw/hfi1/ipoib.h | 3 ++- drivers/infiniband/hw/hfi1/ipoib_tx.c | 14 +++++++------- 2 files changed, 9 insertions(+), 8 deletions(-)
drivers/infiniband/hw/hfi1/ipoib.h +2 -1
@@ -52,8 +52,9 @@ union hfi1_ipoib_flow {* @producer_lock: producer sync lock * @consumer_lock: consumer sync lock */ +struct ipoib_txreq ;struct hfi1_ipoib_circ_buf { -void **items; +struct ipoib_txreq **items;unsigned long head;unsigned long tail;unsigned long max_items;
drivers/infiniband/hw/hfi1/ipoib_tx.c +7 -7
@@ -702,14 +702,14 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv) priv->tx_napis =kcalloc_node (dev->num_tx_queues,sizeof (struct napi_struct ), -GFP_ATOMIC , +GFP_KERNEL , priv->dd->node);if (!priv->tx_napis) goto free_txreq_cache; priv->txqs =kcalloc_node (dev->num_tx_queues,sizeof (struct hfi1_ipoib_txq ), -GFP_ATOMIC , +GFP_KERNEL , priv->dd->node);if (!priv->txqs) goto free_tx_napis;
@@ -741,9 +741,9 @@ int hfi1_ipoib_txreq_init(struct hfi1_ipoib_dev_priv *priv) priv->dd->node); txq->tx_ring.items = -vzalloc_node (array_size (tx_ring_size, -sizeof (struct ipoib_txreq )), - priv->dd->node); +kcalloc_node (tx_ring_size, +sizeof (struct ipoib_txreq *), +GFP_KERNEL , priv->dd->node);if (!txq->tx_ring.items) goto free_txqs;
@@ -764,7 +764,7 @@ free_txqs:struct hfi1_ipoib_txq *txq = &priv->txqs[i];netif_napi_del (txq->napi); -vfree (txq->tx_ring.items); +kfree (txq->tx_ring.items); }kfree (priv->txqs);
@@ -817,7 +817,7 @@ void hfi1_ipoib_txreq_deinit(struct hfi1_ipoib_dev_priv *priv)hfi1_ipoib_drain_tx_list (txq);netif_napi_del (txq->napi); (void )hfi1_ipoib_drain_tx_ring (txq, txq->tx_ring.max_items); -vfree (txq->tx_ring.items); +kfree (txq->tx_ring.items); }kfree (priv->txqs);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 57/363 mac80211: clear the beacons CRC after channel switch
In reply to Greg Kroah-HartmanFrom: Emmanuel Grumbach <[email protected]>
[ Upstream commit d6843d1ee283137723b4a8c76244607ce6db1951 ]
After channel switch, we should consider any beacon with a CSA IE as a new switch. If the CSA IE is a leftover from before the switch that the AP forgot to remove, we'll get a CSA-to-Self.
This caused issues in iwlwifi where the firmware saw a beacon with a CSA-to-Self with mode = 1 on the new channel after a switch. The firmware considered this a new switch and closed its queues. Since the beacon didn't change between before and after the switch, we wouldn't handle it (the CRC is the same) and we wouldn't let the firmware open its queues again or disconnect if the CSA IE stays for too long.
Clear the CRC valid state after we switch to make sure that we handle the beacon and handle the CSA IE as required.
--- net/mac80211/mlme.c | 5 +++++ 1 file changed, 5 insertions(+)
net/mac80211/mlme.c +5 -0
@@ -1295,6 +1295,11 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata) sdata->vif.csa_active = false; ifmgd->csa_waiting_bcn = false; +/* +* If the CSA IE is still present on the beacon after the switch, +* we need to consider it as a new CSA (possibly to self). +*/ + ifmgd->beacon_crc_valid = false; ret =drv_post_channel_switch (sdata);if (ret) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 58/363 ASoC: soc-compress: lock pcm_mutex to resolve lockdep error
In reply to Greg Kroah-HartmanFrom: Gyeongtaek Lee <[email protected]>
[ Upstream commit 45475bf60cc1d42da229a0aa757180c88bab8d22 ]
If panic_on_warn=1 is added in bootargs and compress offload playback with DPCM is started, kernel panic would be occurred because rtd->card->pcm_mutex isn't held in soc_compr_open_fe() and soc_compr_free_fe() and it generates lockdep warning in the following code.
void snd_soc_runtime_action(struct snd_soc_pcm_runtime *rtd,
int stream, int action)
{
struct snd_soc_dai *dai;
int i;
lockdep_assert_held(&rtd->card->pcm_mutex);To prevent lockdep warning but minimize side effect by adding mutex, pcm_mutex is held just before snd_soc_runtime_activate() and snd_soc_runtime_deactivate() and is released right after them.
--- sound/soc/soc-compress.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/soc-compress.c +4 -0
@@ -153,7 +153,9 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream) fe->dpcm[stream].state =SND_SOC_DPCM_STATE_OPEN ; fe->dpcm[stream].runtime_update =SND_SOC_DPCM_UPDATE_NO ; +mutex_lock_nested (&fe->card->pcm_mutex, fe->card->pcm_subclass);snd_soc_runtime_activate (fe, stream); +mutex_unlock (&fe->card->pcm_mutex);mutex_unlock (&fe->card->mutex);
@@ -181,7 +183,9 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream)mutex_lock_nested (&fe->card->mutex,SND_SOC_CARD_CLASS_RUNTIME ); +mutex_lock_nested (&fe->card->pcm_mutex, fe->card->pcm_subclass);snd_soc_runtime_deactivate (fe, stream); +mutex_unlock (&fe->card->pcm_mutex); fe->dpcm[stream].runtime_update =SND_SOC_DPCM_UPDATE_FE ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 59/363 net: phy: make PHY PM ops a no-op if MAC driver manages PHY PM
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit fba863b816049b03f3fbb07b10ebdcfe5c4141f7 ]
Resume callback of the PHY driver is called after the one for the MAC driver. The PHY driver resume callback calls phy_init_hw(), and this is potentially problematic if the MAC driver calls phy_start() in its resume callback. One issue was reported with the fec driver and a KSZ8081 PHY which seems to become unstable if a soft reset is triggered during aneg.
The new flag allows MAC drivers to indicate that they take care of suspending/resuming the PHY. Then the MAC PM callbacks can handle any dependency between MAC and PHY PM.
--- drivers/net/phy/phy_device.c | 6 ++++++ include/linux/phy.h | 2 ++ 2 files changed, 8 insertions(+)
drivers/net/phy/phy_device.c +6 -0
@@ -273,6 +273,9 @@ static __maybe_unused int mdio_bus_phy_suspend(struct device *dev) {struct phy_device *phydev =to_phy_device (dev); +if (phydev->mac_managed_pm) +return 0 ; +/* We must stop the state machine manually, otherwise it stops out of * control, possibly with the phydev->lock held. Upon resume, netdev * may call phy routines that try to grab the same lock, and that may
@@ -294,6 +297,9 @@ static __maybe_unused int mdio_bus_phy_resume(struct device *dev)struct phy_device *phydev =to_phy_device (dev);int ret; +if (phydev->mac_managed_pm) +return 0 ; +if (!phydev->suspended_by_mdio_bus) goto no_resume;
include/linux/phy.h +2 -0
@@ -493,6 +493,7 @@ struct macsec_ops;* @loopback_enabled: Set true if this PHY has been loopbacked successfully. * @downshifted_rate: Set true if link speed has been downshifted. * @is_on_sfp_module: Set true if PHY is located on an SFP module. +* @mac_managed_pm: Set true if MAC driver takes of suspending/resuming PHY * @state: State of the PHY for management purposes * @dev_flags: Device-specific flags used by the PHY driver. * @irq: IRQ number of the PHY's interrupt (-1 if none)
@@ -567,6 +568,7 @@ struct phy_device { unsigned loopback_enabled:1; unsigned downshifted_rate:1; unsigned is_on_sfp_module:1; + unsigned mac_managed_pm:1; unsigned autoneg:1;/* The most recently read link state */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 60/363 net: fec: use mac-managed PHY PM
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 557d5dc83f6831b4e54d141e9b121850406f9a60 ]
Use the new mac_managed_pm flag to work around an issue with KSZ8081 PHY that becomes unstable when a soft reset is triggered during aneg.
--- drivers/net/ethernet/freescale/fec_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/freescale/fec_main.c +3 -0
@@ -2048,6 +2048,8 @@ static int fec_enet_mii_probe(struct net_device *ndev) fep->link =0 ; fep->full_duplex =0 ; + phy_dev->mac_managed_pm =1 ; +phy_attached_info (phy_dev);return 0 ;
@@ -3864,6 +3866,7 @@ static int __maybe_unused fec_resume(struct device *dev)netif_device_attach (ndev);netif_tx_unlock_bh (ndev);napi_enable (&fep->napi); +phy_init_hw (ndev->phydev);phy_start (ndev->phydev); }rtnl_unlock ();
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 61/363 pinctrl: samsung: use int for register masks in Exynos
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit fa0c10a5f3a49130dd11281aa27e7e1c8654abc7 ]
The Special Function Registers on all Exynos SoC, including ARM64, are 32-bit wide, so entire driver uses matching functions like readl() or writel(). On 64-bit ARM using unsigned long for register masks:
1. makes little sense as immediately after bitwise operation it will be cast to 32-bit value when calling writel(),
2. is actually error-prone because it might promote other operands to 64-bit.
Addresses-Coverity: Unintentional integer overflow
--- drivers/pinctrl/samsung/pinctrl-exynos.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/pinctrl/samsung/pinctrl-exynos.c +5 -5
@@ -55,7 +55,7 @@ static void exynos_irq_mask(struct irq_data *irqd)struct exynos_irq_chip *our_chip =to_exynos_irq_chip (chip);struct samsung_pin_bank *bank =irq_data_get_irq_chip_data (irqd);unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset; -unsigned long mask; +unsigned int mask;unsigned long flags;raw_spin_lock_irqsave (&bank->slock, flags);
@@ -83,7 +83,7 @@ static void exynos_irq_unmask(struct irq_data *irqd)struct exynos_irq_chip *our_chip =to_exynos_irq_chip (chip);struct samsung_pin_bank *bank =irq_data_get_irq_chip_data (irqd);unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset; -unsigned long mask; +unsigned int mask;unsigned long flags;/*
@@ -483,7 +483,7 @@ static void exynos_irq_eint0_15(struct irq_desc *desc)chained_irq_exit (chip, desc); } -static inline void exynos_irq_demux_eint (unsigned long pend, +static inline void exynos_irq_demux_eint (unsigned int pend,struct irq_domain *domain) {unsigned int irq;
@@ -500,8 +500,8 @@ static void exynos_irq_demux_eint16_31(struct irq_desc *desc) {struct irq_chip *chip =irq_desc_get_chip (desc);struct exynos_muxed_weint_data *eintd =irq_desc_get_handler_data (desc); -unsigned long pend; -unsigned long mask; +unsigned int pend; +unsigned int mask;int i;chained_irq_enter (chip, desc);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 62/363 rtw88: 8822c: add LC calibration for RTL8822C
In reply to Greg Kroah-HartmanFrom: Po-Hao Huang <[email protected]>
[ Upstream commit 7ae7784ec2a812c07d2ca91a6538ef2470154fb6 ]
Fix power tracking issue by replacing unnecessary IQ calibration with LC calibration.
When thermal difference exceeds limitation, let RF circuit adjsut its characteristic to fit in current environment.
--- drivers/net/wireless/realtek/rtw88/main.h | 2 ++ drivers/net/wireless/realtek/rtw88/phy.c | 14 ++++++++++ drivers/net/wireless/realtek/rtw88/phy.h | 1 + drivers/net/wireless/realtek/rtw88/reg.h | 5 ++++ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 27 +++++++++++++++++-- 5 files changed, 47 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw88/main.h +2 -0
@@ -1166,6 +1166,7 @@ struct rtw_chip_info {bool en_dis_dpd;u16 dpd_ratemask;u8 iqk_threshold; +u8 lck_threshold;const struct rtw_pwr_track_tbl *pwr_track_tbl;u8 bfer_su_max_num;
@@ -1534,6 +1535,7 @@ struct rtw_dm_info {u32 rrsr_mask_min;u8 thermal_avg[RTW_RF_PATH_MAX ];u8 thermal_meter_k; +u8 thermal_meter_lck;s8 delta_power_index[RTW_RF_PATH_MAX ];s8 delta_power_index_last[RTW_RF_PATH_MAX ];u8 default_ofdm_index;
drivers/net/wireless/realtek/rtw88/phy.c +14 -0
@@ -2220,6 +2220,20 @@ s8 rtw_phy_pwrtrack_get_pwridx(struct rtw_dev *rtwdev, }EXPORT_SYMBOL (rtw_phy_pwrtrack_get_pwridx); +bool rtw_phy_pwrtrack_need_lck (struct rtw_dev *rtwdev) +{ +struct rtw_dm_info *dm_info = &rtwdev->dm_info; +u8 delta_lck; + + delta_lck =abs (dm_info->thermal_avg[0 ] - dm_info->thermal_meter_lck); +if (delta_lck >= rtwdev->chip->lck_threshold) { + dm_info->thermal_meter_lck = dm_info->thermal_avg[0 ]; +return true; + } +return false; +} +EXPORT_SYMBOL (rtw_phy_pwrtrack_need_lck); +bool rtw_phy_pwrtrack_need_iqk (struct rtw_dev *rtwdev) {struct rtw_dm_info *dm_info = &rtwdev->dm_info;
drivers/net/wireless/realtek/rtw88/phy.h +1 -0
@@ -55,6 +55,7 @@ u8 rtw_phy_pwrtrack_get_delta(struct rtw_dev *rtwdev, u8 path);s8 rtw_phy_pwrtrack_get_pwridx (struct rtw_dev *rtwdev,struct rtw_swing_table *swing_table,u8 tbl_path,u8 therm_path,u8 delta); +bool rtw_phy_pwrtrack_need_lck (struct rtw_dev *rtwdev);bool rtw_phy_pwrtrack_need_iqk (struct rtw_dev *rtwdev);void rtw_phy_config_swing_table (struct rtw_dev *rtwdev,struct rtw_swing_table *swing_table);
drivers/net/wireless/realtek/rtw88/reg.h +5 -0
@@ -652,8 +652,13 @@#define RF_TXATANK 0x64#define RF_TRXIQ 0x66#define RF_RXIQGEN 0x8d +#define RF_SYN_PFD 0xb0#define RF_XTALX2 0xb8 +#define RF_SYN_CTRL 0xbb#define RF_MALSEL 0xbe +#define RF_SYN_AAC 0xc9 +#define RF_AAC_CTRL 0xca +#define RF_FAST_LCK 0xcc#define RF_RCKD 0xde#define RF_TXADBG 0xde#define RF_LUTDBG 0xdf
drivers/net/wireless/realtek/rtw88/rtw8822c.c +25 -2
@@ -1126,6 +1126,7 @@ static void rtw8822c_pwrtrack_init(struct rtw_dev *rtwdev) dm_info->pwr_trk_triggered = false; dm_info->thermal_meter_k = rtwdev->efuse.thermal_meter_k; + dm_info->thermal_meter_lck = rtwdev->efuse.thermal_meter_k; }static void rtw8822c_phy_set_param (struct rtw_dev *rtwdev)
@@ -2108,6 +2109,26 @@ static void rtw8822c_false_alarm_statistics(struct rtw_dev *rtwdev)rtw_write32_set (rtwdev,REG_RX_BREAK ,BIT_COM_RX_GCK_EN ); } +static void rtw8822c_do_lck (struct rtw_dev *rtwdev) +{ +u32 val; + +rtw_write_rf (rtwdev,RF_PATH_A ,RF_SYN_CTRL ,RFREG_MASK ,0x80010 ); +rtw_write_rf (rtwdev,RF_PATH_A ,RF_SYN_PFD ,RFREG_MASK ,0x1F0FA ); +fsleep (1 ); +rtw_write_rf (rtwdev,RF_PATH_A ,RF_AAC_CTRL ,RFREG_MASK ,0x80000 ); +rtw_write_rf (rtwdev,RF_PATH_A ,RF_SYN_AAC ,RFREG_MASK ,0x80001 ); +read_poll_timeout (rtw_read_rf, val, val !=0x1 ,1000 ,100000 , + true, rtwdev,RF_PATH_A ,RF_AAC_CTRL ,0x1000 ); +rtw_write_rf (rtwdev,RF_PATH_A ,RF_SYN_PFD ,RFREG_MASK ,0x1F0F8 ); +rtw_write_rf (rtwdev,RF_PATH_B ,RF_SYN_CTRL ,RFREG_MASK ,0x80010 ); + +rtw_write_rf (rtwdev,RF_PATH_A ,RF_FAST_LCK ,RFREG_MASK ,0x0f000 ); +rtw_write_rf (rtwdev,RF_PATH_A ,RF_FAST_LCK ,RFREG_MASK ,0x4f000 ); +fsleep (1 ); +rtw_write_rf (rtwdev,RF_PATH_A ,RF_FAST_LCK ,RFREG_MASK ,0x0f000 ); +} +static void rtw8822c_do_iqk (struct rtw_dev *rtwdev) {struct rtw_iqk_para para = {0 };
@@ -3538,11 +3559,12 @@ static void __rtw8822c_pwr_track(struct rtw_dev *rtwdev)rtw_phy_config_swing_table (rtwdev, &swing_table); +if (rtw_phy_pwrtrack_need_lck (rtwdev)) +rtw8822c_do_lck (rtwdev); +for (i =0 ; i < rtwdev->hal.rf_path_num; i++)rtw8822c_pwr_track_path (rtwdev, &swing_table, i); -if (rtw_phy_pwrtrack_need_iqk (rtwdev)) -rtw8822c_do_iqk (rtwdev); }static void rtw8822c_pwr_track (struct rtw_dev *rtwdev)
@@ -4351,6 +4373,7 @@ struct rtw_chip_info rtw8822c_hw_spec = { .dpd_ratemask = DIS_DPD_RATEALL, .pwr_track_tbl = &rtw8822c_rtw_pwr_track_tbl, .iqk_threshold = 8, + .lck_threshold = 8, .bfer_su_max_num = 2, .bfer_mu_max_num = 1, .rx_ldpc = true,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 29/363 ALSA: hdsp: dont disable if not enabled
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 507cdb9adba006a7798c358456426e1aea3d9c4f ]
hdsp wants to disable a not enabled pci device, which makes kernel throw a warning. Make sure the device is enabled before calling disable.
[ 1.758292] snd_hdsp 0000:00:03.0: disabling already-disabled device [ 1.758327] WARNING: CPU: 0 PID: 180 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 [ 1.766985] Call Trace: [ 1.767121] snd_hdsp_card_free+0x94/0xf0 [snd_hdsp] [ 1.767388] release_card_device+0x4b/0x80 [snd] [ 1.767639] device_release+0x3b/0xa0 [ 1.767838] kobject_put+0x94/0x1b0 [ 1.768027] put_device+0x13/0x20 [ 1.768207] snd_card_free+0x61/0x90 [snd] [ 1.768430] snd_hdsp_probe+0x524/0x5e0 [snd_hdsp]
--- sound/pci/rme9652/hdsp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/rme9652/hdsp.c +2 -1
@@ -5390,7 +5390,8 @@ static int snd_hdsp_free(struct hdsp *hdsp)if (hdsp->port)pci_release_regions (hdsp->pci); -pci_disable_device (hdsp->pci); +if (pci_is_enabled (hdsp->pci)) +pci_disable_device (hdsp->pci);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 30/363 ALSA: hdspm: dont disable if not enabled
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 790f5719b85e12e10c41753b864e74249585ed08 ]
hdspm wants to disable a not enabled pci device, which makes kernel throw a warning. Make sure the device is enabled before calling disable.
[ 1.786391] snd_hdspm 0000:00:03.0: disabling already-disabled device [ 1.786400] WARNING: CPU: 0 PID: 182 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 [ 1.795181] Call Trace: [ 1.795320] snd_hdspm_card_free+0x58/0xa0 [snd_hdspm] [ 1.795595] release_card_device+0x4b/0x80 [snd] [ 1.795860] device_release+0x3b/0xa0 [ 1.796072] kobject_put+0x94/0x1b0 [ 1.796260] put_device+0x13/0x20 [ 1.796438] snd_card_free+0x61/0x90 [snd] [ 1.796659] snd_hdspm_probe+0x97b/0x1440 [snd_hdspm]
--- sound/pci/rme9652/hdspm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/rme9652/hdspm.c +2 -1
@@ -6883,7 +6883,8 @@ static int snd_hdspm_free(struct hdspm * hdspm)if (hdspm->port)pci_release_regions (hdspm->pci); -pci_disable_device (hdspm->pci); +if (pci_is_enabled (hdspm->pci)) +pci_disable_device (hdspm->pci);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 31/363 ALSA: rme9652: dont disable if not enabled
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit f57a741874bb6995089020e97a1dcdf9b165dcbe ]
rme9652 wants to disable a not enabled pci device, which makes kernel throw a warning. Make sure the device is enabled before calling disable.
[ 1.751595] snd_rme9652 0000:00:03.0: disabling already-disabled device [ 1.751605] WARNING: CPU: 0 PID: 174 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0 [ 1.759968] Call Trace: [ 1.760145] snd_rme9652_card_free+0x76/0xa0 [snd_rme9652] [ 1.760434] release_card_device+0x4b/0x80 [snd] [ 1.760679] device_release+0x3b/0xa0 [ 1.760874] kobject_put+0x94/0x1b0 [ 1.761059] put_device+0x13/0x20 [ 1.761235] snd_card_free+0x61/0x90 [snd] [ 1.761454] snd_rme9652_probe+0x3be/0x700 [snd_rme9652]
--- sound/pci/rme9652/rme9652.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/rme9652/rme9652.c +2 -1
@@ -1731,7 +1731,8 @@ static int snd_rme9652_free(struct snd_rme9652 *rme9652)if (rme9652->port)pci_release_regions (rme9652->pci); -pci_disable_device (rme9652->pci); +if (pci_is_enabled (rme9652->pci)) +pci_disable_device (rme9652->pci);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 32/363 ALSA: bebob: enable to deliver MIDI messages for multiple ports
In reply to Greg Kroah-HartmanFrom: Takashi Sakamoto <[email protected]>
[ Upstream commit d2b6f15bc18ac8fbce25398290774c21f5b2cd44 ]
Current implementation of bebob driver doesn't correctly handle the case that the device has multiple MIDI ports. The cause is the number of MIDI conformant data channels is passed to AM824 data block processing layer.
This commit fixes the bug.
--- sound/firewire/bebob/bebob_stream.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
sound/firewire/bebob/bebob_stream.c +7 -5
@@ -517,20 +517,22 @@ int snd_bebob_stream_init_duplex(struct snd_bebob *bebob)static int keep_resources (struct snd_bebob *bebob,struct amdtp_stream *stream,unsigned int rate,unsigned int index) { -struct snd_bebob_stream_formation *formation; +unsigned int pcm_channels; +unsigned int midi_ports;struct cmp_connection *conn;int err;if (stream == &bebob->tx_stream) { - formation = bebob->tx_stream_formations + index; + pcm_channels = bebob->tx_stream_formations[index].pcm; + midi_ports = bebob->midi_input_ports; conn = &bebob->out_conn; }else { - formation = bebob->rx_stream_formations + index; + pcm_channels = bebob->rx_stream_formations[index].pcm; + midi_ports = bebob->midi_output_ports; conn = &bebob->in_conn; } - err =amdtp_am824_set_parameters (stream, rate, formation->pcm, - formation->midi, false); + err =amdtp_am824_set_parameters (stream, rate, pcm_channels, midi_ports, false);if (err <0 )return err;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 34/363 Bluetooth: initialize skb_queue_head at l2cap_chan_create()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit be8597239379f0f53c9710dd6ab551bbf535bec6 ]
syzbot is hitting "INFO: trying to register non-static key." message [1], for "struct l2cap_chan"->tx_q.lock spinlock is not yet initialized when l2cap_chan_del() is called due to e.g. timeout.
Since "struct l2cap_chan"->lock mutex is initialized at l2cap_chan_create() immediately after "struct l2cap_chan" is allocated using kzalloc(), let's as well initialize "struct l2cap_chan"->{tx_q,srej_q}.lock spinlocks there.
[1] https://syzkaller.appspot.com/bug?extid=fadfba6a911f6bf71842
--- net/bluetooth/l2cap_core.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/l2cap_core.c +2 -0
@@ -451,6 +451,8 @@ struct l2cap_chan *l2cap_chan_create(void)if (!chan)return NULL ; +skb_queue_head_init (&chan->tx_q); +skb_queue_head_init (&chan->srej_q);mutex_init (&chan->lock);/* Set default lock nesting level */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 25/363 net: stmmac: Set FIFO sizes for ipq806x
In reply to Greg Kroah-HartmanFrom: Jonathan McDowell <[email protected]>
[ Upstream commit e127906b68b49ddb3ecba39ffa36a329c48197d3 ]
Commit eaf4fac47807 ("net: stmmac: Do not accept invalid MTU values") started using the TX FIFO size to verify what counts as a valid MTU request for the stmmac driver. This is unset for the ipq806x variant. Looking at older patches for this it seems the RX + TXs buffers can be up to 8k, so set appropriately.
(I sent this as an RFC patch in June last year, but received no replies. I've been running with this on my hardware (a MikroTik RB3011) since then with larger MTUs to support both the internal qca8k switch and VLANs with no problems. Without the patch it's impossible to set the larger MTU required to support this.)
--- drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +2 -0
@@ -352,6 +352,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) plat_dat->bsp_priv = gmac; plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; plat_dat->multicast_filter_bins =0 ; + plat_dat->tx_fifo_size =8192 ; + plat_dat->rx_fifo_size =8192 ; err =stmmac_dvr_probe (&pdev->dev, plat_dat, &stmmac_res);if (err)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 33/363 Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
In reply to Greg Kroah-HartmanFrom: Archie Pusaka <[email protected]>
[ Upstream commit 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a ]
Currently l2cap_chan_set_defaults() reset chan->conf_state to zero. However, there is a flag CONF_NOT_COMPLETE which is set when creating the l2cap_chan. It is suggested that the flag should be cleared when l2cap_chan is ready, but when l2cap_chan_set_defaults() is called, l2cap_chan is not yet ready. Therefore, we must set this flag as the default.
Example crash call trace:
__dump_stack lib/dump_stack.c:15 [inline] dump_stack+0xc4/0x118 lib/dump_stack.c:56 panic+0x1c6/0x38b kernel/panic.c:117 __warn+0x170/0x1b9 kernel/panic.c:471 warn_slowpath_fmt+0xc7/0xf8 kernel/panic.c:494 debug_print_object+0x175/0x193 lib/debugobjects.c:260 debug_object_assert_init+0x171/0x1bf lib/debugobjects.c:614 debug_timer_assert_init kernel/time/timer.c:629 [inline] debug_assert_init kernel/time/timer.c:677 [inline] del_timer+0x7c/0x179 kernel/time/timer.c:1034 try_to_grab_pending+0x81/0x2e5 kernel/workqueue.c:1230 cancel_delayed_work+0x7c/0x1c4 kernel/workqueue.c:2929 l2cap_clear_timer+0x1e/0x41 include/net/bluetooth/l2cap.h:834 l2cap_chan_del+0x2d8/0x37e net/bluetooth/l2cap_core.c:640 l2cap_chan_close+0x532/0x5d8 net/bluetooth/l2cap_core.c:756 l2cap_sock_shutdown+0x806/0x969 net/bluetooth/l2cap_sock.c:1174 l2cap_sock_release+0x64/0x14d net/bluetooth/l2cap_sock.c:1217 __sock_release+0xda/0x217 net/socket.c:580 sock_close+0x1b/0x1f net/socket.c:1039 __fput+0x322/0x55c fs/file_table.c:208 ____fput+0x17/0x19 fs/file_table.c:244 task_work_run+0x19b/0x1d3 kernel/task_work.c:115 exit_task_work include/linux/task_work.h:21 [inline] do_exit+0xe4c/0x204a kernel/exit.c:766 do_group_exit+0x291/0x291 kernel/exit.c:891 get_signal+0x749/0x1093 kernel/signal.c:2396 do_signal+0xa5/0xcdb arch/x86/kernel/signal.c:737 exit_to_usermode_loop arch/x86/entry/common.c:243 [inline] prepare_exit_to_usermode+0xed/0x235 arch/x86/entry/common.c:277 syscall_return_slowpath+0x3a7/0x3b3 arch/x86/entry/common.c:348 int_ret_from_sys_call+0x25/0xa3
--- net/bluetooth/l2cap_core.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/l2cap_core.c +2 -0
@@ -516,7 +516,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan) chan->flush_to =L2CAP_DEFAULT_FLUSH_TO ; chan->retrans_timeout =L2CAP_DEFAULT_RETRANS_TO ; chan->monitor_timeout =L2CAP_DEFAULT_MONITOR_TO ; + chan->conf_state =0 ; +set_bit (CONF_NOT_COMPLETE , &chan->conf_state);set_bit (FLAG_FORCE_ACTIVE , &chan->flags); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 64/363 mt76: mt7615: support loading EEPROM for MT7613BE
In reply to Greg Kroah-HartmanFrom: Sander Vanheule <[email protected]>
[ Upstream commit 858ebf446bee7d5077bd99488aae617908c3f4fe ]
EEPROM blobs for MT7613BE radios start with (little endian) 0x7663, which is also the PCI device ID for this device. The EEPROM is required for the radio to work at useful power levels, otherwise only the lowest power level is available.
--- drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c +1 -0
@@ -86,6 +86,7 @@ static int mt7615_check_eeprom(struct mt76_dev *dev)switch (val) {case 0x7615 :case 0x7622 : +case 0x7663 :return 0 ;default :return -EINVAL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/363 fuse: invalidate attrs when page writeback completes
In reply to Greg Kroah-HartmanFrom: Vivek Goyal <[email protected]>
[ Upstream commit 3466958beb31a8e9d3a1441a34228ed088b84f3e ]
In fuse when a direct/write-through write happens we invalidate attrs because that might have updated mtime/ctime on server and cached mtime/ctime will be stale.
What about page writeback path. Looks like we don't invalidate attrs there. To be consistent, invalidate attrs in writeback path as well. Only exception is when writeback_cache is enabled. In that case we strust local mtime/ctime and there is no need to invalidate attrs.
Recently users started experiencing failure of xfstests generic/080, geneirc/215 and generic/614 on virtiofs. This happened only newer "stat" utility and not older one. This patch fixes the issue.
So what's the root cause of the issue. Here is detailed explanation.
generic/080 test does mmap write to a file, closes the file and then checks if mtime has been updated or not. When file is closed, it leads to flushing of dirty pages (and that should update mtime/ctime on server). But we did not explicitly invalidate attrs after writeback finished. Still generic/080 passed so far and reason being that we invalidated atime in fuse_readpages_end(). This is called in fuse_readahead() path and always seems to trigger before mmaped write.
So after mmaped write when lstat() is called, it sees that atleast one of the fields being asked for is invalid (atime) and that results in generating GETATTR to server and mtime/ctime also get updated and test passes.
But newer /usr/bin/stat seems to have moved to using statx() syscall now (instead of using lstat()). And statx() allows it to query only ctime or mtime (and not rest of the basic stat fields). That means when querying for mtime, fuse_update_get_attr() sees that mtime is not invalid (only atime is invalid). So it does not generate a new GETATTR and fill stat with cached mtime/ctime. And that means updated mtime is not seen by xfstest and tests start failing.
Invalidating attrs after writeback completion should solve this problem in a generic manner.
--- fs/fuse/file.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/fuse/file.c +9 -0
@@ -1776,8 +1776,17 @@ static void fuse_writepage_end(struct fuse_mount *fm, struct fuse_args *args,container_of (args,typeof (*wpa), ia.ap.args);struct inode *inode = wpa->inode;struct fuse_inode *fi =get_fuse_inode (inode); +struct fuse_conn *fc =get_fuse_conn (inode);mapping_set_error (inode->i_mapping, error); +/* +* A writeback finished and this might have updated mtime/ctime on +* server making local mtime/ctime stale. Hence invalidate attrs. +* Do this only if writeback_cache is not enabled. If writeback_cache +* is enabled, we trust local ctime/mtime. +*/ +if (!fc->writeback_cache) +fuse_invalidate_attr (inode);spin_lock (&fi->lock);rb_erase (&wpa->writepages_entry, &fi->writepages);while (wpa->next) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 75/363 cuse: prevent clone
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
[ Upstream commit 8217673d07256b22881127bf50dce874d0e51653 ]
For cloned connections cuse_channel_release() will be called more than once, resulting in use after free.
Prevent device cloning for CUSE, which does not make sense at this point, and highly unlikely to be used in real life.
--- fs/fuse/cuse.c | 2 ++ 1 file changed, 2 insertions(+)
fs/fuse/cuse.c +2 -0
@@ -627,6 +627,8 @@ static int __init cuse_init(void) cuse_channel_fops.owner =THIS_MODULE ; cuse_channel_fops.open = cuse_channel_open; cuse_channel_fops.release = cuse_channel_release; +/* CUSE is not prepared for FUSE_DEV_IOC_CLONE */ + cuse_channel_fops.unlocked_ioctl =NULL ; cuse_class =class_create (THIS_MODULE ,"cuse" );if (IS_ERR (cuse_class))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 74/363 virtiofs: fix userns
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
[ Upstream commit 0a7419c68a45d2d066b996be5087aa2d07ce80eb ]
get_user_ns() is done twice (once in virtio_fs_get_tree() and once in fuse_conn_init()), resulting in a reference leak.
Also looks better to use fsc->user_ns (which *should* be the current_user_ns() at this point).
--- fs/fuse/virtio_fs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/fuse/virtio_fs.c +1 -2
@@ -1437,8 +1437,7 @@ static int virtio_fs_get_tree(struct fs_context *fsc)if (!fm) goto out_err; -fuse_conn_init (fc, fm,get_user_ns (current_user_ns ()), - &virtio_fs_fiq_ops, fs); +fuse_conn_init (fc, fm, fsc->user_ns, &virtio_fs_fiq_ops, fs); fc->release = fuse_free_conn; fc->delete_stale = true; fc->auto_submounts = true;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 76/363 iwlwifi: pcie: make cfg vs. trans_cfg more robust
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 48a5494d6a4cb5812f0640d9515f1876ffc7a013 ]
If we (for example) have a trans_cfg entry in the PCI IDs table, but then don't find a full cfg entry for it in the info table, we fall through to the code that treats the PCI ID table entry as a full cfg entry. This obviously causes crashes later, e.g. when trying to build the firmware name string.
Avoid such crashes by using the low bit of the pointer as a tag for trans_cfg entries (automatically using a macro that checks the type when assigning) and then checking that before trying to use the data as a full entry - if it's just a partial entry at that point, fail.
Since we're adding some macro magic, also check that the type is in fact either struct iwl_cfg_trans_params or struct iwl_cfg, failing compilation ("initializer element is not constant") if it isn't.
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 35 +++++++++++++++---- 1 file changed, 28 insertions(+), 7 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +28 -7
@@ -17,10 +17,20 @@#include "iwl-prph.h" #include "internal.h" +#define TRANS_CFG_MARKER BIT(0) +#define _IS_A (cfg, _struct) __builtin_types_compatible_p(typeof(cfg), \ + struct _struct) +extern int _invalid_type; +#define _TRANS_CFG_MARKER (cfg) \ + (__builtin_choose_expr(_IS_A(cfg, iwl_cfg_trans_params), \ + TRANS_CFG_MARKER, \ + __builtin_choose_expr(_IS_A(cfg, iwl_cfg), 0, _invalid_type))) +#define _ASSIGN_CFG (cfg) (_TRANS_CFG_MARKER(cfg) + (kernel_ulong_t)&(cfg)) +#define IWL_PCI_DEVICE (dev, subdev, cfg) \ .vendor = PCI_VENDOR_ID_INTEL, .device = (dev), \ .subvendor = PCI_ANY_ID, .subdevice = (subdev), \ - .driver_data = (kernel_ulong_t)&(cfg) + .driver_data = _ASSIGN_CFG(cfg)/* Hardware specific file defines the PCI IDs table for that hardware module */ static const struct pci_device_id iwl_hw_card_ids[] = {
@@ -1075,19 +1085,22 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {static int iwl_pci_probe (struct pci_dev *pdev,const struct pci_device_id *ent) { -const struct iwl_cfg_trans_params *trans = - (struct iwl_cfg_trans_params *)(ent->driver_data); +const struct iwl_cfg_trans_params *trans;const struct iwl_cfg *cfg_7265d__maybe_unused =NULL ;struct iwl_trans *iwl_trans;struct iwl_trans_pcie *trans_pcie;int i, ret; +const struct iwl_cfg *cfg; + + trans = (void *)(ent->driver_data & ~TRANS_CFG_MARKER ); +/* * This is needed for backwards compatibility with the old * tables, so we don't need to change all the config structs * at the same time. The cfg is used to compare with the old * full cfg structs. */ -const struct iwl_cfg *cfg = (struct iwl_cfg *)(ent->driver_data); + cfg = (void *)(ent->driver_data & ~TRANS_CFG_MARKER );/* make sure trans is the first element in iwl_cfg */ BUILD_BUG_ON (offsetof(struct iwl_cfg , trans));
@@ -1202,11 +1215,19 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)#endif /* -* If we didn't set the cfg yet, assume the trans is actually -* a full cfg from the old tables. +* If we didn't set the cfg yet, the PCI ID table entry should have +* been a full config - if yes, use it, otherwise fail. */ -if (!iwl_trans->cfg) +if (!iwl_trans->cfg) { +if (ent->driver_data &TRANS_CFG_MARKER ) { +pr_err ("No config found for PCI dev %04x/%04x, rev=0x%x, rfid=0x%x\n" , + pdev->device, pdev->subsystem_device, + iwl_trans->hw_rev, iwl_trans->hw_rf_id); + ret = -EINVAL ; + goto out_free_trans; + } iwl_trans->cfg = cfg; + }/* if we don't have a name yet, copy name from the old cfg */ if (!iwl_trans->name)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/363 iwlwifi: queue: avoid memory leak in reset flow
In reply to Greg Kroah-HartmanFrom: Mordechay Goodstein <[email protected]>
[ Upstream commit 4cf2f5904d971a461f67825434ae3c31900ff84b ]
In case the device is stopped any usage of hw queues needs to be reallocated in fw due to fw reset after device stop, so all driver internal queue should also be freed, and if we don't free the next usage would leak the old memory and get in recover flows
"iwlwifi 0000:00:03.0: dma_pool_destroy iwlwifi:bc" warning.
Also warn about trying to reuse an internal allocated queue.
--- .../wireless/intel/iwlwifi/pcie/trans-gen2.c | 4 +-- drivers/net/wireless/intel/iwlwifi/queue/tx.c | 30 ++++--------------- drivers/net/wireless/intel/iwlwifi/queue/tx.h | 3 +- 3 files changed, 9 insertions(+), 28 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +2 -2
@@ -1,7 +1,7 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* * Copyright (C) 2017 Intel Deutschland GmbH -* Copyright (C) 2018-2020 Intel Corporation +* Copyright (C) 2018-2021 Intel Corporation */ #include "iwl-trans.h" #include "iwl-prph.h"
@@ -143,7 +143,7 @@ void _iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans)if (test_and_clear_bit (STATUS_DEVICE_ENABLED , &trans->status)) {IWL_DEBUG_INFO (trans,"DEVICE_ENABLED bit was set and is now cleared\n" ); -iwl_txq_gen2_tx_stop (trans); +iwl_txq_gen2_tx_free (trans);iwl_pcie_rx_stop (trans); }
drivers/net/wireless/intel/iwlwifi/queue/tx.c +6 -24
@@ -13,30 +13,6 @@#include "iwl-scd.h" #include <linux/dmapool.h> -/* -* iwl_txq_gen2_tx_stop - Stop all Tx DMA channels -*/ -void iwl_txq_gen2_tx_stop (struct iwl_trans *trans) -{ -int txq_id; - -/* -* This function can be called before the op_mode disabled the -* queues. This happens when we have an rfkill interrupt. -* Since we stop Tx altogether - mark the queues as stopped. -*/ -memset (trans->txqs.queue_stopped,0 , -sizeof (trans->txqs.queue_stopped)); -memset (trans->txqs.queue_used,0 ,sizeof (trans->txqs.queue_used)); - -/* Unmap DMA from host system and free skb's */ -for (txq_id =0 ; txq_id <ARRAY_SIZE (trans->txqs.txq); txq_id++) { -if (!trans->txqs.txq[txq_id]) -continue ; -iwl_txq_gen2_unmap (trans, txq_id); - } -} -/* * iwl_txq_update_byte_tbl - Set up entry in Tx byte-count array */
@@ -1189,6 +1165,12 @@ static int iwl_txq_alloc_response(struct iwl_trans *trans, struct iwl_txq *txq, goto error_free_resp; } +if (WARN_ONCE (trans->txqs.txq[qid], +"queue %d already allocated\n" , qid)) { + ret = -EIO ; + goto error_free_resp; + } + txq->id = qid; trans->txqs.txq[qid] = txq; wr_ptr &= (trans->trans_cfg->base_params->max_tfd_queue_size -1 );
drivers/net/wireless/intel/iwlwifi/queue/tx.h +1 -2
@@ -1,6 +1,6 @@/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ /* -* Copyright (C) 2020 Intel Corporation +* Copyright (C) 2020-2021 Intel Corporation */ #ifndef __iwl_trans_queue_tx_h__#define __iwl_trans_queue_tx_h__
@@ -123,7 +123,6 @@ int iwl_txq_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,void iwl_txq_dyn_free (struct iwl_trans *trans,int queue);void iwl_txq_gen2_free_tfd (struct iwl_trans *trans,struct iwl_txq *txq);void iwl_txq_inc_wr_ptr (struct iwl_trans *trans,struct iwl_txq *txq); -void iwl_txq_gen2_tx_stop (struct iwl_trans *trans);void iwl_txq_gen2_tx_free (struct iwl_trans *trans);int iwl_txq_init (struct iwl_trans *trans,struct iwl_txq *txq,int slots_num,bool cmd_queue);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 78/363 iwlwifi: trans/pcie: defer transport initialisation
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit d12455fdbfe9430affd88bfbfee51777356667a0 ]
In a few PCIe devices we may have to swap out the configuration after we allocate/initialise some parts of the device because we only know the correct one after reading some registers. This causes some things such as the byte-count table allocations to be incorrect, since the configuration is swapped for one with a bigger queue size.
Fix this by initialising most of the transport much later, only after the configuration has finally been determined.
--- .../net/wireless/intel/iwlwifi/iwl-trans.c | 91 +++++++++++-------- .../net/wireless/intel/iwlwifi/iwl-trans.h | 1 + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 4 + 3 files changed, 57 insertions(+), 39 deletions(-)
drivers/net/wireless/intel/iwlwifi/iwl-trans.c +52 -39
@@ -2,7 +2,7 @@/* * Copyright (C) 2015 Intel Mobile Communications GmbH * Copyright (C) 2016-2017 Intel Deutschland GmbH -* Copyright (C) 2019-2020 Intel Corporation +* Copyright (C) 2019-2021 Intel Corporation */ #include <linux/kernel.h> #include <linux/bsearch.h>
@@ -21,7 +21,6 @@ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size, const struct iwl_cfg_trans_params *cfg_trans) {struct iwl_trans *trans; -int txcmd_size, txcmd_align;#ifdef CONFIG_LOCKDEP static struct lock_class_key __key;#endif
@@ -31,10 +30,40 @@ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size,return NULL ; trans->trans_cfg = cfg_trans; -if (!cfg_trans->gen2) { + +#ifdef CONFIG_LOCKDEP +lockdep_init_map (&trans->sync_cmd_lockdep_map,"sync_cmd_lockdep_map" , + &__key,0 ); +#endif + + trans->dev = dev; + trans->ops = ops; + trans->num_rx_queues =1 ; + +WARN_ON (!ops->wait_txq_empty && !ops->wait_tx_queues_empty); + +if (trans->trans_cfg->use_tfh) { + trans->txqs.tfd.addr_size =64 ; + trans->txqs.tfd.max_tbs =IWL_TFH_NUM_TBS ; + trans->txqs.tfd.size =sizeof (struct iwl_tfh_tfd ); + }else { + trans->txqs.tfd.addr_size =36 ; + trans->txqs.tfd.max_tbs =IWL_NUM_OF_TBS ; + trans->txqs.tfd.size =sizeof (struct iwl_tfd ); + } + trans->max_skb_frags =IWL_TRANS_MAX_FRAGS (trans); + +return trans; +} + +int iwl_trans_init (struct iwl_trans *trans) +{ +int txcmd_size, txcmd_align; + +if (!trans->trans_cfg->gen2) { txcmd_size =sizeof (struct iwl_tx_cmd ); txcmd_align =sizeof (void *); - }else if (cfg_trans->device_family <IWL_DEVICE_FAMILY_AX210 ) { + }else if (trans->trans_cfg->device_family <IWL_DEVICE_FAMILY_AX210 ) { txcmd_size =sizeof (struct iwl_tx_cmd_gen2 ); txcmd_align =64 ; }else {
@@ -46,17 +75,8 @@ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size, txcmd_size +=36 ;/* biggest possible 802.11 header */ /* Ensure device TX cmd cannot reach/cross a page boundary in gen2 */ -if (WARN_ON (cfg_trans->gen2 && txcmd_size >= txcmd_align)) -return ERR_PTR (-EINVAL ); - -#ifdef CONFIG_LOCKDEP -lockdep_init_map (&trans->sync_cmd_lockdep_map,"sync_cmd_lockdep_map" , - &__key,0 ); -#endif - - trans->dev = dev; - trans->ops = ops; - trans->num_rx_queues =1 ; +if (WARN_ON (trans->trans_cfg->gen2 && txcmd_size >= txcmd_align)) +return -EINVAL ;if (trans->trans_cfg->device_family >=IWL_DEVICE_FAMILY_AX210 ) trans->txqs.bc_tbl_size =sizeof (struct iwl_gen3_bc_tbl );
@@ -68,23 +88,16 @@ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size,* allocate here. */ if (trans->trans_cfg->gen2) { - trans->txqs.bc_pool =dmam_pool_create ("iwlwifi:bc" , dev, + trans->txqs.bc_pool =dmam_pool_create ("iwlwifi:bc" , trans->dev, trans->txqs.bc_tbl_size,256 ,0 );if (!trans->txqs.bc_pool) -return NULL ; +return -ENOMEM ; } -if (trans->trans_cfg->use_tfh) { - trans->txqs.tfd.addr_size =64 ; - trans->txqs.tfd.max_tbs =IWL_TFH_NUM_TBS ; - trans->txqs.tfd.size =sizeof (struct iwl_tfh_tfd ); - }else { - trans->txqs.tfd.addr_size =36 ; - trans->txqs.tfd.max_tbs =IWL_NUM_OF_TBS ; - trans->txqs.tfd.size =sizeof (struct iwl_tfd ); - } - trans->max_skb_frags =IWL_TRANS_MAX_FRAGS (trans); +/* Some things must not change even if the config does */ +WARN_ON (trans->txqs.tfd.addr_size != + (trans->trans_cfg->use_tfh ?64 :36 ));snprintf (trans->dev_cmd_pool_name,sizeof (trans->dev_cmd_pool_name),"iwl_cmd_pool:%s" ,dev_name (trans->dev));
@@ -93,35 +106,35 @@ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size, txcmd_size, txcmd_align, SLAB_HWCACHE_ALIGN, NULL);if (!trans->dev_cmd_pool) -return NULL ; - -WARN_ON (!ops->wait_txq_empty && !ops->wait_tx_queues_empty); +return -ENOMEM ; trans->txqs.tso_hdr_page = alloc_percpu(struct iwl_tso_hdr_page);if (!trans->txqs.tso_hdr_page) {kmem_cache_destroy (trans->dev_cmd_pool); -return NULL ; +return -ENOMEM ; }/* Initialize the wait queue for commands */ init_waitqueue_head (&trans->wait_command_queue); -return trans; +return 0 ; }void iwl_trans_free (struct iwl_trans *trans) {int i; -for_each_possible_cpu (i) { -struct iwl_tso_hdr_page *p = -per_cpu_ptr (trans->txqs.tso_hdr_page, i); +if (trans->txqs.tso_hdr_page) { +for_each_possible_cpu (i) { +struct iwl_tso_hdr_page *p = +per_cpu_ptr (trans->txqs.tso_hdr_page, i); -if (p->page) -__free_page (p->page); - } +if (p && p->page) +__free_page (p->page); + } -free_percpu (trans->txqs.tso_hdr_page); +free_percpu (trans->txqs.tso_hdr_page); + }kmem_cache_destroy (trans->dev_cmd_pool); }
drivers/net/wireless/intel/iwlwifi/iwl-trans.h +1 -0
@@ -1438,6 +1438,7 @@ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size,struct device *dev, const struct iwl_trans_ops *ops, const struct iwl_cfg_trans_params *cfg_trans); +int iwl_trans_init (struct iwl_trans *trans);void iwl_trans_free (struct iwl_trans *trans);/*****************************************************
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +4 -0
@@ -1243,6 +1243,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) trans_pcie->num_rx_bufs =RX_QUEUE_SIZE ; } + ret =iwl_trans_init (iwl_trans); +if (ret) + goto out_free_trans; +pci_set_drvdata (pdev, iwl_trans); iwl_trans->drv =iwl_drv_start (iwl_trans);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 79/363 powerpc/mm: Add cond_resched() while removing hpte mappings
In reply to Greg Kroah-HartmanFrom: Vaibhav Jain <[email protected]>
[ Upstream commit a5d6a3e73acbd619dd5b7b831762b755f9e2db80 ]
While removing large number of mappings from hash page tables for large memory systems as soft-lockup is reported because of the time spent inside htap_remove_mapping() like one below:
watchdog: BUG: soft lockup - CPU#8 stuck for 23s! <snip> NIP plpar_hcall+0x38/0x58 LR pSeries_lpar_hpte_invalidate+0x68/0xb0 Call Trace: 0x1fffffffffff000 (unreliable) pSeries_lpar_hpte_removebolted+0x9c/0x230 hash__remove_section_mapping+0xec/0x1c0 remove_section_mapping+0x28/0x3c arch_remove_memory+0xfc/0x150 devm_memremap_pages_release+0x180/0x2f0 devm_action_release+0x30/0x50 release_nodes+0x28c/0x300 device_release_driver_internal+0x16c/0x280 unbind_store+0x124/0x170 drv_attr_store+0x44/0x60 sysfs_kf_write+0x64/0x90 kernfs_fop_write+0x1b0/0x290 __vfs_write+0x3c/0x70 vfs_write+0xd4/0x270 ksys_write+0xdc/0x130 system_call+0x5c/0x70
Fix this by adding a cond_resched() to the loop in htap_remove_mapping() that issues hcall to remove hpte mapping. The call to cond_resched() is issued every HZ jiffies which should prevent the soft-lockup from being reported.
--- arch/powerpc/mm/book3s64/hash_utils.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
arch/powerpc/mm/book3s64/hash_utils.c +12 -1
@@ -338,7 +338,7 @@ repeat:int htab_remove_mapping (unsigned long vstart,unsigned long vend,int psize,int ssize) { -unsigned long vaddr; +unsigned long vaddr, time_limit;unsigned int step, shift;int rc;int ret =0 ;
@@ -351,8 +351,19 @@ int htab_remove_mapping(unsigned long vstart, unsigned long vend,/* Unmap the full range specificied */ vaddr =ALIGN_DOWN (vstart, step); + time_limit = jiffies +HZ ; +for (;vaddr < vend; vaddr += step) { rc = mmu_hash_ops.hpte_removebolted (vaddr, psize, ssize); + +/* +* For large number of mappings introduce a cond_resched() +* to prevent softlockup warnings. +*/ +if (time_after (jiffies, time_limit)) { +cond_resched (); + time_limit = jiffies +HZ ; + }if (rc == -ENOENT ) { ret = -ENOENT ;continue ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 80/363 ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init()
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit a122a116fc6d8fcf2f202dcd185173a54268f239 ]
Current rsnd needs to call .prepare (P) for clock settings, .trigger for playback start (S) and stop (E).
It should be called as below from SSI point of view.
P -> S -> E -> P -> S -> E -> ...
But, if you used MIXer, below case might happen
(2) 1: P -> S ---> E -> ... 2: P ----> S -> ... (1) (3)
P(1) setups clock, but E(2) resets it. and starts playback (3). In such case, it will reports "SSI parent/child should use same rate".
rsnd_ssi_master_clk_start() which is the main function at (P) was called from rsnd_ssi_init() (= S) before,
but was moved by below patch to rsnd_soc_dai_prepare() (= P) to avoid using clk_get_rate() which shouldn't be used under atomic context.
commit 4d230d1271064 ("ASoC: rsnd: fixup not to call clk_get/set
under non-atomic")Because of above patch, rsnd_ssi_master_clk_start() is now called at (P) which is for non atomic context. But (P) is assuming that spin lock is *not* used.
One issue now is rsnd_ssi_master_clk_start() is checking ssi->xxx which should be protected by spin lock.
After above patch, adg.c had below patch for other reasons.
commit 06e8f5c842f2d ("ASoC: rsnd: don't call clk_get_rate()
under atomic context")clk_get_rate() is used at probe() timing by this patch. In other words, rsnd_ssi_master_clk_start() is no longer using clk_get_rate() any more.
This means we can call it from rsnd_ssi_init() (= S) again which is protected by spin lock.
This patch re-move it to under spin lock, and solves
1. checking ssi->xxx without spin lock issue.
2. clk setting / device start / device stop race condition.
--- sound/soc/sh/rcar/ssi.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
sound/soc/sh/rcar/ssi.c +5 -9
@@ -507,10 +507,15 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, struct rsnd_priv *priv) {struct rsnd_ssi *ssi =rsnd_mod_to_ssi (mod); +int ret;if (!rsnd_ssi_is_run_mods (mod, io))return 0 ; + ret =rsnd_ssi_master_clk_start (mod, io); +if (ret <0 ) +return ret; + ssi->usrcnt++;rsnd_mod_power_on (mod);
@@ -1060,13 +1065,6 @@ static int rsnd_ssi_pio_pointer(struct rsnd_mod *mod,return 0 ; } -static int rsnd_ssi_prepare (struct rsnd_mod *mod, -struct rsnd_dai_stream *io, -struct rsnd_priv *priv) -{ -return rsnd_ssi_master_clk_start (mod, io); -} -static struct rsnd_mod_ops rsnd_ssi_pio_ops = { .name =SSI_NAME , .probe = rsnd_ssi_common_probe,
@@ -1079,7 +1077,6 @@ static struct rsnd_mod_ops rsnd_ssi_pio_ops = { .pointer = rsnd_ssi_pio_pointer, .pcm_new = rsnd_ssi_pcm_new, .hw_params = rsnd_ssi_hw_params, - .prepare = rsnd_ssi_prepare, .get_status = rsnd_ssi_get_status, };
@@ -1166,7 +1163,6 @@ static struct rsnd_mod_ops rsnd_ssi_dma_ops = { .pcm_new = rsnd_ssi_pcm_new, .fallback = rsnd_ssi_fallback, .hw_params = rsnd_ssi_hw_params, - .prepare = rsnd_ssi_prepare, .get_status = rsnd_ssi_get_status, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 81/363 net: bridge: propagate error code and extack from br_mc_disabled_update
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit ae1ea84b33dab45c7b6c1754231ebda5959b504c ]
Some Ethernet switches might only be able to support disabling multicast snooping globally, which is an issue for example when several bridges span the same physical device and request contradictory settings.
Propagate the return value of br_mc_disabled_update() such that this limitation is transmitted correctly to user-space.
--- net/bridge/br_multicast.c | 28 +++++++++++++++++++++------- net/bridge/br_netlink.c | 4 +++- net/bridge/br_private.h | 3 ++- net/bridge/br_sysfs_br.c | 8 +------- 4 files changed, 27 insertions(+), 16 deletions(-)
net/bridge/br_multicast.c +21 -7
@@ -1593,7 +1593,8 @@ out:spin_unlock (&br->multicast_lock); } -static void br_mc_disabled_update (struct net_device *dev,bool value) +static int br_mc_disabled_update (struct net_device *dev,bool value, +struct netlink_ext_ack *extack) {struct switchdev_attr attr = { .orig_dev = dev,
@@ -1602,11 +1603,13 @@ static void br_mc_disabled_update(struct net_device *dev, bool value) .u.mc_disabled = !value, }; -switchdev_port_attr_set (dev, &attr,NULL ); +return switchdev_port_attr_set (dev, &attr, extack); }int br_multicast_add_port (struct net_bridge_port *port) { +int err; + port->multicast_router =MDB_RTR_TYPE_TEMP_QUERY ; port->multicast_eht_hosts_limit =BR_MCAST_DEFAULT_EHT_HOSTS_LIMIT ;
@@ -1618,8 +1621,12 @@ int br_multicast_add_port(struct net_bridge_port *port)timer_setup (&port->ip6_own_query.timer, br_ip6_multicast_port_query_expired,0 );#endif -br_mc_disabled_update (port->dev, -br_opt_get (port->br,BROPT_MULTICAST_ENABLED )); + err =br_mc_disabled_update (port->dev, +br_opt_get (port->br, +BROPT_MULTICAST_ENABLED ), +NULL ); +if (err) +return err; port->mcast_stats = netdev_alloc_pcpu_stats(struct bridge_mcast_stats);if (!port->mcast_stats)
@@ -3543,16 +3550,23 @@ static void br_multicast_start_querier(struct net_bridge *br,rcu_read_unlock (); } -int br_multicast_toggle (struct net_bridge *br,unsigned long val) +int br_multicast_toggle (struct net_bridge *br,unsigned long val, +struct netlink_ext_ack *extack) {struct net_bridge_port *port;bool change_snoopers = false; +int err =0 ;spin_lock_bh (&br->multicast_lock);if (!!br_opt_get (br,BROPT_MULTICAST_ENABLED ) == !!val) goto unlock; -br_mc_disabled_update (br->dev, val); + err =br_mc_disabled_update (br->dev, val, extack); +if (err == -EOPNOTSUPP ) + err =0 ; +if (err) + goto unlock; +br_opt_toggle (br,BROPT_MULTICAST_ENABLED , !!val);if (!br_opt_get (br,BROPT_MULTICAST_ENABLED )) { change_snoopers = true;
@@ -3590,7 +3604,7 @@ unlock:br_multicast_leave_snoopers (br); } -return 0 ; +return err; }bool br_multicast_enabled (const struct net_device *dev)
net/bridge/br_netlink.c +3 -1
@@ -1293,7 +1293,9 @@ static int br_changelink(struct net_device *brdev, struct nlattr *tb[],if (data[IFLA_BR_MCAST_SNOOPING ]) {u8 mcast_snooping =nla_get_u8 (data[IFLA_BR_MCAST_SNOOPING ]); -br_multicast_toggle (br, mcast_snooping); + err =br_multicast_toggle (br, mcast_snooping, extack); +if (err) +return err; }if (data[IFLA_BR_MCAST_QUERY_USE_IFADDR ]) {
net/bridge/br_private.h +2 -1
@@ -810,7 +810,8 @@ void br_multicast_flood(struct net_bridge_mdb_entry *mdst, struct sk_buff *skb, bool local_rcv, bool local_orig);int br_multicast_set_router (struct net_bridge *br,unsigned long val);int br_multicast_set_port_router (struct net_bridge_port *p,unsigned long val); -int br_multicast_toggle (struct net_bridge *br,unsigned long val); +int br_multicast_toggle (struct net_bridge *br,unsigned long val, +struct netlink_ext_ack *extack);int br_multicast_set_querier (struct net_bridge *br,unsigned long val);int br_multicast_set_hash_max (struct net_bridge *br,unsigned long val);int br_multicast_set_igmp_version (struct net_bridge *br,unsigned long val);
net/bridge/br_sysfs_br.c +1 -7
@@ -409,17 +409,11 @@ static ssize_t multicast_snooping_show(struct device *d,return sprintf (buf,"%d\n" ,br_opt_get (br,BROPT_MULTICAST_ENABLED )); } -static int toggle_multicast (struct net_bridge *br,unsigned long val, -struct netlink_ext_ack *extack) -{ -return br_multicast_toggle (br, val); -} -static ssize_t multicast_snooping_store (struct device *d,struct device_attribute *attr,const char *buf,size_t len) { -return store_bridge_parm (d, buf, len, toggle_multicast); +return store_bridge_parm (d, buf, len, br_multicast_toggle); }static DEVICE_ATTR_RW (multicast_snooping);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 82/363 Revert "iommu/amd: Fix performance counter initialization"
In reply to Greg Kroah-HartmanFrom: Paul Menzel <[email protected]>
[ Upstream commit 715601e4e36903a653cd4294dfd3ed0019101991 ]
This reverts commit 6778ff5b21bd8e78c8bd547fd66437cf2657fd9b.
The original commit tries to address an issue, where PMC power-gating causing the IOMMU PMC pre-init test to fail on certain desktop/mobile platforms where the power-gating is normally enabled.
There have been several reports that the workaround still does not guarantee to work, and can add up to 100 ms (on the worst case) to the boot process on certain platforms such as the MSI B350M MORTAR with AMD Ryzen 3 2200G.
Therefore, revert this commit as a prelude to removing the pre-init test.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201753
--- drivers/iommu/amd/init.c | 45 ++++++++++------------------------------ 1 file changed, 11 insertions(+), 34 deletions(-)
drivers/iommu/amd/init.c +11 -34
@@ -12,7 +12,6 @@#include <linux/acpi.h> #include <linux/list.h> #include <linux/bitmap.h> -#include <linux/delay.h> #include <linux/slab.h> #include <linux/syscore_ops.h> #include <linux/interrupt.h>
@@ -257,8 +256,6 @@ static enum iommu_init_state init_state = IOMMU_START_STATE;static int amd_iommu_enable_interrupts (void );static int __init iommu_go_to_state (enum iommu_init_state state);static void init_device_table_dma (void ); -static int iommu_pc_get_set_reg (struct amd_iommu *iommu,u8 bank,u8 cntr, -u8 fxn,u64 *value,bool is_write);static bool amd_iommu_pre_enabled = true;
@@ -1717,11 +1714,13 @@ static int __init init_iommu_all(struct acpi_table_header *table)return 0 ; } -static void __init init_iommu_perf_ctr (struct amd_iommu *iommu) +static int iommu_pc_get_set_reg (struct amd_iommu *iommu,u8 bank,u8 cntr, +u8 fxn,u64 *value,bool is_write); + +static void init_iommu_perf_ctr (struct amd_iommu *iommu) { -int retry;struct pci_dev *pdev = iommu->dev; -u64 val =0xabcd , val2 =0 , save_reg, save_src; +u64 val =0xabcd , val2 =0 , save_reg =0 ;if (!iommu_feature (iommu,FEATURE_PC ))return ;
@@ -1729,39 +1728,17 @@ static void __init init_iommu_perf_ctr(struct amd_iommu *iommu) amd_iommu_pc_present = true;/* save the value to restore, if writable */ -if (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &save_reg, false) || -iommu_pc_get_set_reg (iommu,0 ,0 ,8 , &save_src, false)) - goto pc_false; - -/* -* Disable power gating by programing the performance counter -* source to 20 (i.e. counts the reads and writes from/to IOMMU -* Reserved Register [MMIO Offset 1FF8h] that are ignored.), -* which never get incremented during this init phase. -* (Note: The event is also deprecated.) -*/ - val =20 ; -if (iommu_pc_get_set_reg (iommu,0 ,0 ,8 , &val, true)) +if (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &save_reg, false)) goto pc_false;/* Check if the performance counters can be written to */ - val =0xabcd ; -for (retry =5 ; retry; retry--) { -if (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &val, true) || -iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &val2, false) || - val2) -break ; - -/* Wait about 20 msec for power gating to disable and retry. */ -msleep (20 ); - } - -/* restore */ -if (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &save_reg, true) || -iommu_pc_get_set_reg (iommu,0 ,0 ,8 , &save_src, true)) +if ((iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &val, true)) || + (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &val2, false)) || + (val != val2)) goto pc_false; -if (val != val2) +/* restore */ +if (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &save_reg, true)) goto pc_false;pci_info (pdev,"IOMMU performance counters supported\n" );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/363 mt76: mt76x0: disable GTK offloading
In reply to Greg Kroah-HartmanFrom: David Bauer <[email protected]>
[ Upstream commit 4b36cc6b390f18dbc59a45fb4141f90d7dfe2b23 ]
When operating two VAP on a MT7610 with encryption (PSK2, SAE, OWE), only the first one to be created will transmit properly encrypteded frames.
All subsequently created VAPs will sent out frames with the payload left unencrypted, breaking multicast traffic (ICMP6 NDP) and potentially disclosing information to a third party.
Disable GTK offloading and encrypt these frames in software to circumvent this issue. THis only seems to be necessary on MT7610 chips, as MT7612 is not affected from our testing.
--- drivers/net/wireless/mediatek/mt76/mt76x02_util.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/mediatek/mt76/mt76x02_util.c +4 -0
@@ -447,6 +447,10 @@ int mt76x02_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))return -EOPNOTSUPP ; +/* MT76x0 GTK offloading does not work with more than one VIF */ +if (is_mt76x0 (dev) && !(key->flags &IEEE80211_KEY_FLAG_PAIRWISE )) +return -EOPNOTSUPP ; + msta = sta ? (struct mt76x02_sta *)sta->drv_priv :NULL ; wcid = msta ? &msta->wcid : &mvif->group_wcid;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 83/363 iommu/amd: Remove performance counter pre-initialization test
In reply to Greg Kroah-HartmanFrom: Suravee Suthikulpanit <[email protected]>
[ Upstream commit 994d6608efe4a4c8834bdc5014c86f4bc6aceea6 ]
In early AMD desktop/mobile platforms (during 2013), when the IOMMU Performance Counter (PMC) support was first introduced in commit 30861ddc9cca ("perf/x86/amd: Add IOMMU Performance Counter resource management"), there was a HW bug where the counters could not be accessed. The result was reading of the counter always return zero.
At the time, the suggested workaround was to add a test logic prior to initializing the PMC feature to check if the counters can be programmed and read back the same value. This has been working fine until the more recent desktop/mobile platforms start enabling power gating for the PMC, which prevents access to the counters. This results in the PMC support being disabled unnecesarily.
Unfortunatly, there is no documentation of since which generation of hardware the original PMC HW bug was fixed. Although, it was fixed soon after the first introduction of the PMC. Base on this, we assume that the buggy platforms are less likely to be in used, and it should be relatively safe to remove this legacy logic.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201753
--- drivers/iommu/amd/init.c | 24 +----------------------- 1 file changed, 1 insertion(+), 23 deletions(-)
drivers/iommu/amd/init.c +1 -23
@@ -1714,33 +1714,16 @@ static int __init init_iommu_all(struct acpi_table_header *table)return 0 ; } -static int iommu_pc_get_set_reg (struct amd_iommu *iommu,u8 bank,u8 cntr, -u8 fxn,u64 *value,bool is_write); -static void init_iommu_perf_ctr (struct amd_iommu *iommu) { +u64 val;struct pci_dev *pdev = iommu->dev; -u64 val =0xabcd , val2 =0 , save_reg =0 ;if (!iommu_feature (iommu,FEATURE_PC ))return ; amd_iommu_pc_present = true; -/* save the value to restore, if writable */ -if (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &save_reg, false)) - goto pc_false; - -/* Check if the performance counters can be written to */ -if ((iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &val, true)) || - (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &val2, false)) || - (val != val2)) - goto pc_false; - -/* restore */ -if (iommu_pc_get_set_reg (iommu,0 ,0 ,0 , &save_reg, true)) - goto pc_false; -pci_info (pdev,"IOMMU performance counters supported\n" ); val =readl (iommu->mmio_base +MMIO_CNTR_CONF_OFFSET );
@@ -1748,11 +1731,6 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu) iommu->max_counters = (u8) ((val >>7 ) &0xf );return ; - -pc_false: -pci_err (pdev,"Unable to read/write to IOMMU perf counter.\n" ); - amd_iommu_pc_present = false; -return ; } static ssize_t amd_iommu_show_cap(struct device *dev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 84/363 drm/amd/display: Force vsync flip when reconfiguring MPCC
In reply to Greg Kroah-HartmanFrom: Anthony Wang <[email protected]>
[ Upstream commit 56d63782af9bbd1271bff1422a6a013123eade4d ]
[Why]
Underflow observed when disabling PIP overlay in-game when vsync is disabled, due to OTC master lock not working with game pipe which is immediate flip.
[How]
When performing a full update, override flip_immediate value to false for all planes, so that flip occurs on vsync.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +4 -0
@@ -2546,6 +2546,10 @@ static void commit_planes_for_stream(struct dc *dc, plane_state->triplebuffer_flips = true; } } +if (update_type ==UPDATE_TYPE_FULL ) { +/* force vsync flip when reconfiguring pipes to prevent underflow */ + plane_state->flip_immediate = false; + } } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 85/363 selftests: Set CC to clang in lib.mk if LLVM is set
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit 26e6dd1072763cd5696b75994c03982dde952ad9 ]
selftests/bpf/Makefile includes lib.mk. With the following command
make -j60 LLVM=1 LLVM_IAS=1 <=== compile kernel
make -j60 -C tools/testing/selftests/bpf LLVM=1 LLVM_IAS=1 V=1
some files are still compiled with gcc. This patch fixed lib.mk issue which sets CC to gcc in all cases.
--- tools/testing/selftests/lib.mk | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/lib.mk +4 -0
@@ -1,6 +1,10 @@ # This mimics the top-level Makefile. We do it explicitly here so that this # Makefile can operate with or without the kbuild infrastructure. +ifneq ($(LLVM),) +CC := clang +else CC := $(CROSS_COMPILE)gcc +endif ifeq (0,$(MAKELEVEL)) ifeq ($(OUTPUT),)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 86/363 kconfig: nconf: stop endless search loops
In reply to Greg Kroah-HartmanFrom: Mihai Moldovan <[email protected]>
[ Upstream commit 8c94b430b9f6213dec84e309bb480a71778c4213 ]
If the user selects the very first entry in a page and performs a search-up operation, or selects the very last entry in a page and performs a search-down operation that will not succeed (e.g., via [/]asdfzzz[Up Arrow]), nconf will never terminate searching the page.
The reason is that in this case, the starting point will be set to -1 or n, which is then translated into (n - 1) (i.e., the last entry of the page) or 0 (i.e., the first entry of the page) and finally the search begins. This continues to work fine until the index reaches 0 or (n - 1), at which point it will be decremented to -1 or incremented to n, but not checked against the starting point right away. Instead, it's wrapped around to the bottom or top again, after which the starting point check occurs... and naturally fails.
My original implementation added another check for -1 before wrapping the running index variable around, but Masahiro Yamada pointed out that the actual issue is that the comparison point (starting point) exceeds bounds (i.e., the [0,n-1] interval) in the first place and that, instead, the starting point should be fixed.
This has the welcome side-effect of also fixing the case where the starting point was n while searching down, which also lead to an infinite loop.
OTOH, this code is now essentially all his work.
Amazingly, nobody seems to have been hit by this for 11 years - or at the very least nobody bothered to debug and fix this.
--- scripts/kconfig/nconf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/kconfig/nconf.c +1 -1
@@ -504,8 +504,8 @@ static int get_mext_match(const char *match_str, match_f flag)else if (flag ==FIND_NEXT_MATCH_UP ) --match_start; + match_start = (match_start + items_num) % items_num; index = match_start; - index = (index + items_num) % items_num;while (true) {char *str = k_menu_items[index].str;if (strcasestr (str, match_str) !=NULL )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 87/363 ALSA: hda/realtek: Add quirk for Lenovo Ideapad S740
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 26928ca1f06aab4361eb5adbe7ef3b5c82f13cf2 ]
Lenovo Ideapad S740 requires quite a few COEF setups to make its speakers working. The verb table was provided from Ryan Prescott as the result of investigation via qemu:
https://github.com/ryanprescott/realtek-verb-tools/wiki/How-to-sniff-verbs-from-a-Windows-sound-driver
--- sound/pci/hda/ideapad_s740_helper.c | 492 ++++++++++++++++++++++++++++ sound/pci/hda/patch_realtek.c | 11 + 2 files changed, 503 insertions(+) create mode 100644 sound/pci/hda/ideapad_s740_helper.c
sound/pci/hda/ideapad_s740_helper.c new file +492 -0
@@ -0,0 +1,492 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Fixes for Lenovo Ideapad S740, to be included from codec driver */ + +static const struct hda_verb alc285_ideapad_s740_coefs[] = { +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x10 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0320 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0041 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0041 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x007f }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x007f }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x003c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0011 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x003c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0011 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x000c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001a }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x000c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001a }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x000f }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0042 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x000f }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0042 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0010 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0040 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0010 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0040 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0003 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0009 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0003 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0009 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x004c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x004c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001d }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x004e }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001d }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x004e }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001b }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001b }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0019 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0025 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0019 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0025 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0018 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0037 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0018 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0037 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001a }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0040 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001a }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0040 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0016 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0076 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0016 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0076 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0017 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0010 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0017 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0010 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0015 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0015 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0015 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0015 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0007 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0086 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0007 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0086 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0002 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0002 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0002 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0002 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0042 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0042 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x007f }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x007f }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x003c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0011 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x003c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0011 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x000c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x002a }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x000c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x002a }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x000f }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0046 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x000f }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0046 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0010 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0044 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0010 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0044 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0003 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0009 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0003 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0009 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x004c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x004c }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001b }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001b }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0019 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0025 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0019 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0025 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0018 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0037 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0018 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0037 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001a }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0040 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x001a }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0040 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0016 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0076 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0016 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0076 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0017 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0010 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0017 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0010 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0015 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0015 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0015 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0015 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0007 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0086 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0007 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0086 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0002 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0002 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0001 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x29 }, +{0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0002 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0x0000 }, +{0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, +{} +}; + +static void alc285_fixup_ideapad_s740_coef (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +switch (action) { +case HDA_FIXUP_ACT_PRE_PROBE : +snd_hda_add_verbs (codec, alc285_ideapad_s740_coefs); +break ; + } +}
sound/pci/hda/patch_realtek.c +11 -0
@@ -6282,6 +6282,9 @@ static void alc_fixup_thinkpad_acpi(struct hda_codec *codec,/* for alc295_fixup_hp_top_speakers */ #include "hp_x360_helper.c" +/* for alc285_fixup_ideapad_s740_coef() */ +#include "ideapad_s740_helper.c" +enum {ALC269_FIXUP_GPIO2 ,ALC269_FIXUP_SONY_VAIO ,
@@ -6481,6 +6484,7 @@ enum {ALC282_FIXUP_ACER_DISABLE_LINEOUT ,ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST ,ALC256_FIXUP_ACER_HEADSET_MIC , + ALC285_FIXUP_IDEAPAD_S740_COEF, }; static const struct hda_fixup alc269_fixups[] = {
@@ -7973,6 +7977,12 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id =ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC }, + [ALC285_FIXUP_IDEAPAD_S740_COEF] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_ideapad_s740_coef, + .chained = true, + .chain_id = ALC269_FIXUP_THINKPAD_ACPI, + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8320,6 +8330,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3176 ,"ThinkCentre Station" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x17aa ,0x3178 ,"ThinkCentre Station" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x17aa ,0x3818 ,"Lenovo C940" ,ALC298_FIXUP_LENOVO_SPK_VOLUME ), +SND_PCI_QUIRK (0x17aa ,0x3827 ,"Ideapad S740" ,ALC285_FIXUP_IDEAPAD_S740_COEF ),SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ),SND_PCI_QUIRK (0x17aa ,0x3977 ,"IdeaPad S210" ,ALC283_FIXUP_INT_MIC ), SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 88/363 ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp
In reply to Greg Kroah-HartmanFrom: Vamshi Krishna Gopal <[email protected]>
[ Upstream commit d25bbe80485f8bcbbeb91a2a6cd8798c124b27b7 ]
Add quirks for jack detection, rt711 DAI and DMIC
--- sound/soc/intel/boards/sof_sdw.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
sound/soc/intel/boards/sof_sdw.c +11 -0
@@ -187,6 +187,17 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { SOF_RT715_DAI_ID_FIX | SOF_SDW_FOUR_SPK), }, +/* AlderLake devices */ + { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alder Lake Client Platform"), + }, + .driver_data = (void *)(SOF_RT711_JD_SRC_JD1 | + SOF_SDW_TGL_HDMI | + SOF_SDW_PCH_DMIC), + }, {} };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 89/363 ALSA: hda/hdmi: fix race in handling acomp ELD notification at resume
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit 0c37e2eb6b83e375e8a654d01598292d5591fc65 ]
When snd-hda-codec-hdmi is used with ASoC HDA controller like SOF (acomp used for ELD notifications), display connection change done during suspend, can be lost due to following sequence of events:
1. system in S3 suspend
2. DP/HDMI receiver connected
3. system resumed
4. HDA controller resumed, but card->deferred_resume_work not complete
5. acomp eld_notify callback
6. eld_notify ignored as power state is not CTL_POWER_D0
7. HDA resume deferred work completed, power state set to CTL_POWER_D0
This results in losing the notification, and the jack state reported to user-space is not correct.
The check on step 6 was added in commit 8ae743e82f0b ("ALSA: hda - Skip ELD notification during system suspend"). It would seem with the deferred resume logic in ASoC core, this check is not safe.
Fix the issue by modifying the check to use "dev.power.power_state.event" instead of ALSA specific card power state variable.
--- sound/pci/hda/patch_hdmi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_hdmi.c +2 -2
@@ -2654,7 +2654,7 @@ static void generic_acomp_pin_eld_notify(void *audio_ptr, int port, int dev_id)/* skip notification during system suspend (but not in runtime PM); * the state will be updated at resume */ -if (snd_power_get_state (codec->card) !=SNDRV_CTL_POWER_D0 ) +if (codec->core.dev.power.power_state.event ==PM_EVENT_SUSPEND )return ;/* ditto during suspend/resume process itself */ if (snd_hdac_is_in_pm (&codec->core))
@@ -2840,7 +2840,7 @@ static void intel_pin_eld_notify(void *audio_ptr, int port, int pipe)/* skip notification during system suspend (but not in runtime PM); * the state will be updated at resume */ -if (snd_power_get_state (codec->card) !=SNDRV_CTL_POWER_D0 ) +if (codec->core.dev.power.power_state.event ==PM_EVENT_SUSPEND )return ;/* ditto during suspend/resume process itself */ if (snd_hdac_is_in_pm (&codec->core))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 91/363 sctp: Fix out-of-bounds warning in sctp_process_asconf_param()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit e5272ad4aab347dde5610c0aedb786219e3ff793 ]
Fix the following out-of-bounds warning:
net/sctp/sm_make_chunk.c:3150:4: warning: 'memcpy' offset [17, 28] from the object at 'addr' is out of the bounds of referenced subobject 'v4' with type 'struct sockaddr_in' at offset 0 [-Warray-bounds]
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- net/sctp/sm_make_chunk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sm_make_chunk.c +1 -1
@@ -3147,7 +3147,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,* primary. */ if (af->is_any (&addr)) -memcpy (&addr.v4,sctp_source (asconf),sizeof (addr)); +memcpy (&addr,sctp_source (asconf),sizeof (addr)); if (security_sctp_bind_connect(asoc->ep->base.sk, SCTP_PARAM_SET_PRIMARY,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 90/363 i2c: i801: Add support for Intel Alder Lake PCH-M
In reply to Greg Kroah-HartmanFrom: Jarkko Nikula <[email protected]>
[ Upstream commit 8f51c1763ae98bb63fc04627ceae383aa0e8ff7b ]
Add PCI ID of SMBus controller on Intel Alder Lake PCH-M.
--- drivers/i2c/busses/i2c-i801.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i2c/busses/i2c-i801.c +4 -0
@@ -73,6 +73,7 @@* Comet Lake-V (PCH) 0xa3a3 32 hard yes yes yes * Alder Lake-S (PCH) 0x7aa3 32 hard yes yes yes * Alder Lake-P (PCH) 0x51a3 32 hard yes yes yes +* Alder Lake-M (PCH) 0x54a3 32 hard yes yes yes * * Features supported by this driver: * Software PEC no
@@ -230,6 +231,7 @@#define PCI_DEVICE_ID_INTEL_ELKHART_LAKE_SMBUS 0x4b23#define PCI_DEVICE_ID_INTEL_JASPER_LAKE_SMBUS 0x4da3#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_P_SMBUS 0x51a3 +#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_M_SMBUS 0x54a3#define PCI_DEVICE_ID_INTEL_BROXTON_SMBUS 0x5ad4#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_S_SMBUS 0x7aa3#define PCI_DEVICE_ID_INTEL_LYNXPOINT_SMBUS 0x8c22
@@ -1087,6 +1089,7 @@ static const struct pci_device_id i801_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_JASPER_LAKE_SMBUS) }, { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ALDER_LAKE_S_SMBUS) }, { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ALDER_LAKE_P_SMBUS) }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ALDER_LAKE_M_SMBUS) }, { 0, } };
@@ -1771,6 +1774,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)case PCI_DEVICE_ID_INTEL_EBG_SMBUS :case PCI_DEVICE_ID_INTEL_ALDER_LAKE_S_SMBUS :case PCI_DEVICE_ID_INTEL_ALDER_LAKE_P_SMBUS : +case PCI_DEVICE_ID_INTEL_ALDER_LAKE_M_SMBUS : priv->features |=FEATURE_BLOCK_PROC ; priv->features |=FEATURE_I2C_BLOCK_READ ; priv->features |=FEATURE_IRQ ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 92/363 flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 1e3d976dbb23b3fce544752b434bdc32ce64aabc ]
Fix the following out-of-bounds warning:
net/core/flow_dissector.c:835:3: warning: 'memcpy' offset [33, 48] from the object at 'flow_keys' is out of the bounds of referenced subobject 'ipv6_src' with type '__u32[4]' {aka 'unsigned int[4]'} at offset 16 [-Warray-bounds]
The problem is that the original code is trying to copy data into a couple of struct members adjacent to each other in a single call to memcpy(). So, the compiler legitimately complains about it. As these are just a couple of members, fix this by copying each one of them in separate calls to memcpy().
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- net/core/flow_dissector.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/core/flow_dissector.c +4 -2
@@ -828,8 +828,10 @@ static void __skb_flow_bpf_to_target(const struct bpf_flow_keys *flow_keys, key_addrs =skb_flow_dissector_target (flow_dissector,FLOW_DISSECTOR_KEY_IPV6_ADDRS , target_container); -memcpy (&key_addrs->v6addrs, &flow_keys->ipv6_src, -sizeof (key_addrs->v6addrs)); +memcpy (&key_addrs->v6addrs.src, &flow_keys->ipv6_src, +sizeof (key_addrs->v6addrs.src)); +memcpy (&key_addrs->v6addrs.dst, &flow_keys->ipv6_dst, +sizeof (key_addrs->v6addrs.dst)); key_control->addr_type =FLOW_DISSECTOR_KEY_IPV6_ADDRS ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 93/363 powerpc/xive: Use the "ibm, chip-id" property only under PowerNV
In reply to Greg Kroah-HartmanFrom: Cédric Le Goater <[email protected]>
[ Upstream commit e9e16917bc388846163b8566a298a291d71e44c9 ]
The 'chip_id' field of the XIVE CPU structure is used to choose a target for a source located on the same chip. For that, the XIVE driver queries the chip identifier from the "ibm,chip-id" property and compares it to a 'src_chip' field identifying the chip of a source. This information is only available on the PowerNV platform, 'src_chip' being assigned to XIVE_INVALID_CHIP_ID under pSeries.
The "ibm,chip-id" property is also not available on all platforms. It was first introduced on PowerNV and later, under QEMU for pSeries/KVM. However, the property is not part of PAPR and does not exist under pSeries/PowerVM.
Assign 'chip_id' to XIVE_INVALID_CHIP_ID by default and let the PowerNV platform override the value with the "ibm,chip-id" property.
--- arch/powerpc/sysdev/xive/common.c | 9 +++------ arch/powerpc/sysdev/xive/native.c | 6 ++++++ arch/powerpc/sysdev/xive/xive-internal.h | 1 + 3 files changed, 10 insertions(+), 6 deletions(-)
arch/powerpc/sysdev/xive/common.c +3 -6
@@ -1341,17 +1341,14 @@ static int xive_prepare_cpu(unsigned int cpu) xc =per_cpu (xive_cpu, cpu);if (!xc) { -struct device_node *np; - xc =kzalloc_node (sizeof (struct xive_cpu ),GFP_KERNEL ,cpu_to_node (cpu));if (!xc)return -ENOMEM ; - np =of_get_cpu_node (cpu,NULL ); -if (np) - xc->chip_id =of_get_ibm_chip_id (np); -of_node_put (np); xc->hw_ipi =XIVE_BAD_IRQ ; + xc->chip_id =XIVE_INVALID_CHIP_ID ; +if (xive_ops->prepare_cpu) + xive_ops->prepare_cpu (cpu, xc);per_cpu (xive_cpu, cpu) = xc; }
arch/powerpc/sysdev/xive/native.c +6 -0
@@ -380,6 +380,11 @@ static void xive_native_update_pending(struct xive_cpu *xc) } } +static void xive_native_prepare_cpu (unsigned int cpu,struct xive_cpu *xc) +{ + xc->chip_id =cpu_to_chip_id (cpu); +} +static void xive_native_setup_cpu (unsigned int cpu,struct xive_cpu *xc) {s64 rc;
@@ -462,6 +467,7 @@ static const struct xive_ops xive_native_ops = { .match = xive_native_match, .shutdown = xive_native_shutdown, .update_pending = xive_native_update_pending, + .prepare_cpu = xive_native_prepare_cpu, .setup_cpu = xive_native_setup_cpu, .teardown_cpu = xive_native_teardown_cpu, .sync_source = xive_native_sync_source,
arch/powerpc/sysdev/xive/xive-internal.h +1 -0
@@ -46,6 +46,7 @@ struct xive_ops { u32 *sw_irq);int (*setup_queue)(unsigned int cpu,struct xive_cpu *xc,u8 prio);void (*cleanup_queue)(unsigned int cpu,struct xive_cpu *xc,u8 prio); +void (*prepare_cpu)(unsigned int cpu,struct xive_cpu *xc);void (*setup_cpu)(unsigned int cpu,struct xive_cpu *xc);void (*teardown_cpu)(unsigned int cpu,struct xive_cpu *xc);bool (*match)(struct device_node *np);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 66/363 mt76: connac: always check return value from mt76_connac_mcu_alloc_wtbl_req
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit baa3afb39e94965f4ca5b5d3d274379504b8fa24 ]
Even if this is not a real bug since mt76_connac_mcu_alloc_wtbl_req routine can fails just if nskb is NULL , always check return value from mt76_connac_mcu_alloc_wtbl_req in order to avoid possible future mistake.
--- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 3 +++ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 3 +++ 2 files changed, 6 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +3 -0
@@ -1040,6 +1040,9 @@ mt7615_mcu_sta_ba(struct mt7615_dev *dev, wtbl_hdr =mt76_connac_mcu_alloc_wtbl_req (&dev->mt76, &msta->wcid,WTBL_SET , sta_wtbl, &skb); +if (IS_ERR (wtbl_hdr)) +return PTR_ERR (wtbl_hdr); +mt76_connac_mcu_wtbl_ba_tlv (&dev->mt76, skb, params, enable, tx, sta_wtbl, wtbl_hdr);
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +3 -0
@@ -833,6 +833,9 @@ int mt76_connac_mcu_add_sta_cmd(struct mt76_phy *phy, wtbl_hdr =mt76_connac_mcu_alloc_wtbl_req (dev, wcid,WTBL_RESET_AND_SET , sta_wtbl, &skb); +if (IS_ERR (wtbl_hdr)) +return PTR_ERR (wtbl_hdr); +if (enable) {mt76_connac_mcu_wtbl_generic_tlv (dev, skb, vif, sta, sta_wtbl, wtbl_hdr);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 94/363 powerpc/smp: Set numa node before updating mask
In reply to Greg Kroah-HartmanFrom: Srikar Dronamraju <[email protected]>
[ Upstream commit 6980d13f0dd189846887bbbfa43793d9a41768d3 ]
Geethika reported a trace when doing a dlpar CPU add.
------------[ cut here ]------------ WARNING: CPU: 152 PID: 1134 at kernel/sched/topology.c:2057 CPU: 152 PID: 1134 Comm: kworker/152:1 Not tainted 5.12.0-rc5-master #5 Workqueue: events cpuset_hotplug_workfn NIP: c0000000001cfc14 LR: c0000000001cfc10 CTR: c0000000007e3420 REGS: c0000034a08eb260 TRAP: 0700 Not tainted (5.12.0-rc5-master+) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28828422 XER: 00000020
CFAR: c0000000001fd888 IRQMASK: 0 #012GPR00: c0000000001cfc10 c0000034a08eb500 c000000001f35400 0000000000000027 #012GPR04:c0000035abaa8010 c0000035abb30a00 0000000000000027 c0000035abaa8018 #012GPR08: 0000000000000023 c0000035abaaef48 00000035aa540000 c0000035a49dffe8 #012GPR12: 0000000028828424 c0000035bf1a1c80 0000000000000497 0000000000000004 #012GPR16: c00000000347a258 0000000000000140 c00000000203d468 c000000001a1a490 #012GPR20:c000000001f9c160 c0000034adf70920 c0000034aec9fd20 0000000100087bd3 #012GPR24: 0000000100087bd3 c0000035b3de09f8 0000000000000030 c0000035b3de09f8 #012GPR28: 0000000000000028 c00000000347a280 c0000034aefe0b00 c0000000010a2a68
NIP [c0000000001cfc14] build_sched_domains+0x6a4/0x1500 LR [c0000000001cfc10] build_sched_domains+0x6a0/0x1500
Call Trace: [c0000034a08eb500] [c0000000001cfc10] build_sched_domains+0x6a0/0x1500 (unreliable) [c0000034a08eb640] [c0000000001d1e6c] partition_sched_domains_locked+0x3ec/0x530 [c0000034a08eb6e0] [c0000000002936d4] rebuild_sched_domains_locked+0x524/0xbf0 [c0000034a08eb7e0] [c000000000296bb0] rebuild_sched_domains+0x40/0x70 [c0000034a08eb810] [c000000000296e74] cpuset_hotplug_workfn+0x294/0xe20 [c0000034a08ebc30] [c000000000178dd0] process_one_work+0x300/0x670 [c0000034a08ebd10] [c0000000001791b8] worker_thread+0x78/0x520 [c0000034a08ebda0] [c000000000185090] kthread+0x1a0/0x1b0 [c0000034a08ebe10] [c00000000000ccec] ret_from_kernel_thread+0x5c/0x70 Instruction dump: 7d2903a6 4e800421 e8410018 7f67db78 7fe6fb78 7f45d378 7f84e378 7c681b78 3c62ff1a 3863c6f8 4802dc35 60000000 <0fe00000> 3920fff4 f9210070 e86100a0 ---[ end trace 532d9066d3d4d7ec ]---
Some of the per-CPU masks use cpu_cpu_mask as a filter to limit the search for related CPUs. On a dlpar add of a CPU, update cpu_cpu_mask before updating the per-CPU masks. This will ensure the cpu_cpu_mask is updated correctly before its used in setting the masks. Setting the numa_node will ensure that when cpu_cpu_mask() gets called, the correct node number is used. This code movement helped fix the above call trace.
--- arch/powerpc/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/kernel/smp.c +3 -3
@@ -1546,6 +1546,9 @@ void start_secondary(void *unused)vdso_getcpu_init ();#endif +set_numa_node (numa_cpu_lookup_table[cpu]); +set_numa_mem (local_memory_node (numa_cpu_lookup_table[cpu])); +/* Update topology CPU masks */ add_cpu_to_masks (cpu);
@@ -1564,9 +1567,6 @@ void start_secondary(void *unused) shared_caches = true; } -set_numa_node (numa_cpu_lookup_table[cpu]); -set_numa_mem (local_memory_node (numa_cpu_lookup_table[cpu])); -smp_wmb ();notify_cpu_starting (cpu);set_cpu_online (cpu, true);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 95/363 wilc1000: Bring MAC address setting in line with typical Linux behavior
In reply to Greg Kroah-HartmanFrom: David Mosberger-Tang <[email protected]>
[ Upstream commit a381b78a1598dde34a6e40dae2842024308a6ef2 ]
Linux network drivers normally disallow changing the MAC address when the interface is up. This driver has been different in that it allows to change the MAC address *only* when it's up. This patch brings wilc1000 behavior more in line with other network drivers. We could have replaced wilc_set_mac_addr() with eth_mac_addr() but that would break existing documentation on how to change the MAC address. Likewise, return -EADDRNOTAVAIL (not -EINVAL) when the specified MAC address is invalid or unavailable.
--- .../net/wireless/microchip/wilc1000/netdev.c | 25 ++++++++++++------- 1 file changed, 16 insertions(+), 9 deletions(-)
drivers/net/wireless/microchip/wilc1000/netdev.c +16 -9
@@ -575,7 +575,6 @@ static int wilc_mac_open(struct net_device *ndev) {struct wilc_vif *vif =netdev_priv (ndev);struct wilc *wl = vif->wilc; -unsigned char mac_add[ETH_ALEN ] = {0 };int ret =0 ;struct mgmt_frame_regs mgmt_regs = {};
@@ -598,9 +597,12 @@ static int wilc_mac_open(struct net_device *ndev)wilc_set_operation_mode (vif,wilc_get_vif_idx (vif), vif->iftype, vif->idx); -wilc_get_mac_address (vif, mac_add); -netdev_dbg (ndev,"Mac address: %pM\n" , mac_add); -ether_addr_copy (ndev->dev_addr, mac_add); + +if (is_valid_ether_addr (ndev->dev_addr)) +wilc_set_mac_address (vif, ndev->dev_addr); +else +wilc_get_mac_address (vif, ndev->dev_addr); +netdev_dbg (ndev,"Mac address: %pM\n" , ndev->dev_addr);if (!is_valid_ether_addr (ndev->dev_addr)) {netdev_err (ndev,"Wrong MAC address\n" );
@@ -639,7 +641,14 @@ static int wilc_set_mac_addr(struct net_device *dev, void *p)int srcu_idx;if (!is_valid_ether_addr (addr->sa_data)) -return -EINVAL ; +return -EADDRNOTAVAIL ; + +if (!vif->mac_opened) { +eth_commit_mac_addr_change (dev, p); +return 0 ; + } + +/* Verify MAC Address is not already in use: */ srcu_idx =srcu_read_lock (&wilc->srcu);list_for_each_entry_rcu (tmp_vif, &wilc->vif_list, list) {
@@ -647,7 +656,7 @@ static int wilc_set_mac_addr(struct net_device *dev, void *p)if (ether_addr_equal (addr->sa_data, mac_addr)) {if (vif != tmp_vif) {srcu_read_unlock (&wilc->srcu, srcu_idx); -return -EINVAL ; +return -EADDRNOTAVAIL ; }srcu_read_unlock (&wilc->srcu, srcu_idx);return 0 ;
@@ -659,9 +668,7 @@ static int wilc_set_mac_addr(struct net_device *dev, void *p)if (result)return result; -ether_addr_copy (vif->bssid, addr->sa_data); -ether_addr_copy (vif->ndev->dev_addr, addr->sa_data); - +eth_commit_mac_addr_change (dev, p);return result; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 96/363 mac80211: properly drop the connection in case of invalid CSA IE
In reply to Greg Kroah-HartmanFrom: Emmanuel Grumbach <[email protected]>
[ Upstream commit 253907ab8bc0818639af382f6398810fa1f022b3 ]
In case the frequency is invalid, ieee80211_parse_ch_switch_ie will fail and we may not even reach the check in ieee80211_sta_process_chanswitch. Drop the connection in case ieee80211_parse_ch_switch_ie failed, but still take into account the CSA mode to remember not to send a deauth frame in case if it is forbidden to.
--- net/mac80211/mlme.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
net/mac80211/mlme.c +2 -5
@@ -1405,11 +1405,8 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata, ch_switch.delay = csa_ie.max_switch_time; } -if (res <0 ) { -ieee80211_queue_work (&local->hw, - &ifmgd->csa_connection_drop_work); -return ; - } +if (res <0 ) + goto lock_and_drop_connection;if (beacon && sdata->vif.csa_active && !ifmgd->csa_waiting_bcn) {if (res)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 97/363 ASoC: rt286: Generalize support for ALC3263 codec
In reply to Greg Kroah-HartmanFrom: David Ward <[email protected]>
[ Upstream commit aa2f9c12821e6a4ba1df4fb34a3dbc6a2a1ee7fe ]
The ALC3263 codec on the XPS 13 9343 is also found on the Latitude 13 7350 and Venue 11 Pro 7140. They require the same handling for the combo jack to work with a headset: GPIO pin 6 must be set.
The HDA driver always sets this pin on the ALC3263, which it distinguishes by the codec vendor/device ID 0x10ec0288 and PCI subsystem vendor ID 0x1028 (Dell). The ASoC driver does not use PCI, so adapt this check to use DMI to determine if Dell is the system vendor.
--- sound/soc/codecs/rt286.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
sound/soc/codecs/rt286.c +10 -10
@@ -1117,12 +1117,11 @@ static const struct dmi_system_id force_combo_jack_table[] = { { } }; -static const struct dmi_system_id dmi_dell_dino[] = { +static const struct dmi_system_id dmi_dell[] = { { - .ident ="Dell Dino" , + .ident ="Dell" , .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"XPS 13 9343" ) } }, { }
@@ -1133,7 +1132,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c, {struct rt286_platform_data *pdata =dev_get_platdata (&i2c->dev);struct rt286_priv *rt286; -int i, ret, val; +int i, ret, vendor_id; rt286 =devm_kzalloc (&i2c->dev,sizeof (*rt286),GFP_KERNEL );
@@ -1149,14 +1148,15 @@ static int rt286_i2c_probe(struct i2c_client *i2c, } ret =regmap_read (rt286->regmap, -RT286_GET_PARAM (AC_NODE_ROOT ,AC_PAR_VENDOR_ID ), &val); +RT286_GET_PARAM (AC_NODE_ROOT ,AC_PAR_VENDOR_ID ), &vendor_id);if (ret !=0 ) {dev_err (&i2c->dev,"I2C error %d\n" , ret);return ret; } -if (val !=RT286_VENDOR_ID && val !=RT288_VENDOR_ID ) { +if (vendor_id !=RT286_VENDOR_ID && vendor_id !=RT288_VENDOR_ID ) {dev_err (&i2c->dev, -"Device with ID register %#x is not rt286\n" , val); +"Device with ID register %#x is not rt286\n" , + vendor_id);return -ENODEV ; }
@@ -1180,8 +1180,8 @@ static int rt286_i2c_probe(struct i2c_client *i2c,if (pdata) rt286->pdata = *pdata; -if (dmi_check_system (force_combo_jack_table) || -dmi_check_system (dmi_dell_dino)) +if ((vendor_id ==RT288_VENDOR_ID &&dmi_check_system (dmi_dell)) || +dmi_check_system (force_combo_jack_table)) rt286->pdata.cbj_en = true;regmap_write (rt286->regmap,RT286_SET_AUDIO_POWER ,AC_PWRST_D3 );
@@ -1220,7 +1220,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c,regmap_update_bits (rt286->regmap,RT286_DEPOP_CTRL3 ,0xf777 ,0x4737 );regmap_update_bits (rt286->regmap,RT286_DEPOP_CTRL4 ,0x00ff ,0x003f ); -if (dmi_check_system (dmi_dell_dino)) { +if (vendor_id ==RT288_VENDOR_ID &&dmi_check_system (dmi_dell)) {regmap_update_bits (rt286->regmap,RT286_SET_GPIO_MASK ,0x40 ,0x40 ); regmap_update_bits(rt286->regmap,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 98/363 ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit c1d9e34e11281a8ba1a1c54e4db554232a461488 ]
Fix the following out-of-bounds warning:
net/ethtool/ioctl.c:492:2: warning: 'memcpy' offset [49, 84] from the object at 'link_usettings' is out of the bounds of referenced subobject 'base' with type 'struct ethtool_link_settings' at offset 0 [-Warray-bounds]
The problem is that the original code is trying to copy data into a some struct members adjacent to each other in a single call to memcpy(). This causes a legitimate compiler warning because memcpy() overruns the length of &link_usettings.base. Fix this by directly using &link_usettings and _from_ as destination and source addresses, instead.
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- net/ethtool/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ethtool/ioctl.c +1 -1
@@ -489,7 +489,7 @@ store_link_ksettings_for_user(void __user *to, {struct ethtool_link_usettings link_usettings; -memcpy (&link_usettings.base, &from->base,sizeof (link_usettings)); +memcpy (&link_usettings, from,sizeof (link_usettings));bitmap_to_arr32 (link_usettings.link_modes.supported, from->link_modes.supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 99/363 net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule
In reply to Greg Kroah-HartmanFrom: Du Cheng <[email protected]>
[ Upstream commit ed8157f1ebf1ae81a8fa2653e3f20d2076fad1c9 ]
There is a reproducible sequence from the userland that will trigger a WARN_ON() condition in taprio_get_start_time, which causes kernel to panic if configured as "panic_on_warn". Catch this condition in parse_taprio_schedule to prevent this condition.
Reported as bug on syzkaller:
https://syzkaller.appspot.com/bug?extid=d50710fd0873a9c6b40c
--- net/sched/sch_taprio.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/sched/sch_taprio.c +6 -0
@@ -901,6 +901,12 @@ static int parse_taprio_schedule(struct taprio_sched *q, struct nlattr **tb,list_for_each_entry (entry, &new->entries, list) cycle =ktime_add_ns (cycle, entry->interval); + +if (!cycle) { +NL_SET_ERR_MSG (extack,"'cycle_time' can never be 0" ); +return -EINVAL ; + } + new->cycle_time = cycle; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 100/363 samples/bpf: Fix broken tracex1 due to kprobe argument change
In reply to Greg Kroah-HartmanFrom: Yaqi Chen <[email protected]>
[ Upstream commit 137733d08f4ab14a354dacaa9a8fc35217747605 ]
Quoted 1 line
From commit
c0bbbdc32feb("__netif_receive_skb_core: pass skb by
reference"), the first argument passed into __netif_receive_skb_core has changed to reference of a skb pointer.
This commit fixes by using bpf_probe_read_kernel.
--- samples/bpf/tracex1_kern.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
samples/bpf/tracex1_kern.c +2 -2
@@ -26,7 +26,7 @@ SEC("kprobe/__netif_receive_skb_core")int bpf_prog1 (struct pt_regs *ctx) { -/* attaches to kprobe netif_receive_skb, +/* attaches to kprobe __netif_receive_skb_core, * looks for packets on loobpack device and prints them */ char devname[IFNAMSIZ ];
@@ -35,7 +35,7 @@ int bpf_prog1(struct pt_regs *ctx)int len;/* non-portable! works for the given kernel only */ - skb = (struct sk_buff *)PT_REGS_PARM1 (ctx); +bpf_probe_read_kernel (&skb,sizeof (skb), (void *)PT_REGS_PARM1 (ctx)); dev =_ (skb->dev); len =_ (skb->len);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/363 mt76: mt7915: always check return value from mt7915_mcu_alloc_wtbl_req
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 45f93e368211fbbd247e1ece254ffb121e20fa10 ]
As done for mt76_connac_mcu_alloc_wtbl_req, even if this is not a real bug since mt7915_mcu_alloc_wtbl_req routine can fails just if nskb is NULL, always check return value from mt7915_mcu_alloc_wtbl_req in order to avoid possible future mistake.
--- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +12 -0
@@ -1198,6 +1198,9 @@ mt7915_mcu_sta_ba(struct mt7915_dev *dev, wtbl_hdr =mt7915_mcu_alloc_wtbl_req (dev, msta,WTBL_SET , sta_wtbl, &skb); +if (IS_ERR (wtbl_hdr)) +return PTR_ERR (wtbl_hdr); +mt7915_mcu_wtbl_ba_tlv (skb, params, enable, tx, sta_wtbl, wtbl_hdr); ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
@@ -1714,6 +1717,9 @@ int mt7915_mcu_sta_update_hdr_trans(struct mt7915_dev *dev,return -ENOMEM ; wtbl_hdr =mt7915_mcu_alloc_wtbl_req (dev, msta,WTBL_SET ,NULL , &skb); +if (IS_ERR (wtbl_hdr)) +return PTR_ERR (wtbl_hdr); +mt7915_mcu_wtbl_hdr_trans_tlv (skb, vif, sta,NULL , wtbl_hdr); return mt76_mcu_skb_send_msg(&dev->mt76, skb, MCU_EXT_CMD(WTBL_UPDATE),
@@ -1738,6 +1744,9 @@ int mt7915_mcu_add_smps(struct mt7915_dev *dev, struct ieee80211_vif *vif, wtbl_hdr =mt7915_mcu_alloc_wtbl_req (dev, msta,WTBL_SET , sta_wtbl, &skb); +if (IS_ERR (wtbl_hdr)) +return PTR_ERR (wtbl_hdr); +mt7915_mcu_wtbl_smps_tlv (skb, sta, sta_wtbl, wtbl_hdr); return mt76_mcu_skb_send_msg(&dev->mt76, skb,
@@ -2263,6 +2272,9 @@ int mt7915_mcu_add_sta(struct mt7915_dev *dev, struct ieee80211_vif *vif, wtbl_hdr =mt7915_mcu_alloc_wtbl_req (dev, msta,WTBL_RESET_AND_SET , sta_wtbl, &skb); +if (IS_ERR (wtbl_hdr)) +return PTR_ERR (wtbl_hdr); +if (enable) {mt7915_mcu_wtbl_generic_tlv (skb, vif, sta, sta_wtbl, wtbl_hdr);mt7915_mcu_wtbl_hdr_trans_tlv (skb, vif, sta, sta_wtbl, wtbl_hdr);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/363 mt76: mt7915: fix key set/delete issue
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 1da4fd48d28436f8b690cdc2879603dede6d8355 ]
Deleting a key with the previous key index deletes the current key Rework the code to better keep track of multiple keys and check for the key index before deleting the current key
--- .../net/wireless/mediatek/mt76/mt7915/main.c | 25 +++++++++++++------ 1 file changed, 18 insertions(+), 7 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/main.c +18 -7
@@ -317,7 +317,9 @@ static int mt7915_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,struct mt7915_sta *msta = sta ? (struct mt7915_sta *)sta->drv_priv : &mvif->sta;struct mt76_wcid *wcid = &msta->wcid; +u8 *wcid_keyidx = &wcid->hw_key_idx;int idx = key->keyidx; +int err =0 ;/* The hardware does not support per-STA RX GTK, fallback * to software mode for these.
@@ -332,6 +334,7 @@ static int mt7915_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,/* fall back to sw encryption for unsupported ciphers */ switch (key->cipher) {case WLAN_CIPHER_SUITE_AES_CMAC : + wcid_keyidx = &wcid->hw_key_idx2; key->flags |=IEEE80211_KEY_FLAG_GENERATE_MMIE ;break ;case WLAN_CIPHER_SUITE_TKIP :
@@ -347,16 +350,24 @@ static int mt7915_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,return -EOPNOTSUPP ; } -if (cmd ==SET_KEY ) { - key->hw_key_idx = wcid->idx; - wcid->hw_key_idx = idx; - }else if (idx == wcid->hw_key_idx) { - wcid->hw_key_idx =-1 ; - } +mutex_lock (&dev->mt76.mutex); + +if (cmd ==SET_KEY ) + *wcid_keyidx = idx; +else if (idx == *wcid_keyidx) + *wcid_keyidx =-1 ; +else + goto out; +mt76_wcid_key_setup (&dev->mt76, wcid, cmd ==SET_KEY ? key :NULL ); -return mt7915_mcu_add_key (dev, vif, msta, key, cmd); + err =mt7915_mcu_add_key (dev, vif, msta, key, cmd); + +out: +mutex_unlock (&dev->mt76.mutex); + +return err; }static int mt7915_config (struct ieee80211_hw *hw,u32 changed)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/363 mt76: mt7915: add wifi subsystem reset
In reply to Greg Kroah-HartmanFrom: Ryder Lee <[email protected]>
[ Upstream commit e07419a7dca97dd9bddfe5d099380857c19535f3 ]
Reset wifi subsystem when MCU is already running.
Fixes firmware download failure after soft reboot on systems where the PCIe reset could not be performed properly.
--- .../net/wireless/mediatek/mt76/mt7915/init.c | 58 ++++++++++++++++++- .../net/wireless/mediatek/mt76/mt7915/mcu.c | 15 +---- .../net/wireless/mediatek/mt76/mt7915/regs.h | 13 +++++ 3 files changed, 70 insertions(+), 16 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/init.c +56 -2
@@ -4,6 +4,7 @@#include <linux/etherdevice.h> #include "mt7915.h" #include "mac.h" +#include "mcu.h" #include "eeprom.h" #define CCK_RATE (_idx, _rate) { \
@@ -283,9 +284,50 @@ static void mt7915_init_work(struct work_struct *work)mt7915_register_ext_phy (dev); } +static void mt7915_wfsys_reset (struct mt7915_dev *dev) +{ +u32 val =MT_TOP_PWR_KEY |MT_TOP_PWR_SW_PWR_ON |MT_TOP_PWR_PWR_ON ; +u32 reg =mt7915_reg_map_l1 (dev,MT_TOP_MISC ); + +#define MT_MCU_DUMMY_RANDOM GENMASK(15, 0) +#define MT_MCU_DUMMY_DEFAULT GENMASK(31, 16) + +mt76_wr (dev,MT_MCU_WFDMA0_DUMMY_CR ,MT_MCU_DUMMY_RANDOM ); + +/* change to software control */ + val |=MT_TOP_PWR_SW_RST ; +mt76_wr (dev,MT_TOP_PWR_CTRL , val); + +/* reset wfsys */ + val &= ~MT_TOP_PWR_SW_RST ; +mt76_wr (dev,MT_TOP_PWR_CTRL , val); + +/* release wfsys then mcu re-excutes romcode */ + val |=MT_TOP_PWR_SW_RST ; +mt76_wr (dev,MT_TOP_PWR_CTRL , val); + +/* switch to hw control */ + val &= ~MT_TOP_PWR_SW_RST ; + val |=MT_TOP_PWR_HW_CTRL ; +mt76_wr (dev,MT_TOP_PWR_CTRL , val); + +/* check whether mcu resets to default */ +if (!mt76_poll_msec (dev,MT_MCU_WFDMA0_DUMMY_CR ,MT_MCU_DUMMY_DEFAULT , +MT_MCU_DUMMY_DEFAULT ,1000 )) { +dev_err (dev->mt76.dev,"wifi subsystem reset failure\n" ); +return ; + } + +/* wfsys reset won't clear host registers */ +mt76_clear (dev, reg,MT_TOP_MISC_FW_STATE ); + +msleep (100 ); +} +static int mt7915_init_hardware (struct mt7915_dev *dev) {int ret, idx; +u32 val;mt76_wr (dev,MT_INT_SOURCE_CSR , ~0 );
@@ -295,6 +337,12 @@ static int mt7915_init_hardware(struct mt7915_dev *dev) dev->dbdc_support = !!(mt7915_l1_rr (dev,MT_HW_BOUND ) &BIT (5 )); + val =mt76_rr (dev,mt7915_reg_map_l1 (dev,MT_TOP_MISC )); + +/* If MCU was already running, it is likely in a bad state */ +if (FIELD_GET (MT_TOP_MISC_FW_STATE , val) >FW_STATE_FW_DOWNLOAD ) +mt7915_wfsys_reset (dev); + ret =mt7915_dma_init (dev);if (ret)return ret;
@@ -308,8 +356,14 @@ static int mt7915_init_hardware(struct mt7915_dev *dev)mt76_wr (dev,MT_SWDEF_MODE ,MT_SWDEF_NORMAL_MODE ); ret =mt7915_mcu_init (dev); -if (ret) -return ret; +if (ret) { +/* Reset and try again */ +mt7915_wfsys_reset (dev); + + ret =mt7915_mcu_init (dev); +if (ret) +return ret; + } ret =mt7915_eeprom_init (dev);if (ret <0 )
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +1 -14
@@ -2764,21 +2764,8 @@ out:static int mt7915_load_firmware (struct mt7915_dev *dev) { +u32 reg =mt7915_reg_map_l1 (dev,MT_TOP_MISC );int ret; -u32 val, reg =mt7915_reg_map_l1 (dev,MT_TOP_MISC ); - - val =FIELD_PREP (MT_TOP_MISC_FW_STATE ,FW_STATE_FW_DOWNLOAD ); - -if (!mt76_poll_msec (dev, reg,MT_TOP_MISC_FW_STATE , val,1000 )) { -/* restart firmware once */ -__mt76_mcu_restart (&dev->mt76); -if (!mt76_poll_msec (dev, reg,MT_TOP_MISC_FW_STATE , - val,1000 )) { -dev_err (dev->mt76.dev, -"Firmware is not ready for download\n" ); -return -EIO ; - } - } ret =mt7915_load_patch (dev);if (ret)
drivers/net/wireless/mediatek/mt76/mt7915/regs.h +13 -0
@@ -4,6 +4,11 @@#ifndef __MT7915_REGS_H#define __MT7915_REGS_H +/* MCU WFDMA0 */ +#define MT_MCU_WFDMA0_BASE 0x2000 +#define MT_MCU_WFDMA0 (ofs) (MT_MCU_WFDMA0_BASE + (ofs)) +#define MT_MCU_WFDMA0_DUMMY_CR MT_MCU_WFDMA0(0x120) +/* MCU WFDMA1 */ #define MT_MCU_WFDMA1_BASE 0x3000#define MT_MCU_WFDMA1 (ofs) (MT_MCU_WFDMA1_BASE + (ofs))
@@ -396,6 +401,14 @@#define MT_WFDMA1_PCIE1_BUSY_ENA_TX_FIFO1 BIT(1)#define MT_WFDMA1_PCIE1_BUSY_ENA_RX_FIFO BIT(2) +#define MT_TOP_RGU_BASE 0xf0000 +#define MT_TOP_PWR_CTRL (MT_TOP_RGU_BASE + (0x0)) +#define MT_TOP_PWR_KEY (0x5746 << 16) +#define MT_TOP_PWR_SW_RST BIT(0) +#define MT_TOP_PWR_SW_PWR_ON GENMASK(3, 2) +#define MT_TOP_PWR_HW_CTRL BIT(4) +#define MT_TOP_PWR_PWR_ON BIT(7) +#define MT_INFRA_CFG_BASE 0xf1000#define MT_INFRA (ofs) (MT_INFRA_CFG_BASE + (ofs))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/363 mt76: mt7915: fix txpower init for TSSI off chips
In reply to Greg Kroah-HartmanFrom: Shayne Chen <[email protected]>
[ Upstream commit a226ccd04c479ccd23d6927c64bad1b441707f70 ]
Fix incorrect txpower init value for TSSI off chips which causes too small txpower.
--- .../wireless/mediatek/mt76/mt7915/eeprom.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c +13 -6
@@ -124,7 +124,7 @@ int mt7915_eeprom_get_target_power(struct mt7915_dev *dev,struct ieee80211_channel *chan, u8 chain_idx) { - int index; + int index, target_power;bool tssi_on;if (chain_idx >3 )
@@ -133,15 +133,22 @@ int mt7915_eeprom_get_target_power(struct mt7915_dev *dev, tssi_on =mt7915_tssi_enabled (dev, chan->band);if (chan->band ==NL80211_BAND_2GHZ ) { - index =MT_EE_TX0_POWER_2G + chain_idx *3 + !tssi_on; + index =MT_EE_TX0_POWER_2G + chain_idx *3 ; + target_power =mt7915_eeprom_read (dev, index); + +if (!tssi_on) + target_power +=mt7915_eeprom_read (dev, index +1 ); }else { -int group = tssi_on ? -mt7915_get_channel_group (chan->hw_value) :8 ; +int group =mt7915_get_channel_group (chan->hw_value); + + index =MT_EE_TX0_POWER_5G + chain_idx *12 ; + target_power =mt7915_eeprom_read (dev, index + group); - index =MT_EE_TX0_POWER_5G + chain_idx *12 + group; +if (!tssi_on) + target_power +=mt7915_eeprom_read (dev, index +8 ); } -return mt7915_eeprom_read (dev, index); +return target_power; }static const u8 sku_cck_delta_map[] = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 111/363 iavf: remove duplicate free resources calls
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit 1a0e880b028f97478dc689e2900b312741d0d772 ]
Both iavf_free_all_tx_resources() and iavf_free_all_rx_resources() have already been called in the very same function.
Remove the duplicate calls.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +0 -2
@@ -3899,8 +3899,6 @@ static void iavf_remove(struct pci_dev *pdev)iounmap (hw->hw_addr);pci_release_regions (pdev); -iavf_free_all_tx_resources (adapter); -iavf_free_all_rx_resources (adapter);iavf_free_queues (adapter);kfree (adapter->vf_res);spin_lock_bh (&adapter->mac_vlan_list_lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 102/363 drm/amd/display: fixed divide by zero kernel crash during dsc enablement
In reply to Greg Kroah-HartmanFrom: Robin Singh <[email protected]>
[ Upstream commit 19cc1f3829567e7dca21c1389ea6407b8f5efab4 ]
[why]
During dsc enable, a divide by zero condition triggered the kernel crash.
[how]
An IGT test, which enable the DSC, was crashing at the time of restore the default dsc status, becaue of h_totals value becoming 0. So add a check before divide condition. If h_total is zero, gracefully ignore and set the default value.
kernel panic log:
[ 128.758827] divide error: 0000 [#1] PREEMPT SMP NOPTI [ 128.762714] CPU: 5 PID: 4562 Comm: amd_dp_dsc Tainted: G W 5.4.19-android-x86_64 #1 [ 128.769728] Hardware name: ADVANCED MICRO DEVICES, INC. Mauna/Mauna, BIOS WMN0B13N Nov 11 2020 [ 128.777695] RIP: 0010:hubp2_vready_at_or_After_vsync+0x37/0x7a [amdgpu] [ 128.785707] Code: 80 02 00 00 48 89 f3 48 8b 7f 08 b ...... [ 128.805696] RSP: 0018:ffffad8f82d43628 EFLAGS: 00010246 ...... [ 128.857707] CR2: 00007106d8465000 CR3: 0000000426530000 CR4: 0000000000140ee0 [ 128.865695] Call Trace: [ 128.869712] hubp3_setup+0x1f/0x7f [amdgpu] [ 128.873705] dcn20_update_dchubp_dpp+0xc8/0x54a [amdgpu] [ 128.877706] dcn20_program_front_end_for_ctx+0x31d/0x463 [amdgpu] [ 128.885706] dc_commit_state+0x3d2/0x658 [amdgpu] [ 128.889707] amdgpu_dm_atomic_commit_tail+0x4b3/0x1e7c [amdgpu] [ 128.897699] ? dm_read_reg_func+0x41/0xb5 [amdgpu] [ 128.901707] ? dm_read_reg_func+0x41/0xb5 [amdgpu] [ 128.905706] ? __is_insn_slot_addr+0x43/0x48 [ 128.909706] ? fill_plane_buffer_attributes+0x29e/0x3dc [amdgpu] [ 128.917705] ? dm_plane_helper_prepare_fb+0x255/0x284 [amdgpu] [ 128.921700] ? usleep_range+0x7c/0x7c [ 128.925705] ? preempt_count_sub+0xf/0x18 [ 128.929706] ? _raw_spin_unlock_irq+0x13/0x24 [ 128.933732] ? __wait_for_common+0x11e/0x18f [ 128.937705] ? _raw_spin_unlock_irq+0x13/0x24 [ 128.941706] ? __wait_for_common+0x11e/0x18f [ 128.945705] commit_tail+0x8b/0xd2 [drm_kms_helper] [ 128.949707] drm_atomic_helper_commit+0xd8/0xf5 [drm_kms_helper] [ 128.957706] amdgpu_dm_atomic_commit+0x337/0x360 [amdgpu] [ 128.961705] ? drm_atomic_check_only+0x543/0x68d [drm] [ 128.969705] ? drm_atomic_set_property+0x760/0x7af [drm] [ 128.973704] ? drm_mode_atomic_ioctl+0x6f3/0x85a [drm] [ 128.977705] drm_mode_atomic_ioctl+0x6f3/0x85a [drm] [ 128.985705] ? drm_atomic_set_property+0x7af/0x7af [drm] [ 128.989706] drm_ioctl_kernel+0x82/0xda [drm] [ 128.993706] drm_ioctl+0x225/0x319 [drm] [ 128.997707] ? drm_atomic_set_property+0x7af/0x7af [drm] [ 129.001706] ? preempt_count_sub+0xf/0x18 [ 129.005713] amdgpu_drm_ioctl+0x4b/0x76 [amdgpu] [ 129.009705] vfs_ioctl+0x1d/0x2a [ 129.013705] do_vfs_ioctl+0x419/0x43d [ 129.017707] ksys_ioctl+0x52/0x71 [ 129.021707] __x64_sys_ioctl+0x16/0x19 [ 129.025706] do_syscall_64+0x78/0x85 [ 129.029705] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c +9 -6
@@ -1,5 +1,5 @@/* -* Copyright 2012-17 Advanced Micro Devices, Inc. +* Copyright 2012-2021 Advanced Micro Devices, Inc. * * Permission is hereby granted, free of charge, to any person obtaining a * copy of this software and associated documentation files (the "Software"),
@@ -181,11 +181,14 @@ void hubp2_vready_at_or_After_vsync(struct hubp *hubp,else Set HUBP_VREADY_AT_OR_AFTER_VSYNC = 0 */ -if ((pipe_dest->vstartup_start - (pipe_dest->vready_offset+pipe_dest->vupdate_width - + pipe_dest->vupdate_offset) / pipe_dest->htotal) <= pipe_dest->vblank_end) { - value =1 ; - }else - value =0 ; +if (pipe_dest->htotal !=0 ) { +if ((pipe_dest->vstartup_start - (pipe_dest->vready_offset+pipe_dest->vupdate_width + + pipe_dest->vupdate_offset) / pipe_dest->htotal) <= pipe_dest->vblank_end) { + value =1 ; + }else + value =0 ; + } +REG_UPDATE (DCHUBP_CNTL ,HUBP_VREADY_AT_OR_AFTER_VSYNC , value); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 63/363 mt76: mt7615: fix key set/delete issues
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 730d6d0da8d8f5905faafe645a5b3c08ac3f5a8f ]
There were multiple issues in the current key set/remove code:
- deleting a key with the previous key index deletes the current key
- BIP key would only be uploaded correctly initially and corrupted on rekey
Rework the code to better keep track of multiple keys and check for the key index before deleting the current key
--- drivers/net/wireless/mediatek/mt76/mt76.h | 1 + .../net/wireless/mediatek/mt76/mt7615/mac.c | 97 ++++++++++--------- .../net/wireless/mediatek/mt76/mt7615/main.c | 18 ++-- 3 files changed, 65 insertions(+), 51 deletions(-)
drivers/net/wireless/mediatek/mt76/mt76.h +1 -0
@@ -222,6 +222,7 @@ struct mt76_wcid {u16 idx;u8 hw_key_idx; +u8 hw_key_idx2; u8 sta:1; u8 ext_phy:1;
drivers/net/wireless/mediatek/mt76/mt7615/mac.c +53 -44
158 lines not on this page · raw message
drivers/net/wireless/mediatek/mt76/mt7615/main.c +11 -7
@@ -334,7 +334,8 @@ static int mt7615_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,struct mt7615_sta *msta = sta ? (struct mt7615_sta *)sta->drv_priv : &mvif->sta;struct mt76_wcid *wcid = &msta->wcid; -int idx = key->keyidx, err; +int idx = key->keyidx, err =0 ; +u8 *wcid_keyidx = &wcid->hw_key_idx;/* The hardware does not support per-STA RX GTK, fallback * to software mode for these.
@@ -349,6 +350,7 @@ static int mt7615_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,/* fall back to sw encryption for unsupported ciphers */ switch (key->cipher) {case WLAN_CIPHER_SUITE_AES_CMAC : + wcid_keyidx = &wcid->hw_key_idx2; key->flags |=IEEE80211_KEY_FLAG_GENERATE_MMIE ;break ;case WLAN_CIPHER_SUITE_TKIP :
@@ -366,12 +368,13 @@ static int mt7615_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,mt7615_mutex_acquire (dev); -if (cmd ==SET_KEY ) { - key->hw_key_idx = wcid->idx; - wcid->hw_key_idx = idx; - }else if (idx == wcid->hw_key_idx) { - wcid->hw_key_idx =-1 ; - } +if (cmd ==SET_KEY ) + *wcid_keyidx = idx; +else if (idx == *wcid_keyidx) + *wcid_keyidx =-1 ; +else + goto out; +mt76_wcid_key_setup (&dev->mt76, wcid, cmd ==SET_KEY ? key :NULL );
@@ -380,6 +383,7 @@ static int mt7615_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,else err =__mt7615_mac_wtbl_set_key (dev, wcid, key, cmd); +out:mt7615_mutex_release (dev);return err;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 112/363 net: ethernet: mtk_eth_soc: fix RX VLAN offload
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 3f57d8c40fea9b20543cab4da12f4680d2ef182c ]
The VLAN ID in the rx descriptor is only valid if the RX_DMA_VTAG bit is set. Fixes frames wrongly marked with VLAN tags.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +1 -1
@@ -1319,7 +1319,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, skb->protocol =eth_type_trans (skb, netdev);if (netdev->features &NETIF_F_HW_VLAN_CTAG_RX && -RX_DMA_VID (trxd.rxd3)) + (trxd.rxd2 &RX_DMA_VTAG ))__vlan_hwaccel_put_tag (skb,htons (ETH_P_8021Q ),RX_DMA_VID (trxd.rxd3));skb_record_rx_queue (skb,0 );
drivers/net/ethernet/mediatek/mtk_eth_soc.h +1 -0
@@ -296,6 +296,7 @@#define RX_DMA_LSO BIT(30)#define RX_DMA_PLEN0 (_x) (((_x) & 0x3fff) << 16)#define RX_DMA_GET_PLEN0 (_x) (((_x) >> 16) & 0x3fff) +#define RX_DMA_VTAG BIT(15)/* QDMA descriptor rxd3 */ #define RX_DMA_VID (_x) ((_x) & 0xfff)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 114/363 selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit 1233898ab758cbcf5f6fea10b8dd16a0b2c24fab ]
The mirror_gre_scale test creates as many ERSPAN sessions as the underlying chip supports, and tests that they all work. In order to determine that it issues a stream of ICMP packets and checks if they are mirrored as expected.
However, the mausezahn invocation missed the -6 flag to identify the use of IPv6 protocol, and was sending ICMP messages over IPv6, as opposed to ICMP6. It also didn't pass an explicit source IP address, which apparently worked at some point in the past, but does not anymore.
To fix these issues, extend the function mirror_test() in mirror_lib by detecting the IPv6 protocol addresses, and using a different ICMP scheme. Fix __mirror_gre_test() in the selftest itself to pass a source IP address.
--- .../drivers/net/mlxsw/mirror_gre_scale.sh | 3 ++- .../selftests/net/forwarding/mirror_lib.sh | 19 +++++++++++++++++-- 2 files changed, 19 insertions(+), 3 deletions(-)
tools/testing/selftests/drivers/net/mlxsw/mirror_gre_scale.sh +2 -1
@@ -120,12 +120,13 @@ __mirror_gre_test() sleep 5 for ((i = 0; i < count; ++i)); do + local sip=$(mirror_gre_ipv6_addr 1 $i)::1 local dip=$(mirror_gre_ipv6_addr 1 $i)::2 local htun=h3-gt6-$i local message icmp6_capture_install $htun - mirror_test v$h1 "" $dip $htun 100 10 + mirror_test v$h1 $sip $dip $htun 100 10 icmp6_capture_uninstall $htun done }
tools/testing/selftests/net/forwarding/mirror_lib.sh +17 -2
@@ -20,6 +20,13 @@ mirror_uninstall() tc filter del dev $swp1 $direction pref 1000 } +is_ipv6() +{ + local addr=$1; shift + + [[ -z ${addr//[0-9a-fA-F:]/} ]] +} + mirror_test() { local vrf_name=$1; shift
@@ -29,9 +36,17 @@ mirror_test() local pref=$1; shift local expect=$1; shift + if is_ipv6 $dip; then + local proto=-6 + local type="icmp6 type=128" # Echo request. + else + local proto= + local type="icmp echoreq" + fi + local t0=$(tc_rule_stats_get $dev $pref) - $MZ $vrf_name ${sip:+-A $sip} -B $dip -a own -b bc -q \ - -c 10 -d 100msec -t icmp type=8 + $MZ $proto $vrf_name ${sip:+-A $sip} -B $dip -a own -b bc -q \ + -c 10 -d 100msec -t $type sleep 0.5 local t1=$(tc_rule_stats_get $dev $pref) local delta=$((t1 - t0))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 113/363 selftests: mlxsw: Increase the tolerance of backlog buildup
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit dda7f4fa55839baeb72ae040aeaf9ccf89d3e416 ]
The intention behind this test is to make sure that qdisc limit is correctly projected to the HW. However, first, due to rounding in the qdisc, and then in the driver, the number cannot actually be accurate. And second, the approach to testing this is to oversubscribe the port with traffic generated on the same switch. The actual backlog size therefore fluctuates.
In practice, this test proved to be noisier than the rest, and spuriously fails every now and then. Increase the tolerance to 10 % to avoid these issues.
--- tools/testing/selftests/drivers/net/mlxsw/sch_red_core.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/drivers/net/mlxsw/sch_red_core.sh +2 -2
@@ -507,8 +507,8 @@ do_red_test() check_err $? "backlog $backlog / $limit Got $pct% marked packets, expected == 0." local diff=$((limit - backlog)) pct=$((100 * diff / limit)) - ((0 <= pct && pct <= 5)) - check_err $? "backlog $backlog / $limit expected <= 5% distance" + ((0 <= pct && pct <= 10)) + check_err $? "backlog $backlog / $limit expected <= 10% distance" log_test "TC $((vlan - 10)): RED backlog > limit" stop_traffic
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 115/363 kbuild: generate Module.symvers only when vmlinux exists
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 69bc8d386aebbd91a6bb44b6d33f77c8dfa9ed8c ]
The external module build shows the following warning if Module.symvers is missing in the kernel tree.
WARNING: Symbol version dump "Module.symvers" is missing.
Modules may not have dependencies or modversions.
I think this is an important heads-up because the resulting modules may not work as expected. This happens when you did not build the entire kernel tree, for example, you might have prepared the minimal setups for external modules by 'make defconfig && make modules_preapre'.
A problem is that 'make modules' creates Module.symvers even without vmlinux. In this case, that warning is suppressed since Module.symvers already exists in spite of its incomplete content.
The incomplete (i.e. invalid) Module.symvers should not be created.
This commit changes the second pass of modpost to dump symbols into modules-only.symvers. The final Module.symvers is created by concatenating vmlinux.symvers and modules-only.symvers if both exist.
Module.symvers is supposed to collect symbols from both vmlinux and modules. It might be a bit confusing, and I am not quite sure if it is an official interface, but presumably it is difficult to rename it because some tools (e.g. kmod) parse it.
--- .gitignore | 1 + Documentation/dontdiff | 1 + Makefile | 2 +- scripts/Makefile.modpost | 15 ++++++++++++++- scripts/mod/modpost.c | 15 +-------------- 5 files changed, 18 insertions(+), 16 deletions(-)
.gitignore +1 -0
@@ -57,6 +57,7 @@ modules.order /tags /TAGS /linux +/modules-only.symvers /vmlinux /vmlinux.32 /vmlinux.symvers
Documentation/dontdiff +1 -0
@@ -178,6 +178,7 @@ mktables mktree mkutf8data modpost +modules-only.symvers modules.builtin modules.builtin.modinfo modules.nsdeps
Makefile +1 -1
@@ -1513,7 +1513,7 @@ endif # CONFIG_MODULES # make distclean Remove editor backup files, patch leftover files and the like # Directories & files removed with 'make clean' -CLEAN_FILES += include/ksym vmlinux.symvers \ +CLEAN_FILES += include/ksym vmlinux.symvers modules-only.symvers \ modules.builtin modules.builtin.modinfo modules.nsdeps \ compile_commands.json .thinlto-cache
scripts/Makefile.modpost +14 -1
@@ -68,7 +68,20 @@ else ifeq ($(KBUILD_EXTMOD),) input-symdump := vmlinux.symvers -output-symdump := Module.symvers +output-symdump := modules-only.symvers + +quiet_cmd_cat = GEN $@ + cmd_cat = cat $(real-prereqs) > $@ + +ifneq ($(wildcard vmlinux.symvers),) + +__modpost: Module.symvers +Module.symvers: vmlinux.symvers modules-only.symvers FORCE + $(call if_changed,cat) + +targets += Module.symvers + +endif else
scripts/mod/modpost.c +1 -14
@@ -2423,19 +2423,6 @@ fail:fatal ("parse error in symbol dump file\n" ); } -/* For normal builds always dump all symbols. -* For external modules only dump symbols -* that are not read from kernel Module.symvers. -**/ -static int dump_sym (struct symbol *sym) -{ -if (!external_module) -return 1 ; -if (sym->module->from_dump) -return 0 ; -return 1 ; -} -static void write_dump (const char *fname) {struct buffer buf = { };
@@ -2446,7 +2433,7 @@ static void write_dump(const char *fname)for (n =0 ; n <SYMBOL_HASH_SIZE ; n++) { symbol = symbolhash[n];while (symbol) { -if (dump_sym (symbol)) { +if (!symbol->module->from_dump) { namespace = symbol->namespace; buf_printf(&buf, "0x%08x\t%s\t%s\t%s\t%s\n", symbol->crc, symbol->name,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/363 mt76: mt7921: fix key set/delete issue
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 60468f7fd7072c804b2613f1cadabace8d77d311 ]
Similar to the mt7915 driver, deleting a key with the previous key index deletes the current key. Rework the code to better keep track of multiple keys and check for the key index before deleting the current key
--- .../net/wireless/mediatek/mt76/mt7921/main.c | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/main.c +17 -8
@@ -413,7 +413,8 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,struct mt7921_sta *msta = sta ? (struct mt7921_sta *)sta->drv_priv : &mvif->sta;struct mt76_wcid *wcid = &msta->wcid; -int idx = key->keyidx; +u8 *wcid_keyidx = &wcid->hw_key_idx; +int idx = key->keyidx, err =0 ;/* The hardware does not support per-STA RX GTK, fallback * to software mode for these.
@@ -429,6 +430,7 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,switch (key->cipher) {case WLAN_CIPHER_SUITE_AES_CMAC : key->flags |=IEEE80211_KEY_FLAG_GENERATE_MMIE ; + wcid_keyidx = &wcid->hw_key_idx2;break ;case WLAN_CIPHER_SUITE_TKIP :case WLAN_CIPHER_SUITE_CCMP :
@@ -443,16 +445,23 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,return -EOPNOTSUPP ; } -if (cmd ==SET_KEY ) { - key->hw_key_idx = wcid->idx; - wcid->hw_key_idx = idx; - }else if (idx == wcid->hw_key_idx) { - wcid->hw_key_idx =-1 ; - } +mt7921_mutex_acquire (dev); + +if (cmd ==SET_KEY ) + *wcid_keyidx = idx; +else if (idx == *wcid_keyidx) + *wcid_keyidx =-1 ; +else + goto out; +mt76_wcid_key_setup (&dev->mt76, wcid, cmd ==SET_KEY ? key :NULL ); -return mt7921_mcu_add_key (dev, vif, msta, key, cmd); + err =mt7921_mcu_add_key (dev, vif, msta, key, cmd); +out: +mt7921_mutex_release (dev); + +return err; }static int mt7921_config (struct ieee80211_hw *hw,u32 changed)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 116/363 bnxt_en: Add PCI IDs for Hyper-V VF devices.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit 7fbf359bb2c19c824cbb1954020680824f6ee5a5 ]
Support VF device IDs used by the Hyper-V hypervisor.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +18 -1
@@ -122,7 +122,10 @@ enum board_idx {NETXTREME_E_VF ,NETXTREME_C_VF ,NETXTREME_S_VF , +NETXTREME_C_VF_HV , +NETXTREME_E_VF_HV ,NETXTREME_E_P5_VF , + NETXTREME_E_P5_VF_HV, };/* indexed by enum above */
@@ -170,7 +173,10 @@ static const struct { [NETXTREME_E_VF] = { "Broadcom NetXtreme-E Ethernet Virtual Function" }, [NETXTREME_C_VF] = { "Broadcom NetXtreme-C Ethernet Virtual Function" }, [NETXTREME_S_VF] = { "Broadcom NetXtreme-S Ethernet Virtual Function" }, + [NETXTREME_C_VF_HV] = { "Broadcom NetXtreme-C Virtual Function for Hyper-V" }, + [NETXTREME_E_VF_HV] = { "Broadcom NetXtreme-E Virtual Function for Hyper-V" }, [NETXTREME_E_P5_VF] = { "Broadcom BCM5750X NetXtreme-E Ethernet Virtual Function" }, + [NETXTREME_E_P5_VF_HV] = { "Broadcom BCM5750X NetXtreme-E Virtual Function for Hyper-V" }, };static const struct pci_device_id bnxt_pci_tbl[] = {
@@ -222,15 +228,25 @@ static const struct pci_device_id bnxt_pci_tbl[] = { { PCI_VDEVICE(BROADCOM, 0xd804), .driver_data = BCM58804 }, #ifdef CONFIG_BNXT_SRIOV { PCI_VDEVICE(BROADCOM, 0x1606), .driver_data = NETXTREME_E_VF }, + { PCI_VDEVICE(BROADCOM, 0x1607), .driver_data = NETXTREME_E_VF_HV }, + { PCI_VDEVICE(BROADCOM, 0x1608), .driver_data = NETXTREME_E_VF_HV }, { PCI_VDEVICE(BROADCOM, 0x1609), .driver_data = NETXTREME_E_VF }, + { PCI_VDEVICE(BROADCOM, 0x16bd), .driver_data = NETXTREME_E_VF_HV }, { PCI_VDEVICE(BROADCOM, 0x16c1), .driver_data = NETXTREME_E_VF }, + { PCI_VDEVICE(BROADCOM, 0x16c2), .driver_data = NETXTREME_C_VF_HV }, + { PCI_VDEVICE(BROADCOM, 0x16c3), .driver_data = NETXTREME_C_VF_HV }, + { PCI_VDEVICE(BROADCOM, 0x16c4), .driver_data = NETXTREME_E_VF_HV }, + { PCI_VDEVICE(BROADCOM, 0x16c5), .driver_data = NETXTREME_E_VF_HV }, { PCI_VDEVICE(BROADCOM, 0x16cb), .driver_data = NETXTREME_C_VF }, { PCI_VDEVICE(BROADCOM, 0x16d3), .driver_data = NETXTREME_E_VF }, { PCI_VDEVICE(BROADCOM, 0x16dc), .driver_data = NETXTREME_E_VF }, { PCI_VDEVICE(BROADCOM, 0x16e1), .driver_data = NETXTREME_C_VF }, { PCI_VDEVICE(BROADCOM, 0x16e5), .driver_data = NETXTREME_C_VF }, + { PCI_VDEVICE(BROADCOM, 0x16e6), .driver_data = NETXTREME_C_VF_HV }, { PCI_VDEVICE(BROADCOM, 0x1806), .driver_data = NETXTREME_E_P5_VF }, { PCI_VDEVICE(BROADCOM, 0x1807), .driver_data = NETXTREME_E_P5_VF }, + { PCI_VDEVICE(BROADCOM, 0x1808), .driver_data = NETXTREME_E_P5_VF_HV }, + { PCI_VDEVICE(BROADCOM, 0x1809), .driver_data = NETXTREME_E_P5_VF_HV }, { PCI_VDEVICE(BROADCOM, 0xd800), .driver_data = NETXTREME_S_VF }, #endif { 0 }
@@ -265,7 +281,8 @@ static struct workqueue_struct *bnxt_pf_wq;static bool bnxt_vf_pciid (enum board_idx idx) {return (idx ==NETXTREME_C_VF || idx ==NETXTREME_E_VF || - idx ==NETXTREME_S_VF || idx ==NETXTREME_E_P5_VF ); + idx ==NETXTREME_S_VF || idx ==NETXTREME_C_VF_HV || + idx ==NETXTREME_E_VF_HV || idx ==NETXTREME_E_P5_VF ); }#define DB_CP_REARM_FLAGS (DB_KEY_CP | DB_IDX_VALID)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/363 i2c: imx: Fix PM reference leak in i2c_imx_reg_slave()
In reply to Greg Kroah-HartmanFrom: Ye Weihua <[email protected]>
[ Upstream commit c4b1fcc310e655fa8414696c38a84d36c00684c8 ]
pm_runtime_get_sync() will increment the PM reference count even on failure. Forgetting to put the reference again will result in a leak.
Replace it with pm_runtime_resume_and_get() to keep the usage counter balanced.
--- drivers/i2c/busses/i2c-imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-imx.c +1 -1
@@ -801,7 +801,7 @@ static int i2c_imx_reg_slave(struct i2c_client *client) i2c_imx->last_slave_event =I2C_SLAVE_STOP ;/* Resume */ - ret =pm_runtime_get_sync (i2c_imx->adapter.dev.parent); + ret =pm_runtime_resume_and_get (i2c_imx->adapter.dev.parent);if (ret <0 ) {dev_err (&i2c_imx->adapter.dev,"failed to resume i2c controller" );return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 117/363 ia64: module: fix symbolizer crash on fdescr
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit 99e729bd40fb3272fa4b0140839d5e957b58588a ]
Noticed failure as a crash on ia64 when tried to symbolize all backtraces collected by page_owner=on:
$ cat /sys/kernel/debug/page_owner
<oops> CPU: 1 PID: 2074 Comm: cat Not tainted 5.12.0-rc4 #226
Hardware name: hp server rx3600, BIOS 04.03 04/08/2008
ip is at dereference_module_function_descriptor+0x41/0x100Crash happens at dereference_module_function_descriptor() due to use-after-free when dereferencing ".opd" section header.
All section headers are already freed after module is laoded successfully.
To keep symbolizer working the change stores ".opd" address and size after module is relocated to a new place and before section headers are discarded.
To make similar errors less obscure module_finalize() now zeroes out all variables relevant to module loading only.
--- arch/ia64/include/asm/module.h | 6 +++++- arch/ia64/kernel/module.c | 29 +++++++++++++++++++++++++---- 2 files changed, 30 insertions(+), 5 deletions(-)
arch/ia64/include/asm/module.h +5 -1
@@ -14,16 +14,20 @@struct elf64_shdr ;/* forward declration */ struct mod_arch_specific { +/* Used only at module load time. */ struct elf64_shdr *core_plt;/* core PLT section */ struct elf64_shdr *init_plt;/* init PLT section */ struct elf64_shdr *got;/* global offset table */ struct elf64_shdr *opd;/* official procedure descriptors */ struct elf64_shdr *unwind;/* unwind-table section */ unsigned long gp;/* global-pointer for module */ +unsigned int next_got_entry;/* index of next available got entry */ +/* Used at module run and cleanup time. */ void *core_unw_table;/* core unwind-table cookie returned by unwinder */ void *init_unw_table;/* init unwind-table cookie returned by unwinder */ -unsigned int next_got_entry;/* index of next available got entry */ +void *opd_addr;/* symbolize uses .opd to get to actual function */ +unsigned long opd_size; };#define ARCH_SHF_SMALL SHF_IA_64_SHORT
arch/ia64/kernel/module.c +25 -4
@@ -905,9 +905,31 @@ register_unwind_table (struct module *mod)int module_finalize (const Elf_Ehdr *hdr,const Elf_Shdr *sechdrs,struct module *mod) { +struct mod_arch_specific *mas = &mod->arch; +DEBUGP ("%s: init: entry=%p\n" , __func__, mod->init); -if (mod->arch.unwind) +if (mas->unwind)register_unwind_table (mod); + +/* +* ".opd" was already relocated to the final destination. Store +* it's address for use in symbolizer. +*/ + mas->opd_addr = (void *)mas->opd->sh_addr; + mas->opd_size = mas->opd->sh_size; + +/* +* Module relocation was already done at this point. Section +* headers are about to be deleted. Wipe out load-time context. +*/ + mas->core_plt =NULL ; + mas->init_plt =NULL ; + mas->got =NULL ; + mas->opd =NULL ; + mas->unwind =NULL ; + mas->gp =0 ; + mas->next_got_entry =0 ; +return 0 ; }
@@ -926,10 +948,9 @@ module_arch_cleanup (struct module *mod)void *dereference_module_function_descriptor (struct module *mod,void *ptr) { -Elf64_Shdr *opd = mod->arch.opd; +struct mod_arch_specific *mas = &mod->arch; -if (ptr < (void *)opd->sh_addr || - ptr >= (void *)(opd->sh_addr + opd->sh_size)) +if (ptr < mas->opd_addr || ptr >= mas->opd_addr + mas->opd_size)return ptr;return dereference_function_descriptor (ptr);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 118/363 watchdog: rename __touch_watchdog() to a better descriptive name
In reply to Greg Kroah-HartmanFrom: Petr Mladek <[email protected]>
[ Upstream commit 7c0012f522c802d25be102bafe54f333168e6119 ]
Patch series "watchdog/softlockup: Report overall time and some cleanup", v2.
I dug deep into the softlockup watchdog history when time permitted this year. And reworked the patchset that fixed timestamps and cleaned up the code[2].
I split it into very small steps and did even more code clean up. The result looks quite strightforward and I am pretty confident with the changes.
[1] v2: https://lore.kernel.org/r/[email protected]
[2] v1: https://lore.kernel.org/r/[email protected]
This patch (of 6):
There are many touch_*watchdog() functions. They are called in situations where the watchdog could report false positives or create unnecessary noise. For example, when CPU is entering idle mode, a virtual machine is stopped, or a lot of messages are printed in the atomic context.
These functions set SOFTLOCKUP_RESET instead of a real timestamp. It allows to call them even in a context where jiffies might be outdated. For example, in an atomic context.
The real timestamp is set by __touch_watchdog() that is called from the watchdog timer callback.
Rename this callback to update_touch_ts(). It better describes the effect and clearly distinguish is from the other touch_*watchdog() functions.
Another motivation is that two timestamps are going to be used. One will be used for the total softlockup time. The other will be used to measure time since the last report. The new function name will help to distinguish which timestamp is being updated.
--- kernel/watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/watchdog.c +4 -4
@@ -236,7 +236,7 @@ static void set_sample_period(void) }/* Commands for resetting the watchdog */ -static void __touch_watchdog (void ) +static void update_touch_ts (void ) {__this_cpu_write (watchdog_touch_ts,get_timestamp ()); }
@@ -332,7 +332,7 @@ static DEFINE_PER_CPU(struct cpu_stop_work, softlockup_stop_work);*/ static int softlockup_fn (void *data) { -__touch_watchdog (); +update_touch_ts ();complete (this_cpu_ptr (&softlockup_completion));return 0 ;
@@ -375,7 +375,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)/* Clear the guest paused flag on watchdog reset */ kvm_check_and_clear_guest_paused (); -__touch_watchdog (); +update_touch_ts ();return HRTIMER_RESTART ; }
@@ -461,7 +461,7 @@ static void watchdog_enable(unsigned int cpu) HRTIMER_MODE_REL_PINNED_HARD);/* Initialize timestamp */ -__touch_watchdog (); +update_touch_ts ();/* Enable the perf event */ if (watchdog_enabled &NMI_WATCHDOG_ENABLED )watchdog_nmi_enable (cpu);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 119/363 watchdog: explicitly update timestamp when reporting softlockup
In reply to Greg Kroah-HartmanFrom: Petr Mladek <[email protected]>
[ Upstream commit c9ad17c991492f4390f42598f6ab0531f87eed07 ]
The softlockup situation might stay for a long time or even forever. When it happens, the softlockup debug messages are printed in regular intervals defined by get_softlockup_thresh().
There is a mystery. The repeated message is printed after the full interval that is defined by get_softlockup_thresh(). But the timer callback is called more often as defined by sample_period. The code looks like the soflockup should get reported in every sample_period when it was once behind the thresh.
It works only by chance. The watchdog is touched when printing the stall report, for example, in printk_stack_address().
Make the behavior clear and predictable by explicitly updating the timestamp in watchdog_timer_fn() when the report gets printed.
--- kernel/watchdog.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/watchdog.c +3 -0
@@ -410,6 +410,9 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer) } } +/* Start period for the next softlockup warning. */ +update_touch_ts (); +pr_emerg ("BUG: soft lockup - CPU#%d stuck for %us! [%s:%d]\n" ,smp_processor_id (), duration, current->comm,task_pid_nr (current));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 120/363 watchdog/softlockup: report the overall time of softlockups
In reply to Greg Kroah-HartmanFrom: Petr Mladek <[email protected]>
[ Upstream commit fef06efc2ebaa94c8aee299b863e870467dbab8d ]
The softlockup detector currently shows the time spent since the last report. As a result it is not clear whether a CPU is infinitely hogged by a single task or if it is a repeated event.
The situation can be simulated with a simply busy loop:
while (true) cpu_relax();
The softlockup detector produces:
[ 168.277520] watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [cat:4865] [ 196.277604] watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [cat:4865] [ 236.277522] watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [cat:4865]
But it should be, something like:
[ 480.372418] watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [cat:4943] [ 508.372359] watchdog: BUG: soft lockup - CPU#2 stuck for 52s! [cat:4943] [ 548.372359] watchdog: BUG: soft lockup - CPU#2 stuck for 89s! [cat:4943] [ 576.372351] watchdog: BUG: soft lockup - CPU#2 stuck for 115s! [cat:4943]
For the better output, add an additional timestamp of the last report. Only this timestamp is reset when the watchdog is intentionally touched from slow code paths or when printing the report.
--- kernel/watchdog.c | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-)
kernel/watchdog.c +28 -12
@@ -154,7 +154,11 @@ static void lockup_detector_update_enable(void)#ifdef CONFIG_SOFTLOCKUP_DETECTOR -#define SOFTLOCKUP_RESET ULONG_MAX +/* +* Delay the soflockup report when running a known slow code. +* It does _not_ affect the timestamp of the last successdul reschedule. +*/ +#define SOFTLOCKUP_DELAY_REPORT ULONG_MAX#ifdef CONFIG_SMP int __read_mostly sysctl_softlockup_all_cpu_backtrace;
@@ -169,7 +173,10 @@ unsigned int __read_mostly softlockup_panic =static bool softlockup_initialized__read_mostly ;static u64 __read_mostly sample_period; +/* Timestamp taken after the last successful reschedule. */ static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts); +/* Timestamp of the last softlockup report. */ +static DEFINE_PER_CPU(unsigned long, watchdog_report_ts); static DEFINE_PER_CPU(struct hrtimer, watchdog_hrtimer); static DEFINE_PER_CPU(bool, softlockup_touch_sync); static DEFINE_PER_CPU(bool, soft_watchdog_warn);
@@ -235,10 +242,16 @@ static void set_sample_period(void)watchdog_update_hrtimer_threshold (sample_period); } +static void update_report_ts (void ) +{ +__this_cpu_write (watchdog_report_ts,get_timestamp ()); +} +/* Commands for resetting the watchdog */ static void update_touch_ts (void ) {__this_cpu_write (watchdog_touch_ts,get_timestamp ()); +update_report_ts (); }/**
@@ -252,10 +265,10 @@ static void update_touch_ts(void) notrace void touch_softlockup_watchdog_sched(void) {/* -* Preemption can be enabled. It doesn't matter which CPU's timestamp -* gets zeroed here, so use the raw_ operation. +* Preemption can be enabled. It doesn't matter which CPU's watchdog +* report period gets restarted here, so use the raw_ operation. */ -raw_cpu_write (watchdog_touch_ts,SOFTLOCKUP_RESET ); +raw_cpu_write (watchdog_report_ts,SOFTLOCKUP_DELAY_REPORT ); } notrace void touch_softlockup_watchdog(void)
@@ -279,7 +292,7 @@ void touch_all_softlockup_watchdogs(void)* the softlockup check. */ for_each_cpu (cpu, &watchdog_allowed_mask) { -per_cpu (watchdog_touch_ts, cpu) =SOFTLOCKUP_RESET ; +per_cpu (watchdog_report_ts, cpu) =SOFTLOCKUP_DELAY_REPORT ;wq_watchdog_touch (cpu); } }
@@ -287,16 +300,16 @@ void touch_all_softlockup_watchdogs(void)void touch_softlockup_watchdog_sync (void ) {__this_cpu_write (softlockup_touch_sync, true); -__this_cpu_write (watchdog_touch_ts,SOFTLOCKUP_RESET ); +__this_cpu_write (watchdog_report_ts,SOFTLOCKUP_DELAY_REPORT ); } -static int is_softlockup (unsigned long touch_ts) +static int is_softlockup (unsigned long touch_ts,unsigned long period_ts) {unsigned long now =get_timestamp ();if ((watchdog_enabled &SOFT_WATCHDOG_ENABLED ) && watchdog_thresh){/* Warn about unreasonable delays. */ -if (time_after (now, touch_ts +get_softlockup_thresh ())) +if (time_after (now, period_ts +get_softlockup_thresh ()))return now - touch_ts; }return 0 ;
@@ -342,6 +355,7 @@ static int softlockup_fn(void *data)static enum hrtimer_restart watchdog_timer_fn (struct hrtimer *hrtimer) {unsigned long touch_ts =__this_cpu_read (watchdog_touch_ts); +unsigned long period_ts =__this_cpu_read (watchdog_report_ts);struct pt_regs *regs =get_irq_regs ();int duration;int softlockup_all_cpu_backtrace = sysctl_softlockup_all_cpu_backtrace;
@@ -363,7 +377,8 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)/* .. and repeat */ hrtimer_forward_now (hrtimer,ns_to_ktime (sample_period)); -if (touch_ts ==SOFTLOCKUP_RESET ) { +/* Reset the interval when touched externally by a known slow code. */ +if (period_ts ==SOFTLOCKUP_DELAY_REPORT ) {if (unlikely (__this_cpu_read (softlockup_touch_sync))) {/* * If the time stamp was touched atomically
@@ -375,7 +390,8 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)/* Clear the guest paused flag on watchdog reset */ kvm_check_and_clear_guest_paused (); -update_touch_ts (); +update_report_ts (); +return HRTIMER_RESTART ; }
@@ -385,7 +401,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)* indicate it is getting cpu time. If it hasn't then * this is a good indication some task is hogging the cpu */ - duration =is_softlockup (touch_ts); + duration =is_softlockup (touch_ts, period_ts);if (unlikely (duration)) {/* * If a virtual machine is stopped by the host it can look to
@@ -411,7 +427,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer) }/* Start period for the next softlockup warning. */ -update_touch_ts (); +update_report_ts (); pr_emerg("BUG: soft lockup - CPU#%d stuck for %us! [%s:%d]\n", smp_processor_id(), duration,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 103/363 drm/amd/display: add handling for hdcp2 rx id list validation
In reply to Greg Kroah-HartmanFrom: Dingchen (David) Zhang <[email protected]>
[ Upstream commit 4ccf9446b2a3615615045346c97f8a1e2a16568a ]
[why]
the current implementation of hdcp2 rx id list validation does not have handler/checker for invalid message status, e.g. HMAC, the V parameter calculated from PSP not matching the V prime from Rx.
[how]
return a generic FAILURE for any message status not SUCCESS or REVOKED.
--- drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c +2 -0
@@ -791,6 +791,8 @@ enum mod_hdcp_status mod_hdcp_hdcp2_validate_rx_id_list(struct mod_hdcp *hdcp) TA_HDCP2_MSG_AUTHENTICATION_STATUS__RECEIVERID_REVOKED) { hdcp->connection.is_hdcp2_revoked = 1; status = MOD_HDCP_STATUS_HDCP2_RX_ID_LIST_REVOKED; + } else { + status =MOD_HDCP_STATUS_HDCP2_VALIDATE_RX_ID_LIST_FAILURE ; } }mutex_unlock (&psp->hdcp_context.mutex);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 121/363 watchdog/softlockup: remove logic that tried to prevent repeated reports
In reply to Greg Kroah-HartmanFrom: Petr Mladek <[email protected]>
[ Upstream commit 1bc503cb4a2638fb1c57801a7796aca57845ce63 ]
The softlockup detector does some gymnastic with the variable soft_watchdog_warn. It was added by the commit 58687acba59266735ad ("lockup_detector: Combine nmi_watchdog and softlockup detector").
The purpose is not completely clear. There are the following clues. They describe the situation how it looked after the above mentioned commit:
1. The variable was checked with a comment "only warn once".
2. The variable was set when softlockup was reported. It was cleared only when the CPU was not longer in the softlockup state.
3. watchdog_touch_ts was not explicitly updated when the softlockup was reported. Without this variable, the report would normally be printed again during every following watchdog_timer_fn() invocation.
The logic has got even more tangled up by the commit ed235875e2ca98 ("kernel/watchdog.c: print traces for all cpus on lockup detection"). After this commit, soft_watchdog_warn is set only when softlockup_all_cpu_backtrace is enabled. But multiple reports from all CPUs are prevented by a new variable soft_lockup_nmi_warn.
Conclusion:
The variable probably never worked as intended. In each case, it has not worked last many years because the softlockup was reported repeatedly after the full period defined by watchdog_thresh.
The reason is that watchdog gets touched in many known slow paths, for example, in printk_stack_address(). This code is called also when printing the softlockup report. It means that the watchdog timestamp gets updated after each report.
Solution:
Simply remove the logic. People want the periodic report anyway.
--- kernel/watchdog.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
kernel/watchdog.c +2 -12
@@ -179,7 +179,6 @@ static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts); static DEFINE_PER_CPU(unsigned long, watchdog_report_ts); static DEFINE_PER_CPU(struct hrtimer, watchdog_hrtimer); static DEFINE_PER_CPU(bool, softlockup_touch_sync); -static DEFINE_PER_CPU(bool, soft_watchdog_warn); static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts); static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);static unsigned long soft_lockup_nmi_warn;
@@ -411,19 +410,12 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)if (kvm_check_and_clear_guest_paused ())return HRTIMER_RESTART ; -/* only warn once */ -if (__this_cpu_read (soft_watchdog_warn) == true) -return HRTIMER_RESTART ; -if (softlockup_all_cpu_backtrace) {/* Prevent multiple soft-lockup reports if one cpu is already * engaged in dumping cpu back traces */ -if (test_and_set_bit (0 , &soft_lockup_nmi_warn)) { -/* Someone else will report us. Let's give up */ -__this_cpu_write (soft_watchdog_warn, true); +if (test_and_set_bit (0 , &soft_lockup_nmi_warn))return HRTIMER_RESTART ; - } }/* Start period for the next softlockup warning. */
@@ -453,9 +445,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)add_taint (TAINT_SOFTLOCKUP ,LOCKDEP_STILL_OK );if (softlockup_panic)panic ("softlockup: hung tasks" ); -__this_cpu_write (soft_watchdog_warn, true); - }else -__this_cpu_write (soft_watchdog_warn, false); + }return HRTIMER_RESTART ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 122/363 watchdog: fix barriers when printing backtraces from all CPUs
In reply to Greg Kroah-HartmanFrom: Petr Mladek <[email protected]>
[ Upstream commit 9f113bf760ca90d709f8f89a733d10abb1f04a83 ]
Any parallel softlockup reports are skipped when one CPU is already printing backtraces from all CPUs.
The exclusive rights are synchronized using one bit in soft_lockup_nmi_warn. There is also one memory barrier that does not make much sense.
Use two barriers on the right location to prevent mixing two reports.
--- kernel/watchdog.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
kernel/watchdog.c +6 -11
@@ -410,11 +410,12 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)if (kvm_check_and_clear_guest_paused ())return HRTIMER_RESTART ; +/* +* Prevent multiple soft-lockup reports if one cpu is already +* engaged in dumping all cpu back traces. +*/ if (softlockup_all_cpu_backtrace) { -/* Prevent multiple soft-lockup reports if one cpu is already -* engaged in dumping cpu back traces -*/ -if (test_and_set_bit (0 , &soft_lockup_nmi_warn)) +if (test_and_set_bit_lock (0 , &soft_lockup_nmi_warn))return HRTIMER_RESTART ; }
@@ -432,14 +433,8 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)dump_stack ();if (softlockup_all_cpu_backtrace) { -/* Avoid generating two back traces for current -* given that one is already made above -*/ trigger_allbutself_cpu_backtrace (); - -clear_bit (0 , &soft_lockup_nmi_warn); -/* Barrier to sync with other cpus */ -smp_mb__after_atomic (); +clear_bit_unlock (0 , &soft_lockup_nmi_warn); }add_taint (TAINT_SOFTLOCKUP ,LOCKDEP_STILL_OK );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 123/363 watchdog: cleanup handling of false positives
In reply to Greg Kroah-HartmanFrom: Petr Mladek <[email protected]>
[ Upstream commit 9bf3bc949f8aeefeacea4b1198db833b722a8e27 ]
Commit d6ad3e286d2c ("softlockup: Add sched_clock_tick() to avoid kernel warning on kgdb resume") introduced touch_softlockup_watchdog_sync().
It solved a problem when the watchdog was touched in an atomic context, the timer callback was proceed right after releasing interrupts, and the local clock has not been updated yet. In this case, sched_clock_tick() was called in watchdog_timer_fn() before updating the timer.
So far so good.
Later commit 5d1c0f4a80a6 ("watchdog: add check for suspended vm in softlockup detector") added two kvm_check_and_clear_guest_paused() calls. They touch the watchdog when the guest has been sleeping.
The code makes my head spin around.
Scenario 1:
+ guest did sleep:
+ PVCLOCK_GUEST_STOPPED is set
+ 1st watchdog_timer_fn() invocation:
+ the watchdog is not touched yet
+ is_softlockup() returns too big delay
+ kvm_check_and_clear_guest_paused():
+ clear PVCLOCK_GUEST_STOPPED
+ call touch_softlockup_watchdog_sync()
+ set SOFTLOCKUP_DELAY_REPORT
+ set softlockup_touch_sync
+ return from the timer callback
+ 2nd watchdog_timer_fn() invocation:
+ call sched_clock_tick() even though it is not needed. The timer callback was invoked again only because the clock has already been updated in the meantime.
+ call kvm_check_and_clear_guest_paused() that does nothing because PVCLOCK_GUEST_STOPPED has been cleared already.
+ call update_report_ts() and return. This is fine. Except that sched_clock_tick() might allow to set it already during the 1st invocation.
Scenario 2:
+ guest did sleep
+ 1st watchdog_timer_fn() invocation
+ same as in 1st scenario
+ guest did sleep again:
+ set PVCLOCK_GUEST_STOPPED again
+ 2nd watchdog_timer_fn() invocation
+ SOFTLOCKUP_DELAY_REPORT is set from 1st invocation
+ call sched_clock_tick()
+ call kvm_check_and_clear_guest_paused()
+ clear PVCLOCK_GUEST_STOPPED
+ call touch_softlockup_watchdog_sync()
+ set SOFTLOCKUP_DELAY_REPORT
+ set softlockup_touch_sync
+ call update_report_ts() (set real timestamp immediately)
+ return from the timer callback
+ 3rd watchdog_timer_fn() invocation
+ timestamp is set from 2nd invocation
+ softlockup_touch_sync is set but not checked because the real timestamp is already set
Make the code more straightforward:
1. Always call kvm_check_and_clear_guest_paused() at the very beginning to handle PVCLOCK_GUEST_STOPPED. It touches the watchdog when the quest did sleep.
2. Handle the situation when the watchdog has been touched (SOFTLOCKUP_DELAY_REPORT is set).
Call sched_clock_tick() when touch_*sync() variant was used. It makes sure that the timestamp will be up to date even when it has been touched in atomic context or quest did sleep.
As a result, kvm_check_and_clear_guest_paused() is called on a single location. And the right timestamp is always set when returning from the timer callback.
--- kernel/watchdog.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
kernel/watchdog.c +8 -12
@@ -376,7 +376,14 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)/* .. and repeat */ hrtimer_forward_now (hrtimer,ns_to_ktime (sample_period)); -/* Reset the interval when touched externally by a known slow code. */ +/* +* If a virtual machine is stopped by the host it can look to +* the watchdog like a soft lockup. Check to see if the host +* stopped the vm before we process the timestamps. +*/ +kvm_check_and_clear_guest_paused (); + +/* Reset the interval when touched by known problematic code. */ if (period_ts ==SOFTLOCKUP_DELAY_REPORT ) {if (unlikely (__this_cpu_read (softlockup_touch_sync))) {/*
@@ -387,10 +394,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)sched_clock_tick (); } -/* Clear the guest paused flag on watchdog reset */ -kvm_check_and_clear_guest_paused ();update_report_ts (); -return HRTIMER_RESTART ; }
@@ -402,14 +406,6 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)*/ duration =is_softlockup (touch_ts, period_ts);if (unlikely (duration)) { -/* -* If a virtual machine is stopped by the host it can look to -* the watchdog like a soft lockup, check to see if the host -* stopped the vm before we issue the warning -*/ -if (kvm_check_and_clear_guest_paused ()) -return HRTIMER_RESTART ; -/* * Prevent multiple soft-lockup reports if one cpu is already * engaged in dumping all cpu back traces.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 124/363 ASoC: rt286: Make RT286_SET_GPIO_* readable and writable
In reply to Greg Kroah-HartmanFrom: David Ward <[email protected]>
[ Upstream commit cd8499d5c03ba260e3191e90236d0e5f6b147563 ]
The GPIO configuration cannot be applied if the registers are inaccessible. This prevented the headset mic from working on the Dell XPS 13 9343.
--- sound/soc/codecs/rt286.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/codecs/rt286.c +3 -0
@@ -171,6 +171,9 @@ static bool rt286_readable_register(struct device *dev, unsigned int reg)case RT286_PROC_COEF :case RT286_SET_AMP_GAIN_ADC_IN1 :case RT286_SET_AMP_GAIN_ADC_IN2 : +case RT286_SET_GPIO_MASK : +case RT286_SET_GPIO_DIRECTION : +case RT286_SET_GPIO_DATA :case RT286_SET_POWER (RT286_DAC_OUT1 ):case RT286_SET_POWER (RT286_DAC_OUT2 ):case RT286_SET_POWER (RT286_ADC_IN1 ):
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 125/363 leds: lgm: fix gpiolib dependency
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 34731ed13e8a8ca95fa0dca466537396b5f2d1af ]
Without gpiolib, the driver fails to build:
drivers/leds/blink/leds-lgm-sso.c:123:19: error: field has incomplete type 'struct gpio_chip'
struct gpio_chip chip;
^
include/linux/gpio.h:107:8: note: forward declaration of 'struct gpio_chip'
struct gpio_chip;
^
drivers/leds/blink/leds-lgm-sso.c:263:3: error: implicit declaration of function 'gpiod_set_value' [-Werror,-Wimplicit-function-declaration]
gpiod_set_value(led->gpiod, val);
^
drivers/leds/blink/leds-lgm-sso.c:263:3: note: did you mean 'gpio_set_value'?
include/linux/gpio.h:168:20: note: 'gpio_set_value' declared here
static inline void gpio_set_value(unsigned gpio, int value)
^
drivers/leds/blink/leds-lgm-sso.c:345:3: error: implicit declaration of function 'gpiod_set_value' [-Werror,-Wimplicit-function-declaration]
gpiod_set_value(led->gpiod, 1);
^Add the dependency in Kconfig.
--- drivers/leds/blink/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/leds/blink/Kconfig +1 -0
@@ -9,6 +9,7 @@ if LEDS_BLINK config LEDS_BLINK_LGM tristate "LED support for Intel LGM SoC series" + depends on GPIOLIB depends on LEDS_CLASS depends on MFD_SYSCON depends on OF
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 126/363 thermal: thermal_of: Fix error return code of thermal_of_populate_bind_params()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 45c7eaeb29d67224db4ba935deb575586a1fda09 ]
When kcalloc() returns NULL to __tcbp or of_count_phandle_with_args() returns zero or -ENOENT to count, no error return code of thermal_of_populate_bind_params() is assigned.
To fix these bugs, ret is assigned with -ENOMEM and -ENOENT in these cases, respectively.
--- drivers/thermal/thermal_of.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/thermal/thermal_of.c +5 -2
@@ -704,14 +704,17 @@ static int thermal_of_populate_bind_params(struct device_node *np, count =of_count_phandle_with_args (np,"cooling-device" ,"#cooling-cells" ); -if (!count) { +if (count <=0 ) {pr_err ("Add a cooling_device property with at least one device\n" ); + ret = -ENOENT ; goto end; } __tcbp =kcalloc (count,sizeof (*__tcbp),GFP_KERNEL ); -if (!__tcbp) +if (!__tcbp) { + ret = -ENOMEM ; goto end; + }for (i =0 ; i < count; i++) { ret = of_parse_phandle_with_args(np, "cooling-device",
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 129/363 f2fs: fix panic during f2fs_resize_fs()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 3ab0598e6d860ef49d029943ba80f627c15c15d6 ]
f2fs_resize_fs() hangs in below callstack with testcase:
- mkfs 16GB image & mount image
- dd 8GB fileA
- dd 8GB fileB
- sync
- rm fileA
- sync
- resize filesystem to 8GB
kernel BUG at segment.c:2484!
Call Trace: allocate_segment_by_default+0x92/0xf0 [f2fs] f2fs_allocate_data_block+0x44b/0x7e0 [f2fs] do_write_page+0x5a/0x110 [f2fs] f2fs_outplace_write_data+0x55/0x100 [f2fs] f2fs_do_write_data_page+0x392/0x850 [f2fs] move_data_page+0x233/0x320 [f2fs] do_garbage_collect+0x14d9/0x1660 [f2fs] free_segment_range+0x1f7/0x310 [f2fs] f2fs_resize_fs+0x118/0x330 [f2fs] __f2fs_ioctl+0x487/0x3680 [f2fs] __x64_sys_ioctl+0x8e/0xd0 do_syscall_64+0x33/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9
The root cause is we forgot to check that whether we have enough space in resized filesystem to store all valid blocks in before-resizing filesystem, then allocator will run out-of-space during block migration in free_segment_range().
--- fs/f2fs/gc.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
fs/f2fs/gc.c +13 -0
@@ -1977,7 +1977,20 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)/* stop CP to protect MAIN_SEC in free_segment_range */ f2fs_lock_op (sbi); + +spin_lock (&sbi->stat_lock); +if (shrunk_blocks +valid_user_blocks (sbi) + + sbi->current_reserved_blocks + sbi->unusable_block_count + +F2FS_OPTION (sbi).root_reserved_blocks > sbi->user_block_count) + err = -ENOSPC ; +spin_unlock (&sbi->stat_lock); + +if (err) + goto out_unlock; + err =free_segment_range (sbi, secs, true); + +out_unlock:f2fs_unlock_op (sbi);up_write (&sbi->gc_lock);if (err)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 128/363 f2fs: fix to allow migrating fully valid segment
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 7dede88659df38f96128ab3922c50dde2d29c574 ]
F2FS_IOC_FLUSH_DEVICE/F2FS_IOC_RESIZE_FS needs to migrate all blocks of target segment to other place, no matter the segment has partially or fully valid blocks.
However, after commit 803e74be04b3 ("f2fs: stop GC when the victim becomes fully valid"), we may skip migration due to target segment is fully valid, result in failing the ioctl interface, fix this.
--- fs/f2fs/f2fs.h | 2 +- fs/f2fs/file.c | 9 +++++---- fs/f2fs/gc.c | 21 ++++++++++++--------- fs/f2fs/segment.c | 2 +- fs/f2fs/super.c | 2 +- 5 files changed, 20 insertions(+), 16 deletions(-)
fs/f2fs/f2fs.h +1 -1
@@ -3547,7 +3547,7 @@ void f2fs_destroy_post_read_wq(struct f2fs_sb_info *sbi);int f2fs_start_gc_thread (struct f2fs_sb_info *sbi);void f2fs_stop_gc_thread (struct f2fs_sb_info *sbi);block_t f2fs_start_bidx_of_node (unsigned int node_ofs,struct inode *inode); -int f2fs_gc (struct f2fs_sb_info *sbi,bool sync,bool background, +int f2fs_gc (struct f2fs_sb_info *sbi,bool sync,bool background,bool force,unsigned int segno);void f2fs_build_gc_manager (struct f2fs_sb_info *sbi);int f2fs_resize_fs (struct f2fs_sb_info *sbi,__u64 block_count);
fs/f2fs/file.c +5 -4
@@ -1658,7 +1658,7 @@ next_alloc:if (has_not_enough_free_secs (sbi,0 ,GET_SEC_FROM_SEG (sbi,overprovision_segments (sbi)))) {down_write (&sbi->gc_lock); - err =f2fs_gc (sbi, true, false,NULL_SEGNO ); + err =f2fs_gc (sbi, true, false, false,NULL_SEGNO );if (err && err != -ENODATA && err != -EAGAIN ) goto out_err; }
@@ -2489,7 +2489,7 @@ static int f2fs_ioc_gc(struct file *filp, unsigned long arg)down_write (&sbi->gc_lock); } - ret =f2fs_gc (sbi, sync, true,NULL_SEGNO ); + ret =f2fs_gc (sbi, sync, true, false,NULL_SEGNO ); out:mnt_drop_write_file (filp);return ret;
@@ -2525,7 +2525,8 @@ do_more:down_write (&sbi->gc_lock); } - ret =f2fs_gc (sbi, range->sync, true,GET_SEGNO (sbi, range->start)); + ret =f2fs_gc (sbi, range->sync, true, false, +GET_SEGNO (sbi, range->start));if (ret) {if (ret == -EBUSY ) ret = -EAGAIN ;
@@ -2978,7 +2979,7 @@ static int f2fs_ioc_flush_device(struct file *filp, unsigned long arg) sm->last_victim[GC_CB ] = end_segno +1 ; sm->last_victim[GC_GREEDY ] = end_segno +1 ; sm->last_victim[ALLOC_NEXT ] = end_segno +1 ; - ret =f2fs_gc (sbi, true, true, start_segno); + ret =f2fs_gc (sbi, true, true, true, start_segno);if (ret == -EAGAIN ) ret =0 ;else if (ret <0 )
fs/f2fs/gc.c +12 -9
@@ -112,7 +112,7 @@ do_gc: sync_mode =F2FS_OPTION (sbi).bggc_mode ==BGGC_MODE_SYNC ;/* if return value is not zero, no victim was selected */ -if (f2fs_gc (sbi, sync_mode, true,NULL_SEGNO )) +if (f2fs_gc (sbi, sync_mode, true, false,NULL_SEGNO )) wait_ms = gc_th->no_gc_sleep_time; trace_f2fs_background_gc(sbi->sb, wait_ms,
@@ -1354,7 +1354,8 @@ out:* the victim data block is ignored. */ static int gc_data_segment (struct f2fs_sb_info *sbi,struct f2fs_summary *sum, -struct gc_inode_list *gc_list,unsigned int segno,int gc_type) +struct gc_inode_list *gc_list,unsigned int segno,int gc_type, +bool force_migrate) {struct super_block *sb = sbi->sb;struct f2fs_summary *entry;
@@ -1383,8 +1384,8 @@ next_step:* race condition along with SSR block allocation. */ if ((gc_type ==BG_GC &&has_not_enough_free_secs (sbi,0 ,0 )) || -get_valid_blocks (sbi, segno, true) == -BLKS_PER_SEC (sbi)) + (!force_migrate &&get_valid_blocks (sbi, segno, true) == +BLKS_PER_SEC (sbi)))return submitted;if (check_valid_map (sbi, segno, off) ==0 )
@@ -1519,7 +1520,8 @@ static int __get_victim(struct f2fs_sb_info *sbi, unsigned int *victim,static int do_garbage_collect (struct f2fs_sb_info *sbi,unsigned int start_segno, -struct gc_inode_list *gc_list,int gc_type) +struct gc_inode_list *gc_list,int gc_type, +bool force_migrate) {struct page *sum_page;struct f2fs_summary_block *sum;
@@ -1606,7 +1608,8 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, gc_type); else submitted += gc_data_segment(sbi, sum->entries, gc_list, -segno ,gc_type ); +segno ,gc_type , +force_migrate );stat_inc_seg_count (sbi, type, gc_type); migrated++;
@@ -1634,7 +1637,7 @@ skip: }int f2fs_gc (struct f2fs_sb_info *sbi,bool sync, -bool background,unsigned int segno) +bool background,bool force,unsigned int segno) {int gc_type = sync ?FG_GC :BG_GC ;int sec_freed =0 , seg_freed =0 , total_freed =0 ;
@@ -1696,7 +1699,7 @@ gc_more:if (ret) goto stop; - seg_freed =do_garbage_collect (sbi, segno, &gc_list, gc_type); + seg_freed =do_garbage_collect (sbi, segno, &gc_list, gc_type, force);if (gc_type ==FG_GC && seg_freed ==f2fs_usable_segs_in_sec (sbi, segno)) sec_freed++;
@@ -1835,7 +1838,7 @@ static int free_segment_range(struct f2fs_sb_info *sbi, .iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS), }; -do_garbage_collect (sbi, segno, &gc_list,FG_GC ); +do_garbage_collect (sbi, segno, &gc_list,FG_GC , true);put_gc_inode (&gc_list);if (!gc_only &&get_valid_blocks (sbi, segno, true)) {
fs/f2fs/segment.c +1 -1
@@ -504,7 +504,7 @@ void f2fs_balance_fs(struct f2fs_sb_info *sbi, bool need)*/ if (has_not_enough_free_secs (sbi,0 ,0 )) {down_write (&sbi->gc_lock); -f2fs_gc (sbi, false, false,NULL_SEGNO ); +f2fs_gc (sbi, false, false, false,NULL_SEGNO ); } }
fs/f2fs/super.c +1 -1
@@ -1865,7 +1865,7 @@ static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi)while (!f2fs_time_over (sbi,DISABLE_TIME )) {down_write (&sbi->gc_lock); - err =f2fs_gc (sbi, true, false,NULL_SEGNO ); + err =f2fs_gc (sbi, true, false, false,NULL_SEGNO );if (err == -ENODATA ) { err =0 ;break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 130/363 f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 28e18ee636ba28532dbe425540af06245a0bbecb ]
The uninitialized variable dn.node_changed does not get set when a call to f2fs_get_node_page fails. This uninitialized value gets used in the call to f2fs_balance_fs() that may or not may not balances dirty node and dentry pages depending on the uninitialized state of the variable. Fix this by only calling f2fs_balance_fs if err is not set.
Thanks to Jaegeuk Kim for suggesting an appropriate fix.
Addresses-Coverity: ("Uninitialized scalar variable")
--- fs/f2fs/inline.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/inline.c +2 -1
@@ -219,7 +219,8 @@ out:f2fs_put_page (page,1 ); -f2fs_balance_fs (sbi, dn.node_changed); +if (!err) +f2fs_balance_fs (sbi, dn.node_changed);return err; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 133/363 PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc()
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 1e83130f01b04c16579ed5a5e03d729bcffc4c5d ]
IRQ domain alloc function should return zero on success. Non-zero value indicates failure.
--- drivers/pci/controller/pcie-iproc-msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pcie-iproc-msi.c +1 -1
@@ -271,7 +271,7 @@ static int iproc_msi_irq_domain_alloc(struct irq_domain *domain, NULL, NULL); } -return hwirq; +return 0 ; } static void iproc_msi_irq_domain_free(struct irq_domain *domain,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 131/363 rtc: tps65910: include linux/property.h
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 936d3685e62436a378f02b8b74759b054d4aeca1 ]
The added device_property_present() call causes a build failure in some configurations because of the missing header:
drivers/rtc/rtc-tps65910.c:422:7: error: implicit declaration of function 'device_property_present' [-Werror,-Wimplicit-function-declaration]
--- drivers/rtc/rtc-tps65910.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-tps65910.c +1 -0
@@ -18,6 +18,7 @@#include <linux/rtc.h> #include <linux/bcd.h> #include <linux/math64.h> +#include <linux/property.h> #include <linux/platform_device.h> #include <linux/interrupt.h> #include <linux/mfd/tps65910.h>
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 104/363 drm/amdgpu: Add mem sync flag for IB allocated by SA
In reply to Greg Kroah-HartmanFrom: Jinzhou Su <[email protected]>
[ Upstream commit 5c88e3b86a88f14efa0a3ddd28641c6ff49fb9c4 ]
The buffer of SA bo will be used by many cases. So it's better to invalidate the cache of indirect buffer allocated by SA before commit the IB.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +2 -0
@@ -77,6 +77,8 @@ int amdgpu_ib_get(struct amdgpu_device *adev, struct amdgpu_vm *vm, } ib->ptr =amdgpu_sa_bo_cpu_addr (ib->sa_bo); +/* flush the cache before commit the IB */ + ib->flags =AMDGPU_IB_FLAG_EMIT_MEM_SYNC ;if (!vm) ib->gpu_addr =amdgpu_sa_bo_gpu_addr (ib->sa_bo);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 132/363 remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit 3d2ee78906af5f08d499d6aa3aa504406fa38106 ]
Analog to the issue in the common mdt_loader code the MSS ELF loader does not validate that p_filesz bytes will fit in the memory region and that the loaded segments are not truncated. Fix this in the same way as proposed for the mdt_loader.
--- drivers/remoteproc/qcom_q6v5_mss.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/remoteproc/qcom_q6v5_mss.c +18 -0
@@ -1210,6 +1210,14 @@ static int q6v5_mpss_load(struct q6v5 *qproc) goto release_firmware; } +if (phdr->p_filesz > phdr->p_memsz) { +dev_err (qproc->dev, +"refusing to load segment %d with p_filesz > p_memsz\n" , + i); + ret = -EINVAL ; + goto release_firmware; + } + ptr =memremap (qproc->mpss_phys + offset, phdr->p_memsz,MEMREMAP_WC );if (!ptr) { dev_err(qproc->dev,
@@ -1241,6 +1249,16 @@ static int q6v5_mpss_load(struct q6v5 *qproc) goto release_firmware; } +if (seg_fw->size != phdr->p_filesz) { +dev_err (qproc->dev, +"failed to load segment %d from truncated file %s\n" , + i, fw_name); + ret = -EINVAL ; +release_firmware (seg_fw); +memunmap (ptr); + goto release_firmware; + } +release_firmware (seg_fw); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 134/363 PCI: brcmstb: Fix error return code in brcm_pcie_probe()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit b5d9209d50838474fc1b2901d0e11bba59906428 ]
Fix to return negative error code -ENODEV from the unsupported revision error handling case instead of 0, as done elsewhere in this function.
--- drivers/pci/controller/pcie-brcmstb.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/pcie-brcmstb.c +1 -0
@@ -1296,6 +1296,7 @@ static int brcm_pcie_probe(struct platform_device *pdev) pcie->hw_rev =readl (pcie->base +PCIE_MISC_REVISION );if (pcie->type ==BCM4908 && pcie->hw_rev >=BRCM_PCIE_HW_REV_3_20 ) {dev_err (pcie->dev,"hardware revision with unsupported PERST# setup\n" ); + ret = -ENODEV ; goto fail; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 127/363 PCI/RCEC: Fix RCiEP device to RCEC association
In reply to Greg Kroah-HartmanFrom: Qiuxu Zhuo <[email protected]>
[ Upstream commit d9b7eae8e3424c3480fe9f40ebafbb0c96426e4c ]
rcec_assoc_rciep() used "rciep->devfn" (a single byte encoding both the device and function number) as the device number to check whether the corresponding bit was set in the RCEC's Association Bitmap for RCiEPs.
But per PCIe r5.0, sec 7.9.10.2, "Association Bitmap for RCiEPs", the 32-bit bitmap contains one bit per device. That bit applies to all functions of the device.
Fix rcec_assoc_rciep() to convert the value of "rciep->devfn" to a device number to ensure that RCiEP devices are correctly associated with the RCEC.
--- drivers/pci/pcie/rcec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/pcie/rcec.c +1 -1
@@ -32,7 +32,7 @@ static bool rcec_assoc_rciep(struct pci_dev *rcec, struct pci_dev *rciep)/* Same bus, so check bitmap */ for_each_set_bit (devn, &bitmap,32 ) -if (devn == rciep->devfn) +if (devn ==PCI_SLOT (rciep->devfn))return true;return false;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 135/363 PCI: Release OF node in pci_scan_device()s error path
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit c99e755a4a4c165cad6effb39faffd0f3377c02d ]
In pci_scan_device(), if pci_setup_device() fails for any reason, the code will not release device's of_node by calling pci_release_of_node(). Fix that by calling the release function.
--- drivers/pci/probe.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/probe.c +1 -0
@@ -2353,6 +2353,7 @@ static struct pci_dev *pci_scan_device(struct pci_bus *bus, int devfn)pci_set_of_node (dev);if (pci_setup_device (dev)) { +pci_release_of_node (dev);pci_bus_put (dev->bus);kfree (dev);return NULL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 136/363 ARM: 9064/1: hw_breakpoint: Do not directly check the events overflow_handler hook
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit a506bd5756290821a4314f502b4bafc2afcf5260 ]
The commit 1879445dfa7b ("perf/core: Set event's default ::overflow_handler()") set a default event->overflow_handler in perf_event_alloc(), and replace the check event->overflow_handler with is_default_overflow_handler(), but one is missing.
Currently, the bp->overflow_handler can not be NULL. As a result, enable_single_step() is always not invoked.
Comments from Zhen Lei:
https://patchwork.kernel.org/project/linux-arm-kernel/patch/[email protected]/
--- arch/arm/kernel/hw_breakpoint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/kernel/hw_breakpoint.c +1 -1
@@ -886,7 +886,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs) info->trigger = addr;pr_debug ("breakpoint fired: address = 0x%x\n" , addr);perf_bp_event (bp, regs); -if (!bp->overflow_handler) +if (is_default_overflow_handler (bp))enable_single_step (bp, addr); goto unlock; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 137/363 f2fs: fix to align to section for fallocate() on pinned file
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit e1175f02291141bbd924fc578299305fcde35855 ]
Now, fallocate() on a pinned file only allocates blocks which aligns to segment rather than section, so GC may try to migrate pinned file's block, and after several times of failure, pinned file's block could be migrated to other place, however user won't be aware of such condition, and then old obsolete block address may be readed/written incorrectly.
To avoid such condition, let's try to allocate pinned file's blocks with section alignment.
--- fs/f2fs/f2fs.h | 2 +- fs/f2fs/file.c | 19 +++++++++---------- fs/f2fs/segment.c | 34 ++++++++++++++++++++++++++-------- 3 files changed, 36 insertions(+), 19 deletions(-)
fs/f2fs/f2fs.h +1 -1
@@ -3383,7 +3383,7 @@ void f2fs_get_new_segment(struct f2fs_sb_info *sbi, unsigned int *newseg, bool new_sec, int dir);void f2fs_allocate_segment_for_resize (struct f2fs_sb_info *sbi,int type,unsigned int start,unsigned int end); -void f2fs_allocate_new_segment (struct f2fs_sb_info *sbi,int type); +void f2fs_allocate_new_section (struct f2fs_sb_info *sbi,int type);void f2fs_allocate_new_segments (struct f2fs_sb_info *sbi);int f2fs_trim_fs (struct f2fs_sb_info *sbi,struct fstrim_range *range); bool f2fs_exist_trim_candidates(struct f2fs_sb_info *sbi,
fs/f2fs/file.c +9 -10
@@ -1646,27 +1646,26 @@ static int expand_inode_data(struct inode *inode, loff_t offset,return 0 ;if (f2fs_is_pinned_file (inode)) { -block_t len = (map.m_len >> sbi->log_blocks_per_seg) << - sbi->log_blocks_per_seg; +block_t sec_blks =BLKS_PER_SEC (sbi); +block_t sec_len =roundup (map.m_len, sec_blks);block_t done =0 ; -if (map.m_len % sbi->blocks_per_seg) - len += sbi->blocks_per_seg; - - map.m_len = sbi->blocks_per_seg; + map.m_len = sec_blks; next_alloc:if (has_not_enough_free_secs (sbi,0 ,GET_SEC_FROM_SEG (sbi,overprovision_segments (sbi)))) {down_write (&sbi->gc_lock); err =f2fs_gc (sbi, true, false, false,NULL_SEGNO ); -if (err && err != -ENODATA && err != -EAGAIN ) +if (err && err != -ENODATA && err != -EAGAIN ) { + map.m_len = done; goto out_err; + } }down_write (&sbi->pin_sem);f2fs_lock_op (sbi); -f2fs_allocate_new_segment (sbi,CURSEG_COLD_DATA_PINNED ); +f2fs_allocate_new_section (sbi,CURSEG_COLD_DATA_PINNED );f2fs_unlock_op (sbi); map.m_seg_type =CURSEG_COLD_DATA_PINNED ;
@@ -1675,9 +1674,9 @@ next_alloc:up_write (&sbi->pin_sem); done += map.m_len; - len -= map.m_len; + sec_len -= map.m_len; map.m_lblk += map.m_len; -if (!err && len) +if (!err && sec_len) goto next_alloc; map.m_len = done;
fs/f2fs/segment.c +26 -8
@@ -2893,7 +2893,8 @@ unlock:up_read (&SM_I (sbi)->curseg_lock); } -static void __allocate_new_segment (struct f2fs_sb_info *sbi,int type) +static void __allocate_new_segment (struct f2fs_sb_info *sbi,int type, +bool new_sec) {struct curseg_info *curseg =CURSEG_I (sbi, type);unsigned int old_segno;
@@ -2901,10 +2902,22 @@ static void __allocate_new_segment(struct f2fs_sb_info *sbi, int type)if (!curseg->inited) goto alloc; -if (!curseg->next_blkoff && - !get_valid_blocks (sbi, curseg->segno, false) && - !get_ckpt_valid_blocks (sbi, curseg->segno)) -return ; +if (curseg->next_blkoff || +get_valid_blocks (sbi, curseg->segno, new_sec)) + goto alloc; + +if (new_sec) { +unsigned int segno =START_SEGNO (curseg->segno); +int i; + +for (i =0 ; i < sbi->segs_per_sec; i++, segno++) { +if (get_ckpt_valid_blocks (sbi, segno)) + goto alloc; + } + }else { +if (!get_ckpt_valid_blocks (sbi, curseg->segno)) +return ; + } alloc: old_segno = curseg->segno;
@@ -2912,10 +2925,15 @@ alloc:locate_dirty_segment (sbi, old_segno); } -void f2fs_allocate_new_segment (struct f2fs_sb_info *sbi,int type) +static void __allocate_new_section (struct f2fs_sb_info *sbi,int type) +{ +__allocate_new_segment (sbi, type, true); +} + +void f2fs_allocate_new_section (struct f2fs_sb_info *sbi,int type) {down_write (&SIT_I (sbi)->sentry_lock); -__allocate_new_segment (sbi, type); +__allocate_new_section (sbi, type);up_write (&SIT_I (sbi)->sentry_lock); }
@@ -2925,7 +2943,7 @@ void f2fs_allocate_new_segments(struct f2fs_sb_info *sbi)down_write (&SIT_I (sbi)->sentry_lock);for (i =CURSEG_HOT_DATA ; i <=CURSEG_COLD_DATA ; i++) -__allocate_new_segment (sbi, i); +__allocate_new_segment (sbi, i, false);up_write (&SIT_I (sbi)->sentry_lock); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 106/363 crypto: ccp: Free SEV device if SEV init fails
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit b61a9071dc72a3c709192c0c00ab87c2b3de1d94 ]
Free the SEV device if later initialization fails. The memory isn't technically leaked as it's tracked in the top-level device's devres list, but unless the top-level device is removed, the memory won't be freed and is effectively leaked.
Message-Id: <[email protected]>
--- drivers/crypto/ccp/sev-dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/crypto/ccp/sev-dev.c +3 -1
@@ -990,7 +990,7 @@ int sev_dev_init(struct psp_device *psp)if (!sev->vdata) { ret = -ENODEV ;dev_err (dev,"sev: missing driver data\n" ); - goto e_err; + goto e_sev; }psp_set_sev_irq_handler (psp, sev_irq_handler, sev);
@@ -1005,6 +1005,8 @@ int sev_dev_init(struct psp_device *psp) e_irq:psp_clear_sev_irq_handler (psp); +e_sev: +devm_kfree (dev, sev); e_err: psp->sev_data =NULL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 105/363 mt76: mt7615: fix entering driver-own state on mt7663
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 5c7d374444afdeb9dd534a37c4f6c13af032da0c ]
Fixes hardware wakeup issues
--- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +10 -2
@@ -291,12 +291,20 @@ static int mt7615_mcu_drv_pmctrl(struct mt7615_dev *dev)u32 addr;int err; - addr =is_mt7663 (mdev) ?MT_PCIE_DOORBELL_PUSH :MT_CFG_LPCR_HOST ; +if (is_mt7663 (mdev)) { +/* Clear firmware own via N9 eint */ +mt76_wr (dev,MT_PCIE_DOORBELL_PUSH ,MT_CFG_LPCR_HOST_DRV_OWN ); +mt76_poll (dev,MT_CONN_ON_MISC ,MT_CFG_LPCR_HOST_FW_OWN ,0 ,3000 ); + + addr =MT_CONN_HIF_ON_LPCTL ; + }else { + addr =MT_CFG_LPCR_HOST ; + } +mt76_wr (dev, addr,MT_CFG_LPCR_HOST_DRV_OWN );mt7622_trigger_hif_int (dev, true); - addr =is_mt7663 (mdev) ?MT_CONN_HIF_ON_LPCTL :MT_CFG_LPCR_HOST ; err = !mt76_poll_msec (dev, addr,MT_CFG_LPCR_HOST_FW_OWN ,0 ,3000 );mt7622_trigger_hif_int (dev, false);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 107/363 wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 820aa37638a252b57967bdf4038a514b1ab85d45 ]
Fix the following out-of-bounds warnings by enclosing structure members daddr and saddr into new struct addr, in structures wl3501_md_req and wl3501_md_ind:
arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds]
Refactor the code, accordingly:
$ pahole -C wl3501_md_req drivers/net/wireless/wl3501_cs.o
struct wl3501_md_req {
u16 next_blk; /* 0 2 */
u8 sig_id; /* 2 1 */
u8 routing; /* 3 1 */
u16 data; /* 4 2 */
u16 size; /* 6 2 */
u8 pri; /* 8 1 */
u8 service_class; /* 9 1 */
struct {
u8 daddr[6]; /* 10 6 */
u8 saddr[6]; /* 16 6 */
} addr; /* 10 12 *//* size: 22, cachelines: 1, members: 8 */ /* last cacheline: 22 bytes */ };
$ pahole -C wl3501_md_ind drivers/net/wireless/wl3501_cs.o
struct wl3501_md_ind {
u16 next_blk; /* 0 2 */
u8 sig_id; /* 2 1 */
u8 routing; /* 3 1 */
u16 data; /* 4 2 */
u16 size; /* 6 2 */
u8 reception; /* 8 1 */
u8 pri; /* 9 1 */
u8 service_class; /* 10 1 */
struct {
u8 daddr[6]; /* 11 6 */
u8 saddr[6]; /* 17 6 */
} addr; /* 11 12 *//* size: 24, cachelines: 1, members: 9 */ /* padding: 1 */ /* last cacheline: 24 bytes */ };
The problem is that the original code is trying to copy data into a couple of arrays adjacent to each other in a single call to memcpy(). Now that a new struct _addr_ enclosing those two adjacent arrays is introduced, memcpy() doesn't overrun the length of &sig.daddr[0] and &sig.daddr, because the address of the new struct object _addr_ is used, instead.
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- drivers/net/wireless/wl3501.h | 12 ++++++++---- drivers/net/wireless/wl3501_cs.c | 10 ++++++---- 2 files changed, 14 insertions(+), 8 deletions(-)
drivers/net/wireless/wl3501.h +8 -4
@@ -471,8 +471,10 @@ struct wl3501_md_req {u16 size;u8 pri;u8 service_class; -u8 daddr[ETH_ALEN ]; -u8 saddr[ETH_ALEN ]; +struct { +u8 daddr[ETH_ALEN ]; +u8 saddr[ETH_ALEN ]; + } addr; };struct wl3501_md_ind {
@@ -484,8 +486,10 @@ struct wl3501_md_ind {u8 reception;u8 pri;u8 service_class; -u8 daddr[ETH_ALEN ]; -u8 saddr[ETH_ALEN ]; +struct { +u8 daddr[ETH_ALEN ]; +u8 saddr[ETH_ALEN ]; + } addr; };struct wl3501_md_confirm {
drivers/net/wireless/wl3501_cs.c +6 -4
@@ -469,6 +469,7 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)struct wl3501_md_req sig = { .sig_id =WL3501_SIG_MD_REQ , }; +size_t sig_addr_len =sizeof (sig.addr);u8 *pdata = (char *)data;int rc = -EIO ;
@@ -484,9 +485,9 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) goto out; } rc =0 ; -memcpy (&sig.daddr[0 ], pdata,12 ); - pktlen = len -12 ; - pdata +=12 ; +memcpy (&sig.addr, pdata, sig_addr_len); + pktlen = len - sig_addr_len; + pdata += sig_addr_len; sig.data = bf;if (((*pdata) *256 + (*(pdata +1 ))) >1500 ) {u8 addr4[ETH_ALEN ] = {
@@ -980,7 +981,8 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev, }else { skb->dev = dev;skb_reserve (skb,2 );/* IP headers on 16 bytes boundaries */ -skb_copy_to_linear_data (skb, (unsigned char *)&sig.daddr,12 ); +skb_copy_to_linear_data (skb, (unsigned char *)&sig.addr, +sizeof (sig.addr));wl3501_receive (this, skb->data, pkt_len);skb_put (skb, pkt_len); skb->protocol =eth_type_trans (skb, dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 108/363 wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit bb43e5718d8f1b46e7a77e7b39be3c691f293050 ]
Fix the following out-of-bounds warnings by adding a new structure wl3501_req instead of duplicating the same members in structure wl3501_join_req and wl3501_scan_confirm:
arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [39, 108] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 36 [-Warray-bounds] arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [25, 95] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 22 [-Warray-bounds]
Refactor the code, accordingly:
$ pahole -C wl3501_req drivers/net/wireless/wl3501_cs.o
struct wl3501_req {
u16 beacon_period; /* 0 2 */
u16 dtim_period; /* 2 2 */
u16 cap_info; /* 4 2 */
u8 bss_type; /* 6 1 */
u8 bssid[6]; /* 7 6 */
struct iw_mgmt_essid_pset ssid; /* 13 34 */
struct iw_mgmt_ds_pset ds_pset; /* 47 3 */
struct iw_mgmt_cf_pset cf_pset; /* 50 8 */
struct iw_mgmt_ibss_pset ibss_pset; /* 58 4 */
struct iw_mgmt_data_rset bss_basic_rset; /* 62 10 */ /* size: 72, cachelines: 2, members: 10 */
/* last cacheline: 8 bytes */
};$ pahole -C wl3501_join_req drivers/net/wireless/wl3501_cs.o
struct wl3501_join_req {
u16 next_blk; /* 0 2 */
u8 sig_id; /* 2 1 */
u8 reserved; /* 3 1 */
struct iw_mgmt_data_rset operational_rset; /* 4 10 */
u16 reserved2; /* 14 2 */
u16 timeout; /* 16 2 */
u16 probe_delay; /* 18 2 */
u8 timestamp[8]; /* 20 8 */
u8 local_time[8]; /* 28 8 */
struct wl3501_req req; /* 36 72 */ /* size: 108, cachelines: 2, members: 10 */
/* last cacheline: 44 bytes */
};$ pahole -C wl3501_scan_confirm drivers/net/wireless/wl3501_cs.o
struct wl3501_scan_confirm {
u16 next_blk; /* 0 2 */
u8 sig_id; /* 2 1 */
u8 reserved; /* 3 1 */
u16 status; /* 4 2 */
char timestamp[8]; /* 6 8 */
char localtime[8]; /* 14 8 */
struct wl3501_req req; /* 22 72 */
/* --- cacheline 1 boundary (64 bytes) was 30 bytes ago --- */
u8 rssi; /* 94 1 */ /* size: 96, cachelines: 2, members: 8 */
/* padding: 1 */
/* last cacheline: 32 bytes */
};The problem is that the original code is trying to copy data into a bunch of struct members adjacent to each other in a single call to memcpy(). Now that a new struct wl3501_req enclosing all those adjacent members is introduced, memcpy() doesn't overrun the length of &sig.beacon_period and &this->bss_set[i].beacon_period, because the address of the new struct object _req_ is used as the destination, instead.
This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy().
--- drivers/net/wireless/wl3501.h | 35 +++++++++++-------------- drivers/net/wireless/wl3501_cs.c | 44 +++++++++++++++++--------------- 2 files changed, 38 insertions(+), 41 deletions(-)
drivers/net/wireless/wl3501.h +15 -20
@@ -379,16 +379,7 @@ struct wl3501_get_confirm {u8 mib_value[100 ]; }; -struct wl3501_join_req { -u16 next_blk; -u8 sig_id; -u8 reserved; -struct iw_mgmt_data_rset operational_rset; -u16 reserved2; -u16 timeout; -u16 probe_delay; -u8 timestamp[8 ]; -u8 local_time[8 ]; +struct wl3501_req {u16 beacon_period;u16 dtim_period;u16 cap_info;
@@ -401,6 +392,19 @@ struct wl3501_join_req {struct iw_mgmt_data_rset bss_basic_rset; }; +struct wl3501_join_req { +u16 next_blk; +u8 sig_id; +u8 reserved; +struct iw_mgmt_data_rset operational_rset; +u16 reserved2; +u16 timeout; +u16 probe_delay; +u8 timestamp[8 ]; +u8 local_time[8 ]; +struct wl3501_req req; +}; +struct wl3501_join_confirm {u16 next_blk;u8 sig_id;
@@ -443,16 +447,7 @@ struct wl3501_scan_confirm {u16 status;char timestamp[8 ];char localtime[8 ]; -u16 beacon_period; -u16 dtim_period; -u16 cap_info; -u8 bss_type; -u8 bssid[ETH_ALEN ]; -struct iw_mgmt_essid_pset ssid; -struct iw_mgmt_ds_pset ds_pset; -struct iw_mgmt_cf_pset cf_pset; -struct iw_mgmt_ibss_pset ibss_pset; -struct iw_mgmt_data_rset bss_basic_rset; +struct wl3501_req req;u8 rssi; };
drivers/net/wireless/wl3501_cs.c +23 -21
121 lines not on this page · raw message
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 109/363 qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth
In reply to Greg Kroah-HartmanFrom: Lee Gibson <[email protected]>
[ Upstream commit 130f634da1af649205f4a3dd86cbe5c126b57914 ]
Function qtnf_event_handle_external_auth calls memcpy without checking the length.
A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed size.
--- drivers/net/wireless/quantenna/qtnfmac/event.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/quantenna/qtnfmac/event.c +4 -2
@@ -570,8 +570,10 @@ qtnf_event_handle_external_auth(struct qtnf_vif *vif,return 0 ;if (ev->ssid_len) { -memcpy (auth.ssid.ssid, ev->ssid, ev->ssid_len); - auth.ssid.ssid_len = ev->ssid_len; +int len =clamp_val (ev->ssid_len,0 ,IEEE80211_MAX_SSID_LEN ); + +memcpy (auth.ssid.ssid, ev->ssid, len); + auth.ssid.ssid_len = len; } auth.key_mgmt_suite =le32_to_cpu (ev->akm_suite);
Signature · 1 line
2.30.2