5.10.170-rc1 review
Greg Kroah-Hartman
maintainerPATCH 1/25 drm/etnaviv: dont truncate physical page address
In reply to Greg Kroah-HartmanFrom: Lucas Stach <[email protected]>
[ Upstream commit d37c120b73128690434cc093952439eef9d56af1 ]
While the interface for the MMU mapping takes phys_addr_t to hold a full 64bit address when necessary and MMUv2 is able to map physical addresses with up to 40bit, etnaviv_iommu_map() truncates the address to 32bits. Fix this by using the correct type.
--- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_mmu.c +2 -2
@@ -80,10 +80,10 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova,return -EINVAL ;for_each_sgtable_dma_sg (sgt, sg, i) { -u32 pa =sg_dma_address (sg) - sg->offset; +phys_addr_t pa =sg_dma_address (sg) - sg->offset;size_t bytes =sg_dma_len (sg) + sg->offset; -VERB ("map[%d]: %08x %08x(%zx)" , i, iova, pa, bytes); +VERB ("map[%d]: %08x %pap(%zx)" , i, iova, &pa, bytes); ret =etnaviv_context_map (context, da, pa, bytes, prot);if (ret)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 2/25 wifi: rtl8xxxu: gen2: Turn on the rate control
In reply to Greg Kroah-HartmanFrom: Bitterblue Smith <[email protected]>
[ Upstream commit 791082ec0ab843e0be07c8ce3678e4c2afd2e33d ]
Re-enable the function rtl8xxxu_gen2_report_connect.
It informs the firmware when connecting to a network. This makes the firmware enable the rate control, which makes the upload faster.
It also informs the firmware when disconnecting from a network. In the past this made reconnecting impossible because it was sending the auth on queue 0x7 (TXDESC_QUEUE_VO) instead of queue 0x12 (TXDESC_QUEUE_MGNT):
wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 1/3)
wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 2/3)
wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 3/3)
wlp0s20f0u3: authentication with 90:55:de:__:__:__ timed out
Probably the firmware disables the unnecessary TX queues when it knows it's disconnected.
However, this was fixed in commit edd5747aa12e ("wifi: rtl8xxxu: Fix skb misuse in TX queue selection").
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +2 -6
@@ -4369,12 +4369,9 @@ void rtl8xxxu_gen1_report_connect(struct rtl8xxxu_priv *priv,void rtl8xxxu_gen2_report_connect (struct rtl8xxxu_priv *priv,u8 macid,bool connect) { -#ifdef RTL8XXXU_GEN2_REPORT_CONNECT /* -* Barry Day reports this causes issues with 8192eu and 8723bu -* devices reconnecting. The reason for this is unclear, but -* until it is better understood, leave the code in place but -* disabled, so it is not lost. +* The firmware turns on the rate control when it knows it's +* connected to a network. */ struct h2c_cmd h2c;
@@ -4387,7 +4384,6 @@ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv, h2c.media_status_rpt.parm &= ~BIT (0 );rtl8xxxu_gen2_h2c_cmd (priv, &h2c,sizeof (h2c.media_status_rpt)); -#endif }void rtl8xxxu_gen1_init_aggregation (struct rtl8xxxu_priv *priv)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 3/25 clk: mxl: Switch from direct readl/writel based IO to regmap based IO
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit 036177310bac5534de44ff6a7b60a4d2c0b6567c ]
Earlier version of driver used direct io remapped register read writes using readl/writel. But we need secure boot access which is only possible when registers are read & written using regmap. This is because the security bus/hook is written & coupled only with regmap layer.
Switch the driver from direct readl/writel based register accesses to regmap based register accesses.
Additionally, update the license headers to latest status.
Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags")
--- drivers/clk/x86/Kconfig | 5 +++-- drivers/clk/x86/clk-cgu-pll.c | 10 +++++---- drivers/clk/x86/clk-cgu.c | 5 +++-- drivers/clk/x86/clk-cgu.h | 38 +++++++++++++++++++---------------- drivers/clk/x86/clk-lgm.c | 13 ++++++++---- 5 files changed, 42 insertions(+), 29 deletions(-)
drivers/clk/x86/Kconfig +3 -2
@@ -1,8 +1,9 @@ # SPDX-License-Identifier: GPL-2.0-only config CLK_LGM_CGU depends on OF && HAS_IOMEM && (X86 || COMPILE_TEST) + select MFD_SYSCON select OF_EARLY_FLATTREE bool "Clock driver for Lightning Mountain(LGM) platform" help - Clock Generation Unit(CGU) driver for Intel Lightning Mountain(LGM) - network processor SoC. + Clock Generation Unit(CGU) driver for MaxLinear's x86 based + Lightning Mountain(LGM) network processor SoC.
drivers/clk/x86/clk-cgu-pll.c +6 -4
@@ -1,8 +1,9 @@// SPDX-License-Identifier: GPL-2.0 /* +* Copyright (C) 2020-2022 MaxLinear, Inc. * Copyright (C) 2020 Intel Corporation. -* Zhu YiXin <[email protected]> -* Rahul Tanwar <[email protected]> +* Zhu Yixin <[email protected]> +* Rahul Tanwar <[email protected]> */ #include <linux/clk-provider.h>
@@ -76,8 +77,9 @@ static int lgm_pll_enable(struct clk_hw *hw)spin_lock_irqsave (&pll->lock, flags);lgm_set_clk_val (pll->membase, pll->reg,0 ,1 ,1 ); - ret =readl_poll_timeout_atomic (pll->membase + pll->reg, - val, (val &0x1 ),1 ,100 ); + ret =regmap_read_poll_timeout_atomic (pll->membase, pll->reg, + val, (val &0x1 ),1 ,100 ); +spin_unlock_irqrestore (&pll->lock, flags);return ret;
drivers/clk/x86/clk-cgu.c +3 -2
@@ -1,8 +1,9 @@// SPDX-License-Identifier: GPL-2.0 /* +* Copyright (C) 2020-2022 MaxLinear, Inc. * Copyright (C) 2020 Intel Corporation. -* Zhu YiXin <[email protected]> -* Rahul Tanwar <[email protected]> +* Zhu Yixin <[email protected]> +* Rahul Tanwar <[email protected]> */ #include <linux/clk-provider.h> #include <linux/device.h>
drivers/clk/x86/clk-cgu.h +21 -17
@@ -1,18 +1,19 @@/* SPDX-License-Identifier: GPL-2.0 */ /* -* Copyright(c) 2020 Intel Corporation. -* Zhu YiXin <[email protected]> -* Rahul Tanwar <[email protected]> +* Copyright (C) 2020-2022 MaxLinear, Inc. +* Copyright (C) 2020 Intel Corporation. +* Zhu Yixin <[email protected]> +* Rahul Tanwar <[email protected]> */ #ifndef __CLK_CGU_H #define __CLK_CGU_H -#include <linux/io.h> +#include <linux/regmap.h> struct lgm_clk_mux { struct clk_hw hw; - void __iomem *membase; + struct regmap *membase; unsigned int reg; u8 shift; u8 width;
@@ -22,7 +23,7 @@ struct lgm_clk_mux {struct lgm_clk_divider {struct clk_hw hw; -void __iomem *membase; +struct regmap *membase;unsigned int reg;u8 shift;u8 width;
@@ -35,7 +36,7 @@ struct lgm_clk_divider {struct lgm_clk_ddiv {struct clk_hw hw; -void __iomem *membase; +struct regmap *membase;unsigned int reg;u8 shift0;u8 width0;
@@ -53,7 +54,7 @@ struct lgm_clk_ddiv {struct lgm_clk_gate {struct clk_hw hw; -void __iomem *membase; +struct regmap *membase;unsigned int reg;u8 shift;unsigned long flags;
@@ -77,7 +78,7 @@ enum lgm_clk_type {* @clk_data: array of hw clocks and clk number. */ struct lgm_clk_provider { -void __iomem *membase; +struct regmap *membase;struct device_node *np;struct device *dev;struct clk_hw_onecell_data clk_data;
@@ -92,7 +93,7 @@ enum pll_type {struct lgm_clk_pll {struct clk_hw hw; -void __iomem *membase; +struct regmap *membase;unsigned int reg;unsigned long flags;enum pll_type type;
@@ -300,29 +301,32 @@ struct lgm_clk_branch { .div = _d, \ } -static inline void lgm_set_clk_val (void __iomem *membase,u32 reg, +static inline void lgm_set_clk_val (struct regmap *membase,u32 reg,u8 shift,u8 width,u32 set_val) {u32 mask = (GENMASK (width -1 ,0 ) << shift); -u32 regval; - regval =readl (membase + reg); - regval = (regval & ~mask) | ((set_val << shift) & mask); -writel (regval, membase + reg); +regmap_update_bits (membase, reg, mask, set_val << shift); } -static inline u32 lgm_get_clk_val (void __iomem *membase,u32 reg, +static inline u32 lgm_get_clk_val (struct regmap *membase,u32 reg,u8 shift,u8 width) {u32 mask = (GENMASK (width -1 ,0 ) << shift);u32 val; - val =readl (membase + reg); +if (regmap_read (membase, reg, &val)) { +WARN_ONCE (1 ,"Failed to read clk reg: 0x%x\n" , reg); +return 0 ; + } + val = (val & mask) >> shift;return val; } + +int lgm_clk_register_branches (struct lgm_clk_provider *ctx,const struct lgm_clk_branch *list,unsigned int nr_clk);
drivers/clk/x86/clk-lgm.c +9 -4
@@ -1,10 +1,12 @@// SPDX-License-Identifier: GPL-2.0 /* +* Copyright (C) 2020-2022 MaxLinear, Inc. * Copyright (C) 2020 Intel Corporation. -* Zhu YiXin <[email protected]> -* Rahul Tanwar <[email protected]> +* Zhu Yixin <[email protected]> +* Rahul Tanwar <[email protected]> */ #include <linux/clk-provider.h> +#include <linux/mfd/syscon.h> #include <linux/of.h> #include <linux/platform_device.h> #include <dt-bindings/clock/intel,lgm-clk.h>
@@ -433,9 +435,12 @@ static int lgm_cgu_probe(struct platform_device *pdev) ctx->clk_data.num =CLK_NR_CLKS ; - ctx->membase =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (ctx->membase)) + ctx->membase =syscon_node_to_regmap (np); +if (IS_ERR_OR_NULL (ctx->membase)) { +dev_err (dev,"Failed to get clk CGU iomem\n" );return PTR_ERR (ctx->membase); + } + ctx->np = np; ctx->dev = dev;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 4/25 clk: mxl: Remove redundant spinlocks
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit eaabee88a88a26b108be8d120fc072dfaf462cef ]
Patch 1/4 of this patch series switches from direct readl/writel based register access to regmap based register access. Instead of using direct readl/writel, regmap API's are used to read, write & read-modify-write clk registers. Regmap API's already use their own spinlocks to serialize the register accesses across multiple cores in which case additional driver spinlocks becomes redundant.
Hence, remove redundant spinlocks from driver in this patch 2/4.
Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags")
--- drivers/clk/x86/clk-cgu-pll.c | 13 ------ drivers/clk/x86/clk-cgu.c | 80 ++++------------------------------- drivers/clk/x86/clk-cgu.h | 6 --- drivers/clk/x86/clk-lgm.c | 1 - 4 files changed, 9 insertions(+), 91 deletions(-)
drivers/clk/x86/clk-cgu-pll.c +0 -13
@@ -41,13 +41,10 @@ static unsigned long lgm_pll_recalc_rate(struct clk_hw *hw, unsigned long prate) {struct lgm_clk_pll *pll =to_lgm_clk_pll (hw);unsigned int div, mult, frac; -unsigned long flags; -spin_lock_irqsave (&pll->lock, flags); mult =lgm_get_clk_val (pll->membase,PLL_REF_DIV (pll->reg),0 ,12 ); div =lgm_get_clk_val (pll->membase,PLL_REF_DIV (pll->reg),18 ,6 ); frac =lgm_get_clk_val (pll->membase, pll->reg,2 ,24 ); -spin_unlock_irqrestore (&pll->lock, flags);if (pll->type ==TYPE_LJPLL ) div *=4 ;
@@ -58,12 +55,9 @@ static unsigned long lgm_pll_recalc_rate(struct clk_hw *hw, unsigned long prate)static int lgm_pll_is_enabled (struct clk_hw *hw) {struct lgm_clk_pll *pll =to_lgm_clk_pll (hw); -unsigned long flags;unsigned int ret; -spin_lock_irqsave (&pll->lock, flags); ret =lgm_get_clk_val (pll->membase, pll->reg,0 ,1 ); -spin_unlock_irqrestore (&pll->lock, flags);return ret; }
@@ -71,16 +65,13 @@ static int lgm_pll_is_enabled(struct clk_hw *hw)static int lgm_pll_enable (struct clk_hw *hw) {struct lgm_clk_pll *pll =to_lgm_clk_pll (hw); -unsigned long flags;u32 val;int ret; -spin_lock_irqsave (&pll->lock, flags);lgm_set_clk_val (pll->membase, pll->reg,0 ,1 ,1 ); ret =regmap_read_poll_timeout_atomic (pll->membase, pll->reg, val, (val &0x1 ),1 ,100 ); -spin_unlock_irqrestore (&pll->lock, flags);return ret; }
@@ -88,11 +79,8 @@ static int lgm_pll_enable(struct clk_hw *hw)static void lgm_pll_disable (struct clk_hw *hw) {struct lgm_clk_pll *pll =to_lgm_clk_pll (hw); -unsigned long flags; -spin_lock_irqsave (&pll->lock, flags);lgm_set_clk_val (pll->membase, pll->reg,0 ,1 ,0 ); -spin_unlock_irqrestore (&pll->lock, flags); }static const struct clk_ops lgm_pll_ops = {
@@ -123,7 +111,6 @@ lgm_clk_register_pll(struct lgm_clk_provider *ctx,return ERR_PTR (-ENOMEM ); pll->membase = ctx->membase; - pll->lock = ctx->lock; pll->reg = list->reg; pll->flags = list->flags; pll->type = list->type;
drivers/clk/x86/clk-cgu.c +9 -71
321 lines not on this page · raw message
drivers/clk/x86/clk-cgu.h +0 -6
@@ -18,7 +18,6 @@ struct lgm_clk_mux {u8 shift;u8 width;unsigned long flags; -spinlock_t lock; };struct lgm_clk_divider {
@@ -31,7 +30,6 @@ struct lgm_clk_divider {u8 width_gate;unsigned long flags;const struct clk_div_table *table; -spinlock_t lock; };struct lgm_clk_ddiv {
@@ -49,7 +47,6 @@ struct lgm_clk_ddiv {unsigned int mult;unsigned int div;unsigned long flags; -spinlock_t lock; };struct lgm_clk_gate {
@@ -58,7 +55,6 @@ struct lgm_clk_gate {unsigned int reg;u8 shift;unsigned long flags; -spinlock_t lock; };enum lgm_clk_type {
@@ -82,7 +78,6 @@ struct lgm_clk_provider {struct device_node *np;struct device *dev;struct clk_hw_onecell_data clk_data; -spinlock_t lock; };enum pll_type {
@@ -97,7 +92,6 @@ struct lgm_clk_pll {unsigned int reg;unsigned long flags;enum pll_type type; -spinlock_t lock; };/**
drivers/clk/x86/clk-lgm.c +0 -1
@@ -444,7 +444,6 @@ static int lgm_cgu_probe(struct platform_device *pdev) ctx->np = np; ctx->dev = dev; -spin_lock_init (&ctx->lock); ret =lgm_clk_register_plls (ctx, lgm_pll_clks,ARRAY_SIZE (lgm_pll_clks));
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainercover 5.10.170-rc1 review
This is the start of the stable review cycle for the 5.10.170 release. There are 25 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 25 Feb 2023 13:04:16 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.170-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.170-rc1
Vladimir Oltean <[email protected]>
Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs"
Kees Cook <[email protected]>
ext4: Fix function prototype mismatch for ext4_feat_ktype
Paul Moore <[email protected]>
audit: update the mailing list in MAINTAINERS
Lukas Wunner <[email protected]>
wifi: mwifiex: Add missing compatible string for SD8787
Zhang Wensheng <[email protected]>
nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
Yu Kuai <[email protected]>
nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
Yu Kuai <[email protected]>
nbd: fix max value for 'first_minor'
Wen Yang <[email protected]>
Revert "Revert "block: nbd: add sanity check for first_minor""
Dave Hansen <[email protected]>
uaccess: Add speculation barrier to copy_from_user()
Pavel Skripkin <[email protected]>
mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
Zheng Wang <[email protected]>
drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Sean Anderson <[email protected]>
powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
Marc Kleine-Budde <[email protected]>
can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
Jim Mattson <[email protected]>
KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
Sean Christopherson <[email protected]>
KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid
Sean Christopherson <[email protected]>
KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
Jason A. Donenfeld <[email protected]>
random: always mix cycle counter in add_latent_entropy()
Rahul Tanwar <[email protected]>
clk: mxl: syscon_node_to_regmap() returns error pointers
Sean Anderson <[email protected]>
powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
Rahul Tanwar <[email protected]>
clk: mxl: Fix a clk entry by adding relevant flags
Rahul Tanwar <[email protected]>
clk: mxl: Add option to override gate clks
Rahul Tanwar <[email protected]>
clk: mxl: Remove redundant spinlocks
Rahul Tanwar <[email protected]>
clk: mxl: Switch from direct readl/writel based IO to regmap based IO
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: gen2: Turn on the rate control
Lucas Stach <[email protected]>
drm/etnaviv: don't truncate physical page address
-------------
Diffstat:
MAINTAINERS | 2 +- Makefile | 4 +- arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi | 44 +++++++++ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi | 44 +++++++++ arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 20 +++- arch/x86/kvm/svm/svm.c | 10 +- arch/x86/kvm/vmx/nested.c | 11 +++ arch/x86/kvm/vmx/vmx.c | 6 +- arch/x86/kvm/x86.c | 4 +- drivers/block/nbd.c | 13 ++- drivers/clk/x86/Kconfig | 5 +- drivers/clk/x86/clk-cgu-pll.c | 23 ++--- drivers/clk/x86/clk-cgu.c | 106 ++++++--------------- drivers/clk/x86/clk-cgu.h | 46 ++++----- drivers/clk/x86/clk-lgm.c | 18 ++-- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 +- drivers/gpu/drm/i915/gvt/gtt.c | 17 +++- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 33 +++++-- drivers/net/wireless/marvell/mwifiex/sdio.c | 1 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 +- fs/ext4/sysfs.c | 7 +- include/linux/nospec.h | 4 + include/linux/random.h | 6 +- kernel/bpf/core.c | 2 - lib/usercopy.c | 7 ++ net/mac80211/ieee80211_i.h | 24 ++++- net/mac80211/mesh.h | 22 +---- net/mac80211/mesh_pathtbl.c | 89 ++++++----------- net/sched/sch_taprio.c | 8 +- 29 files changed, 339 insertions(+), 249 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 6/25 clk: mxl: Fix a clk entry by adding relevant flags
From: Rahul Tanwar <[email protected]>
[ Upstream commit 106ef3bda21006fe37b62c85931230a6355d78d3 ]
One of the clock entry "dcl" clk has some HW limitations. One is that its rate can only by changed by changing its parent clk's rate & two is that HW does not support enable/disable for this clk.
Handle above two limitations by adding relevant flags. Add standard flag CLK_SET_RATE_PARENT to handle rate change and add driver internal flag DIV_CLK_NO_MASK to handle enable/disable.
--- drivers/clk/x86/clk-cgu.c | 5 +++-- drivers/clk/x86/clk-cgu.h | 1 + drivers/clk/x86/clk-lgm.c | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-)
drivers/clk/x86/clk-cgu.c +3 -2
@@ -164,8 +164,9 @@ static int lgm_clk_divider_enable_disable(struct clk_hw *hw, int enable) {struct lgm_clk_divider *div =to_lgm_clk_divider (hw); -lgm_set_clk_val (div->membase, div->reg, div->shift_gate, - div->width_gate, enable); +if (div->flags !=DIV_CLK_NO_MASK ) +lgm_set_clk_val (div->membase, div->reg, div->shift_gate, + div->width_gate, enable);return 0 ; }
drivers/clk/x86/clk-cgu.h +1 -0
@@ -198,6 +198,7 @@ struct lgm_clk_branch {#define CLOCK_FLAG_VAL_INIT BIT(16)#define MUX_CLK_SW BIT(17)#define GATE_CLK_HW BIT(18) +#define DIV_CLK_NO_MASK BIT(19)#define LGM_MUX (_id, _name, _pdata, _f, _reg, \ _shift, _width, _cf, _v) \
drivers/clk/x86/clk-lgm.c +2 -2
@@ -255,8 +255,8 @@ static const struct lgm_clk_branch lgm_branch_clks[] = {LGM_FIXED (LGM_CLK_SLIC ,"slic" ,NULL ,0 ,CGU_IF_CLK1 ,8 ,2 ,CLOCK_FLAG_VAL_INIT ,8192000 ,2 ),LGM_FIXED (LGM_CLK_DOCSIS ,"v_docsis" ,NULL ,0 ,0 ,0 ,0 ,0 ,16000000 ,0 ), -LGM_DIV (LGM_CLK_DCL ,"dcl" ,"v_ifclk" ,0 ,CGU_PCMCR , -25 ,3 ,0 ,0 ,0 ,0 , dcl_div), +LGM_DIV (LGM_CLK_DCL ,"dcl" ,"v_ifclk" ,CLK_SET_RATE_PARENT ,CGU_PCMCR , +25 ,3 ,0 ,0 ,DIV_CLK_NO_MASK ,0 , dcl_div),LGM_MUX (LGM_CLK_PCM ,"pcm" , pcm_p,0 ,CGU_C55_PCMCR ,0 ,1 ,CLK_MUX_ROUND_CLOSEST ,0 ), LGM_FIXED_FACTOR(LGM_CLK_DDR_PHY, "ddr_phy", "ddr",
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 15/25 drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
commit 4a61648af68f5ba4884f0e3b494ee1cabc4b6620 upstream.
If intel_gvt_dma_map_guest_page failed, it will call ppgtt_invalidate_spt, which will finally free the spt. But the caller function ppgtt_populate_spt_by_guest_entry does not notice that, it will free spt again in its error path.
Fix this by canceling the mapping of DMA address and freeing sub_spt. Besides, leave the handle of spt destroy to caller function instead of callee function when error occurs.
--- drivers/gpu/drm/i915/gvt/gtt.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gvt/gtt.c +13 -4
@@ -1192,10 +1192,8 @@ static int split_2MB_gtt_entry(struct infor_each_shadow_entry (sub_spt, &sub_se, sub_index) { ret =intel_gvt_hypervisor_dma_map_guest_page (vgpu, start_gfn + sub_index,PAGE_SIZE , &dma_addr); -if (ret) { -ppgtt_invalidate_spt (spt); -return ret; - } +if (ret) + goto err; sub_se.val64 = se->val64;/* Copy the PAT field from PDE. */
@@ -1214,6 +1212,17 @@ static int split_2MB_gtt_entry(struct in ops->set_pfn (se, sub_spt->shadow_page.mfn);ppgtt_set_shadow_entry (spt, se, index);return 0 ; +err: +/* Cancel the existing addess mappings of DMA addr. */ +for_each_present_shadow_entry (sub_spt, &sub_se, sub_index) { +gvt_vdbg_mm ("invalidate 4K entry\n" ); +ppgtt_invalidate_pte (sub_spt, &sub_se); + } +/* Release the new allocated spt. */ +trace_spt_change (sub_spt->vgpu->id,"release" , sub_spt, + sub_spt->guest_page.gfn, sub_spt->shadow_page.type); +ppgtt_free_spt (sub_spt); +return ret; } static int split_64KB_gtt_entry(struct intel_vgpu *vgpu,
Greg Kroah-Hartman
maintainerPATCH 16/25 mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit 8b5cb7e41d9d77ffca036b0239177de123394a55 upstream.
Syzbot hit NULL deref in rhashtable_free_and_destroy(). The problem was in mesh_paths and mpp_paths being NULL.
mesh_pathtbl_init() could fail in case of memory allocation failure, but nobody cared, since ieee80211_mesh_init_sdata() returns void. It led to leaving 2 pointers as NULL. Syzbot has found null deref on exit path, but it could happen anywhere else, because code assumes these pointers are valid.
Since all ieee80211_*_setup_sdata functions are void and do not fail, let's embedd mesh_paths and mpp_paths into parent struct to avoid adding error handling on higher levels and follow the pattern of others setup_sdata functions
--- net/mac80211/ieee80211_i.h | 24 ++++++++++- net/mac80211/mesh.h | 22 ---------- net/mac80211/mesh_pathtbl.c | 91 +++++++++++++++----------------------------- 3 files changed, 55 insertions(+), 82 deletions(-)
net/mac80211/ieee80211_i.h +22 -2
@@ -644,6 +644,26 @@ struct mesh_csa_settings {struct cfg80211_csa_settings settings; }; +/** +* struct mesh_table +* +* @known_gates: list of known mesh gates and their mpaths by the station. The +* gate's mpath may or may not be resolved and active. +* @gates_lock: protects updates to known_gates +* @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr +* @walk_head: linked list containing all mesh_path objects +* @walk_lock: lock protecting walk_head +* @entries: number of entries in the table +*/ +struct mesh_table { +struct hlist_head known_gates; +spinlock_t gates_lock; +struct rhashtable rhead; +struct hlist_head walk_head; +spinlock_t walk_lock; +atomic_t entries;/* Up to MAX_MESH_NEIGHBOURS */ +}; +struct ieee80211_if_mesh {struct timer_list housekeeping_timer;struct timer_list mesh_path_timer;
@@ -718,8 +738,8 @@ struct ieee80211_if_mesh {/* offset from skb->data while building IE */ int meshconf_offset; -struct mesh_table *mesh_paths; -struct mesh_table *mpp_paths;/* Store paths for MPP&MAP */ +struct mesh_table mesh_paths; +struct mesh_table mpp_paths;/* Store paths for MPP&MAP */ int mesh_paths_generation;int mpp_paths_generation; };
net/mac80211/mesh.h +1 -21
@@ -127,26 +127,6 @@ struct mesh_path {u32 path_change_count; }; -/** -* struct mesh_table -* -* @known_gates: list of known mesh gates and their mpaths by the station. The -* gate's mpath may or may not be resolved and active. -* @gates_lock: protects updates to known_gates -* @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr -* @walk_head: linked list containging all mesh_path objects -* @walk_lock: lock protecting walk_head -* @entries: number of entries in the table -*/ -struct mesh_table { -struct hlist_head known_gates; -spinlock_t gates_lock; -struct rhashtable rhead; -struct hlist_head walk_head; -spinlock_t walk_lock; -atomic_t entries;/* Up to MAX_MESH_NEIGHBOURS */ -}; -/* Recent multicast cache */ /* RMC_BUCKETS must be a power of 2, maximum 256 */ #define RMC_BUCKETS 256
@@ -308,7 +288,7 @@ int mesh_path_error_tx(struct ieee80211_void mesh_path_assign_nexthop (struct mesh_path *mpath,struct sta_info *sta);void mesh_path_flush_pending (struct mesh_path *mpath);void mesh_path_tx_pending (struct mesh_path *mpath); -int mesh_pathtbl_init (struct ieee80211_sub_if_data *sdata); +void mesh_pathtbl_init (struct ieee80211_sub_if_data *sdata);void mesh_pathtbl_unregister (struct ieee80211_sub_if_data *sdata);int mesh_path_del (struct ieee80211_sub_if_data *sdata,const u8 *addr);void mesh_path_timer (struct timer_list *t);
net/mac80211/mesh_pathtbl.c +32 -59
196 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 17/25 uaccess: Add speculation barrier to copy_from_user()
In reply to Greg Kroah-HartmanFrom: Dave Hansen <[email protected]>
commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 upstream.
The results of "access_ok()" can be mis-speculated. The result is that you can end speculatively:
if (access_ok(from, size)) // Right here
even for bad from/size combinations. On first glance, it would be ideal to just add a speculation barrier to "access_ok()" so that its results can never be mis-speculated.
But there are lots of system calls just doing access_ok() via "copy_to_user()" and friends (example: fstat() and friends). Those are generally not problematic because they do not _consume_ data from userspace other than the pointer. They are also very quick and common system calls that should not be needlessly slowed down.
"copy_from_user()" on the other hand uses a user-controller pointer and is frequently followed up with code that might affect caches. Take something like this:
if (!copy_from_user(&kernelvar, uptr, size)) do_something_with(kernelvar);
If userspace passes in an evil 'uptr' that *actually* points to a kernel addresses, and then do_something_with() has cache (or other) side-effects, it could allow userspace to infer kernel data values.
Add a barrier to the common copy_from_user() code to prevent mis-speculated values which happen after the copy.
Also add a stub for architectures that do not define barrier_nospec(). This makes the macro usable in generic code.
Since the barrier is now usable in generic code, the x86 #ifdef in the BPF code can also go away.
--- include/linux/nospec.h | 4 ++++ kernel/bpf/core.c | 2 -- lib/usercopy.c | 7 +++++++ 3 files changed, 11 insertions(+), 2 deletions(-)
include/linux/nospec.h +4 -0
@@ -11,6 +11,10 @@struct task_struct ; +#ifndef barrier_nospec +# define barrier_nospec () do { } while (0) +#endif +/** * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise * @index: array element index
kernel/bpf/core.c +0 -2
@@ -1642,9 +1642,7 @@ out:* reuse preexisting logic from Spectre v1 mitigation that * happens to produce the required code on x86 for v4 as well. */ -#ifdef CONFIG_X86 barrier_nospec (); -#endif CONT ;#define LDST (SIZEOP ,SIZE ) \ STX_MEM_##SIZEOP: \
lib/usercopy.c +7 -0
@@ -3,6 +3,7 @@#include <linux/fault-inject-usercopy.h> #include <linux/instrumented.h> #include <linux/uaccess.h> +#include <linux/nospec.h> /* out-of-line parts */
@@ -12,6 +13,12 @@ unsigned long _copy_from_user(void *to,unsigned long res = n;might_fault ();if (!should_fail_usercopy () &&likely (access_ok (from, n))) { +/* +* Ensure that bad access_ok() speculation will not +* lead to nasty side effects *after* the copy is +* finished: +*/ +barrier_nospec ();instrument_copy_from_user (to, from, n); res =raw_copy_from_user (to, from, n); }
Greg Kroah-Hartman
maintainerPATCH 18/25 Revert "Revert "block: nbd: add sanity check for first_minor""
In reply to Greg Kroah-HartmanFrom: Wen Yang <[email protected]>
This reverts commit 0daa75bf750c400af0a0127fae37cd959d36dee7.
These problems such as:
https://lore.kernel.org/all/CACPK8XfUWoOHr-0RwRoYoskia4fbAbZ7DYf5wWBnv6qUnGq18w@mail.gmail.com/
It was introduced by introduced by commit b1a811633f73 ("block: nbd: add sanity check for first_minor") and has been have been fixed by commit e4c4871a7394 ("nbd: fix max value for 'first_minor'").
--- drivers/block/nbd.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/block/nbd.c +10 -0
@@ -1771,7 +1771,17 @@ static int nbd_dev_add(int index)refcount_set (&nbd->refs,1 );INIT_LIST_HEAD (&nbd->list); disk->major =NBD_MAJOR ; + +/* Too big first_minor can cause duplicate creation of +* sysfs files/links, since first_minor will be truncated to +* byte in __device_add_disk(). +*/ disk->first_minor = index << part_shift; +if (disk->first_minor >0xff ) { + err = -EINVAL ; + goto out_free_idr; + } + disk->fops = &nbd_fops; disk->private_data = nbd;sprintf (disk->disk_name,"nbd%d" , index);
Greg Kroah-Hartman
maintainerPATCH 19/25 nbd: fix max value for first_minor
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
commit e4c4871a73944353ea23e319de27ef73ce546623 upstream.
commit b1a811633f73 ("block: nbd: add sanity check for first_minor") checks that 'first_minor' should not be greater than 0xff, which is wrong. Whitout the commit, the details that when user pass 0x100000, it ends up create sysfs dir "/sys/block/43:0" are as follows:
nbd_dev_add
disk->first_minor = index << part_shift
-> default part_shift is 5, first_minor is 0x2000000 device_add_disk
ddev->devt = MKDEV(disk->major, disk->first_minor)
-> (0x2b << 20) | (0x2000000) = 0x2b00000
device_add
device_create_sys_dev_entry
format_dev_t
sprintf(buffer, "%u:%u", MAJOR(dev), MINOR(dev));
-> got 43:0
sysfs_create_link -> /sys/block/43:0By the way, with the wrong fix, when part_shift is the default value, only 8 ndb devices can be created since 8 << 5 is greater than 0xff.
Since the max bits for 'first_minor' should be the same as what MKDEV() does, which is 20. Change the upper bound of 'first_minor' from 0xff to 0xfffff.
--- drivers/block/nbd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/block/nbd.c +3 -3
@@ -1773,11 +1773,11 @@ static int nbd_dev_add(int index) disk->major =NBD_MAJOR ;/* Too big first_minor can cause duplicate creation of -* sysfs files/links, since first_minor will be truncated to -* byte in __device_add_disk(). +* sysfs files/links, since MKDEV() expect that the max bits of +* first_minor is 20. */ disk->first_minor = index << part_shift; -if (disk->first_minor >0xff ) { +if (disk->first_minor >MINORMASK ) { err = -EINVAL ; goto out_free_idr; }
Greg Kroah-Hartman
maintainerPATCH 20/25 nbd: fix possible overflow for first_minor in nbd_dev_add()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
commit 940c264984fd1457918393c49674f6b39ee16506 upstream.
If 'part_shift' is not zero, then 'index << part_shift' might overflow to a value that is not greater than '0xfffff', then sysfs might complains about duplicate creation.
--- drivers/block/nbd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/block/nbd.c +3 -3
@@ -1773,11 +1773,11 @@ static int nbd_dev_add(int index) disk->major =NBD_MAJOR ;/* Too big first_minor can cause duplicate creation of -* sysfs files/links, since MKDEV() expect that the max bits of -* first_minor is 20. +* sysfs files/links, since index << part_shift might overflow, or +* MKDEV() expect that the max bits of first_minor is 20. */ disk->first_minor = index << part_shift; -if (disk->first_minor >MINORMASK ) { +if (disk->first_minor < index || disk->first_minor >MINORMASK ) { err = -EINVAL ; goto out_free_idr; }
Greg Kroah-Hartman
maintainerPATCH 21/25 nbd: fix possible overflow on first_minor in nbd_dev_add()
In reply to Greg Kroah-HartmanFrom: Zhang Wensheng <[email protected]>
commit 858f1bf65d3d9c00b5e2d8ca87dc79ed88267c98 upstream.
When 'index' is a big numbers, it may become negative which forced to 'int'. then 'index << part_shift' might overflow to a positive value that is not greater than '0xfffff', then sysfs might complains about duplicate creation. Because of this, move the 'index' judgment to the front will fix it and be better.
--- drivers/block/nbd.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
drivers/block/nbd.c +12 -11
@@ -1771,17 +1771,7 @@ static int nbd_dev_add(int index)refcount_set (&nbd->refs,1 );INIT_LIST_HEAD (&nbd->list); disk->major =NBD_MAJOR ; - -/* Too big first_minor can cause duplicate creation of -* sysfs files/links, since index << part_shift might overflow, or -* MKDEV() expect that the max bits of first_minor is 20. -*/ disk->first_minor = index << part_shift; -if (disk->first_minor < index || disk->first_minor >MINORMASK ) { - err = -EINVAL ; - goto out_free_idr; - } - disk->fops = &nbd_fops; disk->private_data = nbd;sprintf (disk->disk_name,"nbd%d" , index);
@@ -1875,8 +1865,19 @@ static int nbd_genl_connect(struct sk_buif (!netlink_capable (skb,CAP_SYS_ADMIN ))return -EPERM ; -if (info->attrs[NBD_ATTR_INDEX ]) +if (info->attrs[NBD_ATTR_INDEX ]) { index =nla_get_u32 (info->attrs[NBD_ATTR_INDEX ]); + +/* +* Too big first_minor can cause duplicate creation of +* sysfs files/links, since index << part_shift might overflow, or +* MKDEV() expect that the max bits of first_minor is 20. +*/ +if (index <0 || index >MINORMASK >> part_shift) { +printk (KERN_ERR "nbd: illegal input index %d\n" , index); +return -EINVAL ; + } + }if (!info->attrs[NBD_ATTR_SOCKETS ]) {printk (KERN_ERR "nbd: must specify at least one socket\n" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 22/25 wifi: mwifiex: Add missing compatible string for SD8787
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit 36dd7a4c6226133b0b7aa92b8e604e688d958d0c upstream.
Commit e3fffc1f0b47 ("devicetree: document new marvell-8xxx and pwrseq-sd8787 options") documented a compatible string for SD8787 in the devicetree bindings, but neglected to add it to the mwifiex driver.
--- drivers/net/wireless/marvell/mwifiex/sdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/mwifiex/sdio.c +1 -0
@@ -485,6 +485,7 @@ static struct memory_type_mapping mem_ty };static const struct of_device_id mwifiex_sdio_of_match_table[] = { + { .compatible ="marvell,sd8787" }, { .compatible ="marvell,sd8897" }, { .compatible ="marvell,sd8997" }, { }
Greg Kroah-Hartman
maintainerPATCH 23/25 audit: update the mailing list in MAINTAINERS
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
commit 6c6cd913accd77008f74a1a9d57b816db3651daa upstream.
We've moved the upstream Linux Kernel audit subsystem discussions to a new mailing list, this patch updates the MAINTAINERS info with the new list address.
Marking this for stable inclusion to help speed uptake of the new list across all of the supported kernel releases. This is a doc only patch so the risk should be close to nil.
--- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
MAINTAINERS +1 -1
@@ -3001,7 +3001,7 @@ F: drivers/net/ieee802154/atusb.h AUDIT SUBSYSTEM M: Paul Moore <[email protected]> M: Eric Paris <[email protected]> -L: [email protected] (moderated for non-subscribers) +L: [email protected] S: Supported W: https://github.com/linux-audit T: git git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
Greg Kroah-Hartman
maintainerPATCH 24/25 ext4: Fix function prototype mismatch for ext4_feat_ktype
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 118901ad1f25d2334255b3d50512fa20591531cd upstream.
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed.
ext4_feat_ktype was setting the "release" handler to "kfree", which doesn't have a matching function prototype. Add a simple wrapper with the correct prototype.
This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches.
Note that this code is only reached when ext4 is a loadable module and it is being unloaded:
CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698)
...
RIP: 0010:kobject_put+0xbb/0x1b0 ... Call Trace: <TASK> ext4_exit_sysfs+0x14/0x60 [ext4] cleanup_module+0x67/0xedb [ext4]
--- fs/ext4/sysfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/sysfs.c +6 -1
@@ -487,6 +487,11 @@ static void ext4_sb_release(struct kobjecomplete (&sbi->s_kobj_unregister); } +static void ext4_feat_release (struct kobject *kobj) +{ +kfree (kobj); +} +static const struct sysfs_ops ext4_attr_ops = { .show = ext4_attr_show, .store = ext4_attr_store,
@@ -501,7 +506,7 @@ static struct kobj_type ext4_sb_ktype =static struct kobj_type ext4_feat_ktype = { .default_groups = ext4_feat_groups, .sysfs_ops = &ext4_attr_ops, - .release = (void (*)(struct kobject *))kfree, + .release = ext4_feat_release, };static struct kobject *ext4_root;
Greg Kroah-Hartman
maintainerPATCH 7/25 powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 36926a7d70c2d462fca1ed85bfee000d17fd8662 ]
On the T208X SoCs, MAC1 and MAC2 support XGMII. Add some new MAC dtsi fragments, and mark the QMAN ports as 10G.
--- .../boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi | 44 +++++++++++++++++++ .../boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi | 44 +++++++++++++++++++ arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 4 +- 3 files changed, 90 insertions(+), 2 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi create mode 100644 arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi new file +44 -0
@@ -0,0 +1,44 @@ +// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0-or-later +/* + * QorIQ FMan v3 10g port #2 device tree stub [ controller @ offset 0x400000 ] + * + * Copyright 2022 Sean Anderson <[email protected]> + * Copyright 2012 - 2015 Freescale Semiconductor Inc. + */ + +fman@400000 { + fman0_rx_0x08: port@88000 { + cell-index = <0x8>; + compatible = "fsl,fman-v3-port-rx"; + reg = <0x88000 0x1000>; + fsl,fman-10g-port; + }; + + fman0_tx_0x28: port@a8000 { + cell-index = <0x28>; + compatible = "fsl,fman-v3-port-tx"; + reg = <0xa8000 0x1000>; + fsl,fman-10g-port; + }; + + ethernet@e0000 { + cell-index = <0>; + compatible = "fsl,fman-memac"; + reg = <0xe0000 0x1000>; + fsl,fman-ports = <&fman0_rx_0x08 &fman0_tx_0x28>; + ptp-timer = <&ptp_timer0>; + pcsphy-handle = <&pcsphy0>; + }; + + mdio@e1000 { + #address-cells = <1>; + #size-cells = <0>; + compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; + reg = <0xe1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ + + pcsphy0: ethernet-phy@0 { + reg = <0x0>; + }; + }; +};
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi new file +44 -0
44 lines not on this page · raw message
arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +2 -2
@@ -609,8 +609,8 @@ /include/ "qoriq-bman1.dtsi" /include/ "qoriq-fman3-0.dtsi" -/include/ "qoriq-fman3-0-1g-0.dtsi" -/include/ "qoriq-fman3-0-1g-1.dtsi" +/include/ "qoriq-fman3-0-10g-2.dtsi" +/include/ "qoriq-fman3-0-10g-3.dtsi" /include/ "qoriq-fman3-0-1g-2.dtsi" /include/ "qoriq-fman3-0-1g-3.dtsi" /include/ "qoriq-fman3-0-1g-4.dtsi"
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 25/25 Revert "net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs"
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
commit af7b29b1deaac6da3bb7637f0e263dfab7bfc7a3 upstream.
taprio_attach() has this logic at the end, which should have been removed with the blamed patch (which is now being reverted):
/* access to the child qdiscs is not needed in offload mode */
if (FULL_OFFLOAD_IS_ENABLED(q->flags)) {
kfree(q->qdiscs);
q->qdiscs = NULL;
}because otherwise, we make use of q->qdiscs[] even after this array was deallocated, namely in taprio_leaf(). Therefore, whenever one would try to attach a valid child qdisc to a fully offloaded taprio root, one would immediately dereference a NULL pointer.
$ tc qdisc replace dev eno0 handle 8001: parent root taprio \ num_tc 8 \ map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ max-sdu 0 0 0 0 0 200 0 0 \ base-time 200 \ sched-entry S 80 20000 \ sched-entry S a0 20000 \ sched-entry S 5f 60000 \ flags 2 $ max_frame_size=1500 $ data_rate_kbps=20000 $ port_transmit_rate_kbps=1000000 $ idleslope=$data_rate_kbps $ sendslope=$(($idleslope - $port_transmit_rate_kbps)) $ locredit=$(($max_frame_size * $sendslope / $port_transmit_rate_kbps)) $ hicredit=$(($max_frame_size * $idleslope / $port_transmit_rate_kbps)) $ tc qdisc replace dev eno0 parent 8001:7 cbs \ idleslope $idleslope \ sendslope $sendslope \ hicredit $hicredit \ locredit $locredit \ offload 0
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 pc : taprio_leaf+0x28/0x40 lr : qdisc_leaf+0x3c/0x60 Call trace: taprio_leaf+0x28/0x40 tc_modify_qdisc+0xf0/0x72c rtnetlink_rcv_msg+0x12c/0x390 netlink_rcv_skb+0x5c/0x130 rtnetlink_rcv+0x1c/0x2c
The solution is not as obvious as the problem. The code which deallocates q->qdiscs[] is in fact copied and pasted from mqprio, which also deallocates the array in mqprio_attach() and never uses it afterwards.
Therefore, the identical cleanup logic of priv->qdiscs[] that mqprio_destroy() has is deceptive because it will never take place at qdisc_destroy() time, but just at raw ops->destroy() time (otherwise said, priv->qdiscs[] do not last for the entire lifetime of the mqprio root), but rather, this is just the twisted way in which the Qdisc API understands error path cleanup should be done (Qdisc_ops :: destroy() is called even when Qdisc_ops :: init() never succeeded).
Side note, in fact this is also what the comment in mqprio_init() says:
/* pre-allocate qdisc, attachment can't fail */
Or reworded, mqprio's priv->qdiscs[] scheme is only meant to serve as data passing between Qdisc_ops :: init() and Qdisc_ops :: attach().
[ this comment was also copied and pasted into the initial taprio
commit, even though taprio_attach() came way later ]
The problem is that taprio also makes extensive use of the q->qdiscs[] array in the software fast path (taprio_enqueue() and taprio_dequeue()), but it does not keep a reference of its own on q->qdiscs[i] (you'd think that since it creates these Qdiscs, it holds the reference, but nope, this is not completely true).
To understand the difference between taprio_destroy() and mqprio_destroy() one must look before commit 13511704f8d7 ("net: taprio offload: enforce qdisc to netdev queue mapping"), because that just muddied the waters.
In the "original" taprio design, taprio always attached itself (the root Qdisc) to all netdev TX queues, so that dev_qdisc_enqueue() would go through taprio_enqueue().
It also called qdisc_refcount_inc() on itself for as many times as there were netdev TX queues, in order to counter-balance what tc_get_qdisc() does when destroying a Qdisc (simplified for brevity below):
if (n->nlmsg_type == RTM_DELQDISC) err = qdisc_graft(dev, parent=NULL, new=NULL, q, extack);
qdisc_graft(where "new" is NULL so this deletes the Qdisc):
for (i = 0; i < num_q; i++) {
struct netdev_queue *dev_queue;
dev_queue = netdev_get_tx_queue(dev, i);
old = dev_graft_qdisc(dev_queue, new);
if (new && i > 0)
qdisc_refcount_inc(new);
qdisc_put(old);
~~~~~~~~~~~~~~
this decrements taprio's refcount once for each TX queue
}
notify_and_destroy(net, skb, n, classid,
rtnl_dereference(dev->qdisc), new);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
and this finally decrements it to zero,
making qdisc_put() call qdisc_destroy()The q->qdiscs[] created using qdisc_create_dflt() (or their replacements, if taprio_graft() was ever to get called) were then privately freed by taprio_destroy().
This is still what is happening after commit 13511704f8d7 ("net: taprio
offload: enforce qdisc to netdev queue mapping"), but only for software mode.
In full offload mode, the per-txq "qdisc_put(old)" calls from qdisc_graft() now deallocate the child Qdiscs rather than decrement taprio's refcount. So when notify_and_destroy(taprio) finally calls taprio_destroy(), the difference is that the child Qdiscs were already deallocated.
And this is exactly why the taprio_attach() comment "access to the child qdiscs is not needed in offload mode" is deceptive too. Not only the q->qdiscs[] array is not needed, but it is also necessary to get rid of it as soon as possible, because otherwise, we will also call qdisc_put() on the child Qdiscs in qdisc_destroy() -> taprio_destroy(), and this will cause a nasty use-after-free/refcount-saturate/whatever.
In short, the problem is that since the blamed commit, taprio_leaf() needs q->qdiscs[] to not be freed by taprio_attach(), while qdisc_destroy() -> taprio_destroy() does need q->qdiscs[] to be freed by taprio_attach() for full offload. Fixing one problem triggers the other.
All of this can be solved by making taprio keep its q->qdiscs[i] with a refcount elevated at 2 (in offloaded mode where they are attached to the netdev TX queues), both in taprio_attach() and in taprio_graft(). The generic qdisc_graft() would just decrement the child qdiscs' refcounts to 1, and taprio_destroy() would give them the final coup de grace.
However the rabbit hole of changes is getting quite deep, and the complexity increases. The blamed commit was supposed to be a bug fix in the first place, and the bug it addressed is not so significant so as to justify further rework in stable trees. So I'd rather just revert it. I don't know enough about multi-queue Qdisc design to make a proper judgement right now regarding what is/isn't idiomatic use of Qdisc concepts in taprio. I will try to study the problem more and come with a different solution in net-next.
--- net/sched/sch_taprio.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
net/sched/sch_taprio.c +3 -5
@@ -1906,14 +1906,12 @@ start_error:static struct Qdisc *taprio_leaf (struct Qdisc *sch,unsigned long cl) { -struct taprio_sched *q =qdisc_priv (sch); -struct net_device *dev =qdisc_dev (sch); -unsigned int ntx = cl -1 ; +struct netdev_queue *dev_queue =taprio_queue_get (sch, cl); -if (ntx >= dev->num_tx_queues) +if (!dev_queue)return NULL ; -return q->qdiscs[ntx]; +return dev_queue->qdisc_sleeping; }static unsigned long taprio_find (struct Qdisc *sch,u32 classid)
Greg Kroah-Hartman
maintainerPATCH 8/25 clk: mxl: syscon_node_to_regmap() returns error pointers
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit 7256d1f4618b40792d1e9b9b6cb1406a13cad2dd ]
Commit 036177310bac ("clk: mxl: Switch from direct readl/writel based IO to regmap based IO") introduced code resulting in below warning issued by the smatch static checker.
drivers/clk/x86/clk-lgm.c:441 lgm_cgu_probe() warn: passing zero to 'PTR_ERR'
Fix the warning by replacing incorrect IS_ERR_OR_NULL() with IS_ERR().
--- drivers/clk/x86/clk-lgm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/x86/clk-lgm.c +1 -1
@@ -436,7 +436,7 @@ static int lgm_cgu_probe(struct platform_device *pdev) ctx->clk_data.num =CLK_NR_CLKS ; ctx->membase =syscon_node_to_regmap (np); -if (IS_ERR_OR_NULL (ctx->membase)) { +if (IS_ERR (ctx->membase)) {dev_err (dev,"Failed to get clk CGU iomem\n" );return PTR_ERR (ctx->membase); }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 9/25 random: always mix cycle counter in add_latent_entropy()
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit d7bf7f3b813e3755226bcb5114ad2ac477514ebf ]
add_latent_entropy() is called every time a process forks, in kernel_clone(). This in turn calls add_device_randomness() using the latent entropy global state. add_device_randomness() does two things:
2) Mixes into the input pool the latent entropy argument passed; and
1) Mixes in a cycle counter, a sort of measurement of when the event took place, the high precision bits of which are presumably difficult to predict.
(2) is impossible without CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y. But (1) is always possible. However, currently CONFIG_GCC_PLUGIN_LATENT_ENTROPY=n disables both (1) and (2), instead of just (2).
This commit causes the CONFIG_GCC_PLUGIN_LATENT_ENTROPY=n case to still do (1) by passing NULL (len 0) to add_device_randomness() when add_latent_ entropy() is called.
--- include/linux/random.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
include/linux/random.h +3 -3
@@ -19,14 +19,14 @@ void add_input_randomness(unsigned int type, unsigned int code, void add_interrupt_randomness(int irq) __latent_entropy;void add_hwgenerator_randomness (const void *buf,size_t len,size_t entropy); -#if defined(LATENT_ENTROPY_PLUGIN ) && !defined(__CHECKER__)static inline void add_latent_entropy (void ) { +#if defined(LATENT_ENTROPY_PLUGIN ) && !defined(__CHECKER__)add_device_randomness ((const void *)&latent_entropy,sizeof (latent_entropy)); -}#else -static inline void add_latent_entropy (void ) { } +add_device_randomness (NULL ,0 );#endif +}void get_random_bytes (void *buf,size_t len);size_t __must_check get_random_bytes_arch (void *buf,size_t len);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 10/25 KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 17122c06b86c9f77f45b86b8e62c3ed440847a59 ]
Treat any exception during instruction decode for EMULTYPE_SKIP as a "full" emulation failure, i.e. signal failure instead of queuing the exception. When decoding purely to skip an instruction, KVM and/or the CPU has already done some amount of emulation that cannot be unwound, e.g. on an EPT misconfig VM-Exit KVM has already processeed the emulated MMIO. KVM already does this if a #UD is encountered, but not for other exceptions, e.g. if a #PF is encountered during fetch.
In SVM's soft-injection use case, queueing the exception is particularly problematic as queueing exceptions while injecting events can put KVM into an infinite loop due to bailing from VM-Enter to service the newly pending exception. E.g. multiple warnings to detect such behavior fire:
------------[ cut here ]------------ WARNING: CPU: 3 PID: 1017 at arch/x86/kvm/x86.c:9873 kvm_arch_vcpu_ioctl_run+0x1de5/0x20a0 [kvm] Modules linked in: kvm_amd ccp kvm irqbypass CPU: 3 PID: 1017 Comm: svm_nested_soft Not tainted 6.0.0-rc1+ #220 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_arch_vcpu_ioctl_run+0x1de5/0x20a0 [kvm] Call Trace: kvm_vcpu_ioctl+0x223/0x6d0 [kvm] __x64_sys_ioctl+0x85/0xc0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1017 at arch/x86/kvm/x86.c:9987 kvm_arch_vcpu_ioctl_run+0x12a3/0x20a0 [kvm] Modules linked in: kvm_amd ccp kvm irqbypass CPU: 3 PID: 1017 Comm: svm_nested_soft Tainted: G W 6.0.0-rc1+ #220 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_arch_vcpu_ioctl_run+0x12a3/0x20a0 [kvm] Call Trace: kvm_vcpu_ioctl+0x223/0x6d0 [kvm] __x64_sys_ioctl+0x85/0xc0 do_syscall_64+0x2b/0x50 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ---[ end trace 0000000000000000 ]---
--- arch/x86/kvm/x86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/x86.c +3 -1
@@ -7534,7 +7534,9 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, write_fault_to_spt, emulation_type))return 1 ; -if (ctxt->have_exception) { + +if (ctxt->have_exception && + !(emulation_type &EMULTYPE_SKIP )) {/* * #UD should result in just EMULATION_FAILED, and trap-like * exception should not be encountered during decode.
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 11/25 KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isnt valid
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 5c30e8101e8d5d020b1d7119117889756a6ed713 ]
Skip the WRMSR fastpath in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the WRMSR if the CPU doesn't provide the next RIP. Getting the instruction bytes to decode the WRMSR requires reading guest memory, which in turn means dereferencing memslots, and that isn't safe because KVM doesn't hold SRCU when the fastpath runs.
Don't bother trying to enable the fastpath for this case, e.g. by doing only the WRMSR and leaving the "skip" until later. NRIPS is supported on all modern CPUs (KVM has considered making it mandatory), and the next RIP will be valid the vast, vast majority of the time.
=============================
WARNING: suspicious RCU usage
6.0.0-smp--4e557fcd3d80-skip #13 Tainted: G O
-----------------------------
include/linux/kvm_host.h:954 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by stable/206475:
#0: ffff9d9dfebcc0f0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x8b/0x620 [kvm]
stack backtrace: CPU: 152 PID: 206475 Comm: stable Tainted: G O 6.0.0-smp--4e557fcd3d80-skip #13 Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 Call Trace: <TASK> dump_stack_lvl+0x69/0xaa dump_stack+0x10/0x12 lockdep_rcu_suspicious+0x11e/0x130 kvm_vcpu_gfn_to_memslot+0x155/0x190 [kvm] kvm_vcpu_gfn_to_hva_prot+0x18/0x80 [kvm] paging64_walk_addr_generic+0x183/0x450 [kvm] paging64_gva_to_gpa+0x63/0xd0 [kvm] kvm_fetch_guest_virt+0x53/0xc0 [kvm] __do_insn_fetch_bytes+0x18b/0x1c0 [kvm] x86_decode_insn+0xf0/0xef0 [kvm] x86_emulate_instruction+0xba/0x790 [kvm] kvm_emulate_instruction+0x17/0x20 [kvm] __svm_skip_emulated_instruction+0x85/0x100 [kvm_amd] svm_skip_emulated_instruction+0x13/0x20 [kvm_amd] handle_fastpath_set_msr_irqoff+0xae/0x180 [kvm] svm_vcpu_run+0x4b8/0x5a0 [kvm_amd] vcpu_enter_guest+0x16ca/0x22f0 [kvm] kvm_arch_vcpu_ioctl_run+0x39d/0x900 [kvm] kvm_vcpu_ioctl+0x538/0x620 [kvm] __se_sys_ioctl+0x77/0xc0 __x64_sys_ioctl+0x1d/0x20 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
--- arch/x86/kvm/svm/svm.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
arch/x86/kvm/svm/svm.c +8 -2
@@ -3480,8 +3480,14 @@ static void svm_cancel_injection(struct kvm_vcpu *vcpu)static fastpath_t svm_exit_handlers_fastpath (struct kvm_vcpu *vcpu) { -if (to_svm (vcpu)->vmcb->control.exit_code ==SVM_EXIT_MSR && -to_svm (vcpu)->vmcb->control.exit_info_1) +struct vmcb_control_area *control = &to_svm (vcpu)->vmcb->control; + +/* +* Note, the next RIP must be provided as SRCU isn't held, i.e. KVM +* can't read guest memory (dereference memslots) to decode the WRMSR. +*/ +if (control->exit_code ==SVM_EXIT_MSR && control->exit_info_1 && + nrips && control->next_rip)return handle_fastpath_set_msr_irqoff (vcpu);return EXIT_FASTPATH_NONE ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 12/25 KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
In reply to Greg Kroah-HartmanFrom: Jim Mattson <[email protected]>
[ Upstream commit 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 ]
According to Intel's document on Indirect Branch Restricted Speculation, "Enabling IBRS does not prevent software from controlling the predicted targets of indirect branches of unrelated software executed later at the same predictor mode (for example, between two different user applications, or two different virtual machines). Such isolation can be ensured through use of the Indirect Branch Predictor Barrier (IBPB) command." This applies to both basic and enhanced IBRS.
Since L1 and L2 VMs share hardware predictor modes (guest-user and guest-kernel), hardware IBRS is not sufficient to virtualize IBRS. (The way that basic IBRS is implemented on pre-eIBRS parts, hardware IBRS is actually sufficient in practice, even though it isn't sufficient architecturally.)
For virtual CPUs that support IBRS, add an indirect branch prediction barrier on emulated VM-exit, to ensure that the predicted targets of indirect branches executed in L1 cannot be controlled by software that was executed in L2.
Since we typically don't intercept guest writes to IA32_SPEC_CTRL, perform the IBPB at emulated VM-exit regardless of the current IA32_SPEC_CTRL.IBRS value, even though the IBPB could technically be deferred until L1 sets IA32_SPEC_CTRL.IBRS, if IA32_SPEC_CTRL.IBRS is clear at emulated VM-exit.
This is CVE-2022-2196.
--- arch/x86/kvm/vmx/nested.c | 11 +++++++++++ arch/x86/kvm/vmx/vmx.c | 6 ++++-- 2 files changed, 15 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/nested.c +11 -0
@@ -4556,6 +4556,17 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason,vmx_switch_vmcs (vcpu, &vmx->vmcs01); +/* +* If IBRS is advertised to the vCPU, KVM must flush the indirect +* branch predictors when transitioning from L2 to L1, as L1 expects +* hardware (KVM in this case) to provide separate predictor modes. +* Bare metal isolates VMX root (host) from VMX non-root (guest), but +* doesn't isolate different VMCSs, i.e. in this case, doesn't provide +* separate modes for L2 vs L1. +*/ +if (guest_cpuid_has (vcpu,X86_FEATURE_SPEC_CTRL )) +indirect_branch_prediction_barrier (); +/* Update any VMCS fields that might have changed while L2 ran */ vmcs_write32 (VM_EXIT_MSR_LOAD_COUNT , vmx->msr_autoload.host.nr);vmcs_write32 (VM_ENTRY_MSR_LOAD_COUNT , vmx->msr_autoload.guest.nr);
arch/x86/kvm/vmx/vmx.c +4 -2
@@ -1431,8 +1431,10 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu,/* * No indirect branch prediction barrier needed when switching -* the active VMCS within a guest, e.g. on nested VM-Enter. -* The L1 VMM can protect itself with retpolines, IBPB or IBRS. +* the active VMCS within a vCPU, unless IBRS is advertised to +* the vCPU. To minimize the number of IBPBs executed, KVM +* performs IBPB on nested VM-Exit (a single nested transition +* may switch the active VMCS multiple times). */ if (!buddy ||WARN_ON_ONCE (buddy->vmcs != prev))indirect_branch_prediction_barrier ();
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 13/25 can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit f006229135b7debf4037adb1eb93e358559593db ]
Debian's gcc-13 [1] throws the following error inkvaser_usb_hydra_cmd_size():
[1] gcc version 13.0.0 20221214 (experimental) [master r13-4693-g512098a3316] (Debian 13-20221214-1)
| drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c:502:65: error: | array subscript ‘struct kvaser_cmd_ext[0]’ is partly outside array | bounds of ‘unsigned char[32]’ [-Werror=array-bounds=] | 502 | ret = le16_to_cpu(((struct kvaser_cmd_ext *)cmd)->len);
kvaser_usb_hydra_cmd_size() returns the size of given command. It depends on the command number (cmd->header.cmd_no). For extended commands (cmd->header.cmd_no == CMD_EXTENDED) the above shown code is executed.
Help gcc to recognize that this code path is not taken in all cases, by calling kvaser_usb_hydra_cmd_size() directly after assigning the command number.
--- .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 33 ++++++++++++++----- 1 file changed, 24 insertions(+), 9 deletions(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +24 -9
@@ -518,6 +518,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev, u8 cmd_no, int channel) {struct kvaser_cmd *cmd; +size_t cmd_len;int err; cmd =kcalloc (1 ,sizeof (struct kvaser_cmd ),GFP_KERNEL );
@@ -525,6 +526,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev,return -ENOMEM ; cmd->header.cmd_no = cmd_no; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);if (channel <0 ) {kvaser_usb_hydra_set_cmd_dest_he (cmd,KVASER_USB_HYDRA_HE_ADDRESS_ILLEGAL );
@@ -541,7 +543,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev,kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);if (err) goto end;
@@ -557,6 +559,7 @@ kvaser_usb_hydra_send_simple_cmd_async(struct kvaser_usb_net_priv *priv, {struct kvaser_cmd *cmd;struct kvaser_usb *dev = priv->dev; +size_t cmd_len;int err; cmd =kcalloc (1 ,sizeof (struct kvaser_cmd ),GFP_ATOMIC );
@@ -564,14 +567,14 @@ kvaser_usb_hydra_send_simple_cmd_async(struct kvaser_usb_net_priv *priv,return -ENOMEM ; cmd->header.cmd_no = cmd_no; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);kvaser_usb_hydra_set_cmd_dest_he (cmd, dev->card_data.hydra.channel_to_he[priv->channel]);kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd_async (priv, cmd, -kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd_async (priv, cmd, cmd_len);if (err)kfree (cmd);
@@ -715,6 +718,7 @@ static int kvaser_usb_hydra_get_single_capability(struct kvaser_usb *dev, {struct kvaser_usb_dev_card_data *card_data = &dev->card_data;struct kvaser_cmd *cmd; +size_t cmd_len;u32 value =0 ;u32 mask =0 ;u16 cap_cmd_res;
@@ -726,13 +730,14 @@ static int kvaser_usb_hydra_get_single_capability(struct kvaser_usb *dev,return -ENOMEM ; cmd->header.cmd_no =CMD_GET_CAPABILITIES_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd); cmd->cap_req.cap_cmd =cpu_to_le16 (cap_cmd_req);kvaser_usb_hydra_set_cmd_dest_he (cmd, card_data->hydra.sysdbg_he);kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);if (err) goto end;
@@ -1555,6 +1560,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,struct kvaser_usb *dev = priv->dev;struct kvaser_usb_net_hydra_priv *hydra = priv->sub_priv;struct kvaser_cmd *cmd; +size_t cmd_len;int err;if (!hydra)
@@ -1565,6 +1571,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,return -ENOMEM ; cmd->header.cmd_no =CMD_GET_BUSPARAMS_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);kvaser_usb_hydra_set_cmd_dest_he (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); kvaser_usb_hydra_set_cmd_transid
@@ -1574,7 +1581,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,reinit_completion (&priv->get_busparams_comp); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);if (err)return err;
@@ -1601,6 +1608,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,struct kvaser_cmd *cmd;struct kvaser_usb_net_priv *priv =netdev_priv (netdev);struct kvaser_usb *dev = priv->dev; +size_t cmd_len;int err; cmd =kcalloc (1 ,sizeof (struct kvaser_cmd ),GFP_KERNEL );
@@ -1608,6 +1616,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,return -ENOMEM ; cmd->header.cmd_no =CMD_SET_BUSPARAMS_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);memcpy (&cmd->set_busparams_req.busparams_nominal, busparams,sizeof (cmd->set_busparams_req.busparams_nominal));
@@ -1616,7 +1625,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);kfree (cmd);
@@ -1629,6 +1638,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,struct kvaser_cmd *cmd;struct kvaser_usb_net_priv *priv =netdev_priv (netdev);struct kvaser_usb *dev = priv->dev; +size_t cmd_len;int err; cmd =kcalloc (1 ,sizeof (struct kvaser_cmd ),GFP_KERNEL );
@@ -1636,6 +1646,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,return -ENOMEM ; cmd->header.cmd_no =CMD_SET_BUSPARAMS_FD_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);memcpy (&cmd->set_busparams_req.busparams_data, busparams,sizeof (cmd->set_busparams_req.busparams_data));
@@ -1653,7 +1664,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);kfree (cmd);
@@ -1781,6 +1792,7 @@ static int kvaser_usb_hydra_get_software_info(struct kvaser_usb *dev)static int kvaser_usb_hydra_get_software_details (struct kvaser_usb *dev) {struct kvaser_cmd *cmd; +size_t cmd_len;int err;u32 flags;struct kvaser_usb_dev_card_data *card_data = &dev->card_data;
@@ -1790,6 +1802,7 @@ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev)return -ENOMEM ; cmd->header.cmd_no =CMD_GET_SOFTWARE_DETAILS_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd); cmd->sw_detail_req.use_ext_cmd =1 ;kvaser_usb_hydra_set_cmd_dest_he (cmd,KVASER_USB_HYDRA_HE_ADDRESS_ILLEGAL );
@@ -1797,7 +1810,7 @@ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev)kvaser_usb_hydra_set_cmd_transid (cmd,kvaser_usb_hydra_get_next_transid (dev)); - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);if (err) goto end;
@@ -1913,6 +1926,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv) {struct kvaser_usb *dev = priv->dev;struct kvaser_cmd *cmd; +size_t cmd_len;int err; if ((priv->can.ctrlmode &
@@ -1928,6 +1942,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv)return -ENOMEM ; cmd->header.cmd_no =CMD_SET_DRIVERMODE_REQ ; + cmd_len =kvaser_usb_hydra_cmd_size (cmd);kvaser_usb_hydra_set_cmd_dest_he (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); kvaser_usb_hydra_set_cmd_transid
@@ -1937,7 +1952,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv)else cmd->set_ctrlmode.mode =KVASER_USB_HYDRA_CTRLMODE_NORMAL ; - err =kvaser_usb_send_cmd (dev, cmd,kvaser_usb_hydra_cmd_size (cmd)); + err =kvaser_usb_send_cmd (dev, cmd, cmd_len);kfree (cmd);return err;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 14/25 powerpc: dts: t208x: Disable 10G on MAC1 and MAC2
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit 8d8bee13ae9e316443c6666286360126a19c8d94 ]
There aren't enough resources to run these ports at 10G speeds. Disable 10G for these ports, reverting to the previous speed.
--- arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +16 -0
@@ -659,3 +659,19 @@ interrupts = <16 2 1 9>; }; }; + +&fman0_rx_0x08 { + /delete-property/ fsl,fman-10g-port; +}; + +&fman0_tx_0x28 { + /delete-property/ fsl,fman-10g-port; +}; + +&fman0_rx_0x09 { + /delete-property/ fsl,fman-10g-port; +}; + +&fman0_tx_0x29 { + /delete-property/ fsl,fman-10g-port; +};
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 5/25 clk: mxl: Add option to override gate clks
In reply to Greg Kroah-HartmanFrom: Rahul Tanwar <[email protected]>
[ Upstream commit a5d49bd369b8588c0ee9d4d0a2c0160558a3ab69 ]
In MxL's LGM SoC, gate clocks can be controlled either from CGU clk driver i.e. this driver or directly from power management driver/daemon. It is dependent on the power policy/profile requirements of the end product.
To support such use cases, provide option to override gate clks enable/disable by adding a flag GATE_CLK_HW which controls if these gate clks are controlled by HW i.e. this driver or overridden in order to allow it to be controlled by power profiles instead.
Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags")
--- drivers/clk/x86/clk-cgu.c | 16 +++++++++++++++- drivers/clk/x86/clk-cgu.h | 1 + 2 files changed, 16 insertions(+), 1 deletion(-)
drivers/clk/x86/clk-cgu.c +15 -1
@@ -354,8 +354,22 @@ int lgm_clk_register_branches(struct lgm_clk_provider *ctx, hw =lgm_clk_register_fixed_factor (ctx, list);break ;case CLK_TYPE_GATE : - hw =lgm_clk_register_gate (ctx, list); +if (list->gate_flags &GATE_CLK_HW ) { + hw =lgm_clk_register_gate (ctx, list); + }else { +/* +* GATE_CLKs can be controlled either from +* CGU clk driver i.e. this driver or directly +* from power management driver/daemon. It is +* dependent on the power policy/profile requirements +* of the end product. To override control of gate +* clks from this driver, provide NULL for this index +* of gate clk provider. +*/ + hw =NULL ; + }break ; +default :dev_err (ctx->dev,"invalid clk type\n" );return -EINVAL ;
drivers/clk/x86/clk-cgu.h +1 -0
@@ -197,6 +197,7 @@ struct lgm_clk_branch {/* clock flags definition */ #define CLOCK_FLAG_VAL_INIT BIT(16)#define MUX_CLK_SW BIT(17) +#define GATE_CLK_HW BIT(18)#define LGM_MUX (_id, _name, _pdata, _f, _reg, \ _shift, _width, _cf, _v) \
Signature · 1 line
2.39.0