6.10.9-rc1 review
Subsystems (9)
Greg Kroah-Hartman
maintainercover 6.10.9-rc1 review
This is the start of the stable review cycle for the 6.10.9 release. There are 184 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 07 Sep 2024 09:36:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.10.9-rc1
Manivannan Sadhasivam <[email protected]>
scsi: ufs: qcom: Add UFSHCD_QUIRK_BROKEN_LSDBS_CAP for SM8550 SoC
Richard Fitzgerald <[email protected]>
i2c: Use IS_REACHABLE() for substituting empty ACPI functions
Yang Wang <[email protected]>
drm/amdgpu: remove redundant semicolons in RAS_EVENT_LOG
David Howells <[email protected]>
mm: Fix filemap_invalidate_inode() to use invalidate_inode_pages2_range()
Léo DUBOIN <[email protected]>
pinctrl: core: reset gpio_device in loop in pinctrl_pins_show()
Ricardo Ribalda <[email protected]>
media: uvcvideo: Enforce alignment of frame and interval
Stefan Berger <[email protected]>
crypto: ecc - Fix off-by-one missing to clear most significant digit
Alex Hung <[email protected]>
drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
Alex Hung <[email protected]>
drm/amd/display: Check BIOS images before it is used
Tao Zhou <[email protected]>
drm/amdkfd: use mode1 reset for RAS poison consumption
Tao Zhou <[email protected]>
drm/amdgpu: set RAS fed status for more cases
Alex Hung <[email protected]>
drm/amd/display: Avoid overflow from uint32_t to uint8_t
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Disable DMCUB timeout for DCN35
Wenjing Liu <[email protected]>
drm/amd/display: use preferred link settings for dp signal only
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection
Wayne Lin <[email protected]>
drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
winstang <[email protected]>
drm/amd/display: added NULL check at start of dc_validate_stream
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay
Bob Zhou <[email protected]>
drm/amdgpu: fix overflowed constant warning in mmhub_set_clockgating()
Yunxiang Li <[email protected]>
drm/amdgpu: add lock in kfd_process_dequeue_from_device
Yunxiang Li <[email protected]>
drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
Yunxiang Li <[email protected]>
drm/amdgpu: add skip_hw_access checks for sriov
Christoph Hellwig <[email protected]>
block: remove the blk_flush_integrity call in blk_integrity_unregister
Julien Stephan <[email protected]>
driver: iio: add missing checks on iio_info's callback access
Matthew Brost <[email protected]>
drm/xe: Add GuC state asserts to deregister_exec_queue
Chao Yu <[email protected]>
f2fs: fix to do sanity check on blocks for inline_data inode
Johannes Berg <[email protected]>
wifi: cfg80211: make hash table duplicates more survivable
Yazen Ghannam <[email protected]>
hwmon: (k10temp) Check return value of amd_smn_read()
Rafael J. Wysocki <[email protected]>
thermal: trip: Use READ_ONCE() for lockless access to trip properties
Olivier Dautricourt <[email protected]>
dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
Olivier Dautricourt <[email protected]>
dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking callbacks
Lad Prabhakar <[email protected]>
pinctrl: renesas: rzg2l: Validate power registers for SD and ETH
Himal Prasad Ghimiray <[email protected]>
drm/xe: Check valid domain is passed in xe_force_wake_ref
Himal Prasad Ghimiray <[email protected]>
drm/xe: Ensure caller uses sole domain for xe_force_wake_assert_held
Marek Vasut <[email protected]>
drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ
Valentin Schneider <[email protected]>
net: tcp/dccp: prepare for tw_timer un-pinning
John Allen <[email protected]>
RAS/AMD/ATL: Validate address map when information is gathered
Andreas Gruenbacher <[email protected]>
gfs2: Revert "Add quota_change type"
Maxime Méré <[email protected]>
crypto: stm32/cryp - call finalize with bh disabled
Haoran Liu <[email protected]>
drm/meson: plane: Add error handling
Dragos Tatulea <[email protected]>
net/mlx5e: SHAMPO, Fix incorrect page release
Ben Walsh <[email protected]>
platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
Casey Schaufler <[email protected]>
smack: tcp: ipv4, fix incorrect labeling
Andy Shevchenko <[email protected]>
regmap: spi: Fix potential off-by-one when calculating reserved size
Matthew Brost <[email protected]>
drm/xe: Don't overmap identity VRAM mapping
Jesse Zhang <[email protected]>
drm/amdgu: fix Unintentional integer overflow for mall size
Eric Dumazet <[email protected]>
tcp: annotate data-races around tw->tw_ts_recent and tw->tw_ts_recent_stamp
Jason Xing <[email protected]>
net: remove NULL-pointer net parameter in ip_metrics_convert
Amir Goldstein <[email protected]>
fsnotify: clear PARENT_WATCHED flags lazily
Nirmoy Das <[email protected]>
drm/xe: Use missing lock in relay_needs_worker
Abhishek Pandit-Subedi <[email protected]>
usb: typec: ucsi: Fix null pointer dereference in trace
Simon Holesch <[email protected]>
usbip: Don't submit special requests twice
Sakari Ailus <[email protected]>
media: v4l2-cci: Always assign *val
Frederic Weisbecker <[email protected]>
rcu/nocb: Remove buggy bypass lock contention mitigation
Ken Sloat <[email protected]>
pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
Shannon Nelson <[email protected]>
ionic: fix potential irq name truncation
Michael Margolin <[email protected]>
RDMA/efa: Properly handle unexpected AQ completions
Richard Maina <[email protected]>
remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop
Chris Lew <[email protected]>
soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
Richard Maina <[email protected]>
hwspinlock: Introduce hwspin_lock_bust()
Johannes Berg <[email protected]>
wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: use only beacon BSS load for active links
AngeloGioacchino Del Regno <[email protected]>
remoteproc: mediatek: Zero out only remaining bytes of IPI buffer
Aleksandr Mishin <[email protected]>
PCI: al: Check IORESOURCE_BUS existence during probe
Jagadeesh Kona <[email protected]>
cpufreq: scmi: Avoid overflow of target_freq in fast switch
Johannes Berg <[email protected]>
wifi: cfg80211: restrict operation during radar detection
Shahar S Matityahu <[email protected]>
wifi: iwlwifi: remove fw_running op
Tao Zhou <[email protected]>
drm/amdgpu: update type of buf size to u32 for eeprom functions
Victor Skvortsov <[email protected]>
drm/amdgpu: Queue KFD reset workitem in VF FED
Nicholas Susanto <[email protected]>
drm/amd/display: Fix pipe addition logic in calc_blocks_to_ungate DCN35
Yang Wang <[email protected]>
drm/amdgpu: fix compiler 'side-effect' check issue for RAS_EVENT_LOG()
Xiaogang Chen <[email protected]>
drm/kfd: Correct pinned buffer handling at kfd restore and validate process
Himal Prasad Ghimiray <[email protected]>
drm/xe: Fix the warning conditions
Zong-Zhe Yang <[email protected]>
wifi: rtw89: ser: avoid multiple deinit on same CAM
Jesse Zhang <[email protected]>
drm/amd/pm: check negtive return for table entries
Jesse Zhang <[email protected]>
drm/amdgpu: fix the warning bad bit shift operation for aca_error_type type
Jesse Zhang <[email protected]>
drm/amdgpu: the warning dereferencing obj for nbio_v7_4
Jesse Zhang <[email protected]>
drm/amd/pm: check specific index for smu13
Jesse Zhang <[email protected]>
drm/amd/pm: check specific index for aldebaran
Jesse Zhang <[email protected]>
drm/amdgpu: fix the waring dereferencing hive
Jesse Zhang <[email protected]>
drm/amdgpu: fix dereference after null check
Jesse Zhang <[email protected]>
drm/amdgpu: Fix the warning division or modulo by zero
David (Ming Qiang) Wu <[email protected]>
drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend
Ma Jun <[email protected]>
drm/amdgpu/pm: Check input value for power profile setting on smu11, smu13 and smu14
Ma Jun <[email protected]>
drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs
Jeff Johnson <[email protected]>
wifi: ath12k: initialize 'ret' in ath12k_dp_rxdma_ring_sel_config_wcn7850()
Jeff Johnson <[email protected]>
wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem()
Jeff Johnson <[email protected]>
wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem()
Leesoo Ahn <[email protected]>
apparmor: fix possible NULL pointer dereference
Karthik Poosa <[email protected]>
drm/xe/hwmon: Remove unwanted write permission for currN_label
Michael Chen <[email protected]>
drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device
Tim Huang <[email protected]>
drm/amdgpu: fix mc_data out-of-bounds read warning
Tim Huang <[email protected]>
drm/amdgpu: fix ucode out-of-bounds read warning
Ma Jun <[email protected]>
drm/amdgpu: Fix uninitialized variable warning in amdgpu_info_ioctl
Ma Jun <[email protected]>
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
Tim Huang <[email protected]>
drm/amdgpu: fix uninitialized variable warning for jpeg_v4
Tim Huang <[email protected]>
drm/amdgpu: fix uninitialized variable warning for amdgpu_xgmi
Lin.Cao <[email protected]>
drm/amdkfd: Check debug trap enable before write dbg_ev_file
Ma Jun <[email protected]>
drm/amdgpu: Fix out-of-bounds write warning
Ma Jun <[email protected]>
drm/amdgpu: Fix the uninitialized variable warning
Ma Jun <[email protected]>
drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
Ma Jun <[email protected]>
drm/amdgpu/pm: Fix uninitialized variable warning for smu10
Tim Huang <[email protected]>
drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
Sui Jingfeng <[email protected]>
drm/drm-bridge: Drop conditionals around of_node pointers
Rodrigo Vivi <[email protected]>
drm/xe: Demote CCS_MODE info to debug only
Asad Kamal <[email protected]>
drm/amd/amdgpu: Check tbo resource pointer
Hersen Wu <[email protected]>
drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box
Hersen Wu <[email protected]>
drm/amd/display: Fix writeback job lock evasion within dm_crtc_high_irq
Hersen Wu <[email protected]>
drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
Alex Hung <[email protected]>
drm/amd/display: Ensure index calculation will not overflow
Hersen Wu <[email protected]>
drm/amd/display: Fix Coverity INTEGER_OVERFLOW within decide_fallback_link_setting_max_bw_policy
Alex Hung <[email protected]>
drm/amd/display: Spinlock before reading event
Hersen Wu <[email protected]>
drm/amd/display: Release clck_src memory if clk_src_construct fails
Hersen Wu <[email protected]>
drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
Hersen Wu <[email protected]>
drm/amd/display: Fix Coverity INTERGER_OVERFLOW within construct_integrated_info
Hersen Wu <[email protected]>
drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update
Alex Hung <[email protected]>
drm/amd/display: Check link_index before accessing dc->links[]
Hersen Wu <[email protected]>
drm/amd/display: Release state memory if amdgpu_dm_create_color_properties fail
Alex Hung <[email protected]>
drm/amd/display: Check msg_id before processing transcation
Alex Hung <[email protected]>
drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
Hersen Wu <[email protected]>
drm/amd/display: Add array index check for hdcp ddc access
Hersen Wu <[email protected]>
drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range
Alex Hung <[email protected]>
drm/amd/display: Check index for aux_rd_interval before using
Alex Hung <[email protected]>
drm/amd/display: Fix incorrect size calculation for loop
Hersen Wu <[email protected]>
drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
Hersen Wu <[email protected]>
drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
Alex Hung <[email protected]>
drm/amd/display: Check gpio_id before used as array index
Alex Hung <[email protected]>
drm/amd/display: Ensure array index tg_inst won't be -1
Zhigang Luo <[email protected]>
drm/amdgpu: avoid reading vf2pf info size from FB
Francois Dugast <[email protected]>
drm/xe/gt: Fix assert in L3 bank mask generation
Tim Huang <[email protected]>
drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
Tim Huang <[email protected]>
drm/amdgpu: fix uninitialized scalar variable warning
Jesse Zhang <[email protected]>
drm/amd/pm: fix the Out-of-bounds read warning
Tim Huang <[email protected]>
drm/amd/pm: fix uninitialized variable warning for smu_v13
Jesse Zhang <[email protected]>
drm/amd/pm: Fix negative array index read
Jesse Zhang <[email protected]>
drm/amd/pm: fix warning using uninitialized value of max_vid_step
Tim Huang <[email protected]>
drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
Jesse Zhang <[email protected]>
drm/amd/pm: fix uninitialized variable warning
Ma Jun <[email protected]>
drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
Tim Huang <[email protected]>
drm/amdgpu: fix overflowed array index read warning
Philip Yang <[email protected]>
drm/amdgpu: Handle sg size limit for contiguous allocation
Alvin Lee <[email protected]>
drm/amd/display: Assign linear_pitch_alignment even for VM
Rodrigo Siqueira <[email protected]>
drm/amd/display: Handle the case which quad_part is equal 0
Joshua Aberback <[email protected]>
Revert "drm/amd/display: Fix incorrect pointer assignment"
Ma Jun <[email protected]>
drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: test for flush/re-add endpoints
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check re-re-adding ID 0 signal
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: validate event numbers
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check re-adding init endp with != id
Matthieu Baerts (NGI0) <[email protected]>
selftests: mptcp: join: check re-using ID of unused ADD_ADDR
Paolo Abeni <[email protected]>
selftests: mptcp: add explicit test case for remove/readd
Johan Hovold <[email protected]>
arm64: dts: qcom: x1e80100-qcp: fix missing PCIe4 gpios
Johan Hovold <[email protected]>
arm64: dts: qcom: x1e80100-qcp: fix up PCIe6a pinctrl node
Johan Hovold <[email protected]>
arm64: dts: qcom: x1e80100-crd: fix missing PCIe4 gpios
Johan Hovold <[email protected]>
arm64: dts: qcom: x1e80100-crd: fix up PCIe6a pinctrl node
Abel Vesa <[email protected]>
arm64: dts: qcom: x1e80100: Describe the PCIe 6a resources
Zhang Yi <[email protected]>
ASoC: codecs: ES8326: button detect issue
Krzysztof Stępniak <[email protected]>
ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
ZHANG Yuntian <[email protected]>
net: usb: qmi_wwan: add MeiG Smart SRM825L
Rik van Riel <[email protected]>
dma-debug: avoid deadlock between dma debug vs printk and netconsole
Heng Qi <[email protected]>
virtio-net: check feature before configuring the vq coalescing command
Richard Fitzgerald <[email protected]>
i2c: Fix conditional for substituting empty ACPI functions
Boris Burkov <[email protected]>
btrfs: fix qgroup reserve leaks in cow_file_range
Qu Wenruo <[email protected]>
btrfs: scrub: update last_physical after scrubbing one stripe
Qu Wenruo <[email protected]>
btrfs: factor out stripe length calculation into a helper
Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Add new ACPI ID AMDI0107
Luke D. Jones <[email protected]>
platform/x86/amd: pmf: Add quirk for ROG Ally X
Devyn Liu <[email protected]>
spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
Bruno Ancona <[email protected]>
ASoC: amd: yc: Support mic on HP 14-em0002la
Paulo Alcantara <[email protected]>
smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule
Takashi Iwai <[email protected]>
ALSA: seq: ump: Explicitly reset RPN with Null RPN
Takashi Iwai <[email protected]>
ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
Takashi Iwai <[email protected]>
ALSA: seq: ump: Use the common RPN/bank conversion context
Takashi Iwai <[email protected]>
ALSA: ump: Explicitly reset RPN with Null RPN
Takashi Iwai <[email protected]>
ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
Perry Yuan <[email protected]>
x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Mute speakers at suspend / shutdown
Takashi Iwai <[email protected]>
ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
Qu Wenruo <[email protected]>
btrfs: tree-checker: validate dref root and objectid
Peter Wang <[email protected]>
scsi: ufs: core: Bypass quick recovery if force reset is needed
Kyoungrul Kim <[email protected]>
scsi: ufs: core: Check LSDBS cap when !mcq
Philip Mueller <[email protected]>
drm: panel-orientation-quirks: Add quirk for OrangePi Neo
Qiuxu Zhuo <[email protected]>
drm/fb-helper: Don't schedule_work() to flush frame buffer during panic()
-------------
Diffstat:
Documentation/locking/hwspinlock.rst | 11 ++ Makefile | 4 +- arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 81 +++++++++++ arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 81 +++++++++++ arch/x86/kernel/cpu/amd.c | 2 +- block/blk-integrity.c | 2 - crypto/ecc.c | 2 +- drivers/base/regmap/regmap-spi.c | 3 +- drivers/cpufreq/scmi-cpufreq.c | 4 +- drivers/crypto/stm32/stm32-cryp.c | 6 +- drivers/dma/altera-msgdma.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 19 +++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 15 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 3 + drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 + drivers/gpu/drm/amd/amdgpu/df_v1_7.c | 2 + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 2 +- drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c | 2 +- drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/mmhub_v3_3.c | 2 +- drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c | 2 +- drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 3 +- drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 19 --- drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 2 - drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_int_process_v9.c | 4 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 9 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 49 ++++--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 18 ++- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 7 +- .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + .../gpu/drm/amd/display/dc/core/dc_link_exports.c | 3 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc_state.c | 10 +- drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 2 +- drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c | 3 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 + drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c | 2 +- .../gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c | 7 +- .../gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 10 ++ .../gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 10 ++ .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 10 ++ .../gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 10 ++ .../gpu/drm/amd/display/dc/dml/display_mode_vba.c | 7 +- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 17 ++- drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 17 ++- .../drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c | 3 + .../drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 2 +- .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 +- .../display/dc/link/protocols/link_dp_capability.c | 26 ++-- .../display/dc/link/protocols/link_dp_training.c | 4 +- .../drm/amd/display/dc/link/protocols/link_dpcd.c | 1 + .../amd/display/dc/resource/dce80/dce80_resource.c | 1 + .../amd/display/dc/resource/dcn31/dcn31_resource.c | 1 + .../display/dc/resource/dcn314/dcn314_resource.c | 4 +- .../amd/display/dc/resource/dcn35/dcn35_resource.c | 2 + .../display/dc/resource/dcn351/dcn351_resource.c | 1 + drivers/gpu/drm/amd/display/dmub/src/dmub_dcn35.c | 5 +- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 +++- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 2 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c | 13 +- .../gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 29 +++- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 2 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 15 +- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 60 ++++++-- .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 20 ++- .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 31 ++-- .../drm/amd/pm/powerplay/smumgr/vega10_smumgr.c | 6 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 4 + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 5 + drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 31 +++- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 4 + drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 14 ++ drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 +- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 55 ++++--- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 5 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 28 +--- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 28 +--- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 + .../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 28 +--- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 5 + drivers/gpu/drm/bridge/tc358767.c | 2 +- drivers/gpu/drm/drm_bridge.c | 5 - drivers/gpu/drm/drm_fb_helper.c | 11 ++ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/meson/meson_plane.c | 17 ++- drivers/gpu/drm/xe/xe_force_wake.h | 13 +- drivers/gpu/drm/xe/xe_gt_ccs_mode.c | 4 +- drivers/gpu/drm/xe/xe_gt_topology.c | 4 +- drivers/gpu/drm/xe/xe_guc_relay.c | 9 +- drivers/gpu/drm/xe/xe_guc_submit.c | 5 + drivers/gpu/drm/xe/xe_hwmon.c | 9 +- drivers/gpu/drm/xe/xe_migrate.c | 55 +++++-- drivers/gpu/drm/xe/xe_pcode.c | 6 +- drivers/hwmon/k10temp.c | 36 +++-- drivers/hwspinlock/hwspinlock_core.c | 28 ++++ drivers/hwspinlock/hwspinlock_internal.h | 3 + drivers/iio/industrialio-core.c | 7 +- drivers/iio/industrialio-event.c | 9 ++ drivers/iio/inkern.c | 32 +++-- drivers/infiniband/hw/efa/efa_com.c | 30 ++-- drivers/media/usb/uvc/uvc_driver.c | 18 ++- drivers/media/v4l2-core/v4l2-cci.c | 9 ++ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 +- .../ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/virtio_net.c | 6 + drivers/net/wireless/ath/ath11k/qmi.c | 2 +- drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- drivers/net/wireless/ath/ath12k/qmi.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 3 +- drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 1 - drivers/net/wireless/intel/iwlwifi/mvm/link.c | 14 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 - .../net/wireless/intel/iwlwifi/mvm/tests/links.c | 1 + drivers/net/wireless/realtek/rtw89/ser.c | 8 +- drivers/pci/controller/dwc/pcie-al.c | 16 ++- drivers/pinctrl/core.c | 1 + drivers/pinctrl/renesas/pinctrl-rzg2l.c | 12 +- drivers/platform/chrome/cros_ec_lpc_mec.c | 76 +++++++++- drivers/platform/chrome/cros_ec_lpc_mec.h | 11 ++ drivers/platform/x86/amd/pmf/core.c | 3 + drivers/platform/x86/amd/pmf/pmf-quirks.c | 9 +- drivers/ras/amd/atl/dehash.c | 43 ------ drivers/ras/amd/atl/map.c | 77 ++++++++++ drivers/remoteproc/mtk_scp.c | 2 +- drivers/remoteproc/qcom_q6v5_pas.c | 11 ++ drivers/soc/qcom/smem.c | 26 ++++ drivers/spi/spi-hisi-kunpeng.c | 1 + drivers/thermal/thermal_sysfs.c | 6 +- drivers/thermal/thermal_trip.c | 2 +- drivers/ufs/core/ufshcd.c | 19 ++- drivers/ufs/host/ufs-qcom.c | 6 +- drivers/usb/typec/ucsi/ucsi.h | 2 +- drivers/usb/usbip/stub_rx.c | 77 ++++++---- fs/btrfs/inode.c | 3 + fs/btrfs/scrub.c | 25 +++- fs/btrfs/tree-checker.c | 47 ++++++ fs/f2fs/f2fs.h | 2 +- fs/f2fs/inline.c | 20 ++- fs/f2fs/inode.c | 2 +- fs/gfs2/quota.c | 19 +-- fs/gfs2/util.c | 6 +- fs/notify/fsnotify.c | 31 ++-- fs/notify/fsnotify.h | 2 +- fs/notify/mark.c | 32 ++++- fs/smb/client/smb2inode.c | 6 +- include/clocksource/timer-xilinx.h | 2 +- include/linux/fsnotify_backend.h | 8 +- include/linux/hwspinlock.h | 6 + include/linux/i2c.h | 2 +- include/linux/soc/qcom/smem.h | 2 + include/net/inet_timewait_sock.h | 6 +- include/net/ip.h | 3 +- include/net/tcp.h | 2 +- include/sound/ump_convert.h | 1 + include/ufs/ufshcd.h | 1 + include/ufs/ufshci.h | 1 + kernel/dma/debug.c | 5 +- kernel/rcu/tree.h | 1 - kernel/rcu/tree_nocb.h | 32 +---- mm/filemap.c | 2 +- net/dccp/minisocks.c | 3 +- net/ipv4/fib_semantics.c | 5 +- net/ipv4/inet_timewait_sock.c | 52 ++++++- net/ipv4/metrics.c | 8 +- net/ipv4/tcp_cong.c | 11 +- net/ipv4/tcp_ipv4.c | 14 +- net/ipv4/tcp_minisocks.c | 25 ++-- net/ipv6/route.c | 2 +- net/ipv6/tcp_ipv6.c | 6 +- net/mac80211/main.c | 3 +- net/wireless/ibss.c | 5 +- net/wireless/mesh.c | 5 +- net/wireless/nl80211.c | 21 ++- net/wireless/scan.c | 46 ++++-- security/apparmor/apparmorfs.c | 4 + security/smack/smack_lsm.c | 2 +- sound/core/seq/seq_ports.h | 14 +- sound/core/seq/seq_ump_convert.c | 97 ++++++++----- sound/core/ump_convert.c | 60 +++++--- sound/pci/hda/hda_generic.c | 63 ++++++++ sound/pci/hda/hda_generic.h | 1 + sound/pci/hda/patch_conexant.c | 2 + sound/soc/amd/yc/acp6x-mach.c | 14 ++ sound/soc/codecs/es8326.c | 2 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 160 ++++++++++++++++++++- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 4 + 211 files changed, 2049 insertions(+), 696 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/184 drm/fb-helper: Dont schedule_work() to flush frame buffer during panic()
6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 833cd3e9ad8360785b6c23c82dd3856df00732d9 ]
Sometimes the system [1] hangs on x86 I/O machine checks. However, the expected behavior is to reboot the system, as the machine check handler ultimately triggers a panic(), initiating a reboot in the last step.
The root cause is that sometimes the panic() is blocked when drm_fb_helper_damage() invoking schedule_work() to flush the frame buffer. This occurs during the process of flushing all messages to the frame buffer driver as shown in the following call trace:
Machine check occurs [2]:
panic()
console_flush_on_panic()
console_flush_all()
console_emit_next_record()
con->write()
vt_console_print()
hide_cursor()
vc->vc_sw->con_cursor()
fbcon_cursor()
ops->cursor()
bit_cursor()
soft_cursor()
info->fbops->fb_imageblit()
drm_fbdev_generic_defio_imageblit()
drm_fb_helper_damage_area()
drm_fb_helper_damage()
schedule_work() // <--- blocked here
...
emergency_restart() // wasn't invoked, so no reboot.During panic(), except the panic CPU, all the other CPUs are stopped. In schedule_work(), the panic CPU requires the lock of worker_pool to queue the work on that pool, while the lock may have been token by some other stopped CPU. So schedule_work() is blocked.
Additionally, during a panic(), since there is no opportunity to execute any scheduled work, it's safe to fix this issue by skipping schedule_work() on 'oops_in_progress' in drm_fb_helper_damage().
[1] Enable the kernel option CONFIG_FRAMEBUFFER_CONSOLE, CONFIG_DRM_FBDEV_EMULATION, and boot with the 'console=tty0' kernel command line parameter.
[2] Set 'panic_timeout' to a non-zero value before calling panic().
--- drivers/gpu/drm/drm_fb_helper.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/gpu/drm/drm_fb_helper.c +11 -0
@@ -631,6 +631,17 @@ static void drm_fb_helper_add_damage_clip(struct drm_fb_helper *helper, u32 x, ustatic void drm_fb_helper_damage (struct drm_fb_helper *helper,u32 x,u32 y,u32 width,u32 height) { +/* +* This function may be invoked by panic() to flush the frame +* buffer, where all CPUs except the panic CPU are stopped. +* During the following schedule_work(), the panic CPU needs +* the worker_pool lock, which might be held by a stopped CPU, +* causing schedule_work() and panic() to block. Return early on +* oops_in_progress to prevent this blocking. +*/ +if (oops_in_progress) +return ; +drm_fb_helper_add_damage_clip (helper, x, y, width, height);schedule_work (&helper->damage_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/184 drm: panel-orientation-quirks: Add quirk for OrangePi Neo
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Mueller <[email protected]>
[ Upstream commit d60c429610a14560085d98fa6f4cdb43040ca8f0 ]
This adds a DMI orientation quirk for the OrangePi Neo Linux Gaming Handheld.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -414,6 +414,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ONE XPLAYER"), }, .driver_data = (void *)&lcd1600x2560_leftside_up, + }, { /* OrangePi Neo */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"OrangePi" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "NEO-01"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, }, { /* Samsung GalaxyBook 10.6 */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/184 scsi: ufs: core: Check LSDBS cap when !mcq
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyoungrul Kim <[email protected]>
[ Upstream commit 0c60eb0cc320fffbb8b10329d276af14f6f5e6bf ]
If the user sets use_mcq_mode to 0, the host will try to activate the LSDB mode unconditionally even when the LSDBS of device HCI cap is 1. This makes commands time out and causes device probing to fail.
To prevent that problem, check the LSDBS cap when MCQ is not supported.
--- drivers/ufs/core/ufshcd.c | 16 ++++++++++++++++ include/ufs/ufshcd.h | 1 + include/ufs/ufshci.h | 1 + 3 files changed, 18 insertions(+)
drivers/ufs/core/ufshcd.c +16 -0
@@ -2412,7 +2412,17 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)return err; } +/* +* The UFSHCI 3.0 specification does not define MCQ_SUPPORT and +* LSDB_SUPPORT, but [31:29] as reserved bits with reset value 0s, which +* means we can simply read values regardless of version. +*/ hba->mcq_sup =FIELD_GET (MASK_MCQ_SUPPORT , hba->capabilities); +/* +* 0h: legacy single doorbell support is available +* 1h: indicate that legacy single doorbell support has been removed +*/ + hba->lsdb_sup = !FIELD_GET (MASK_LSDB_SUPPORT , hba->capabilities);if (!hba->mcq_sup)return 0 ;
@@ -10456,6 +10466,12 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) }if (!is_mcq_supported (hba)) { +if (!hba->lsdb_sup) { +dev_err (hba->dev,"%s: failed to initialize (legacy doorbell mode not supported)\n" , + __func__); + err = -EINVAL ; + goto out_disable; + } err =scsi_add_host (host, hba->dev);if (err) {dev_err (hba->dev,"scsi_add_host failed\n" );
include/ufs/ufshcd.h +1 -0
@@ -1074,6 +1074,7 @@ struct ufs_hba {bool ext_iid_sup;bool scsi_host_added;bool mcq_sup; +bool lsdb_sup;bool mcq_enabled;struct ufshcd_res_info res[RES_MAX ];void __iomem *mcq_base;
include/ufs/ufshci.h +1 -0
@@ -75,6 +75,7 @@ enum {MASK_OUT_OF_ORDER_DATA_DELIVERY_SUPPORT =0x02000000 ,MASK_UIC_DME_TEST_MODE_SUPPORT =0x04000000 ,MASK_CRYPTO_SUPPORT =0x10000000 , +MASK_LSDB_SUPPORT =0x20000000 , MASK_MCQ_SUPPORT = 0x40000000, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/184 scsi: ufs: core: Bypass quick recovery if force reset is needed
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Wang <[email protected]>
[ Upstream commit 022587d8aec3da1d1698ddae9fb8cfe35f3ad49c ]
If force_reset is true, bypass quick recovery. This will shorten error recovery time.
--- drivers/ufs/core/ufshcd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/ufs/core/ufshcd.c +2 -1
@@ -6560,7 +6560,8 @@ static void ufshcd_err_handler(struct work_struct *work)if (ufshcd_err_handling_should_stop (hba)) goto skip_err_handling; -if (hba->dev_quirks &UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS ) { +if ((hba->dev_quirks &UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS ) && + !hba->force_reset) {bool ret;spin_unlock_irqrestore (hba->host->host_lock, flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/184 btrfs: tree-checker: validate dref root and objectid
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit f333a3c7e8323499aa65038e77fe8f3199d4e283 ]
[CORRUPTION]
There is a bug report that btrfs flips RO due to a corruption in the extent tree, the involved dumps looks like this:
item 188 key (402811572224 168 4096) itemoff 14598 itemsize 79
extent refs 3 gen 3678544 flags 1
ref#0: extent data backref root 13835058055282163977 objectid 281473384125923 offset 81432576 count 1 ref#1: shared data backref parent 1947073626112 count 1
ref#2: shared data backref parent 1156030103552 count 1
BTRFS critical (device vdc1: state EA): unable to find ref byte nr 402811572224 parent 0 root 265 owner 28703026 offset 81432576 slot 189 BTRFS error (device vdc1: state EA): failed to run delayed ref for logical 402811572224 num_bytes 4096 type 178 action 2 ref_mod 1: -2
[CAUSE]
The corrupted entry is ref#0 of item 188.
The root number 13835058055282163977 is beyond the upper limit for root items (the current limit is 1 << 48), and the objectid also looks suspicious.
Only the offset and count is correct.
[ENHANCEMENT]
Although it's still unknown why we have such many bytes corrupted randomly, we can still enhance the tree-checker for data backrefs by:
- Validate the root value
For now there should only be 3 types of roots can have data backref:
* subvolume trees
* data reloc trees
* root tree
Only for v1 space cache
- validate the objectid value
The objectid should be a valid inode number.
Hopefully we can catch such problem in the future with the new checkers.
--- fs/btrfs/tree-checker.c | 47 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+)
fs/btrfs/tree-checker.c +47 -0
@@ -1272,6 +1272,19 @@ static void extent_err(const struct extent_buffer *eb, int slot,va_end (args); } +static bool is_valid_dref_root (u64 rootid) +{ +/* +* The following tree root objectids are allowed to have a data backref: +* - subvolume trees +* - data reloc tree +* - tree root +* For v1 space cache +*/ +return is_fstree (rootid) || rootid ==BTRFS_DATA_RELOC_TREE_OBJECTID || + rootid ==BTRFS_ROOT_TREE_OBJECTID ; +} +static int check_extent_item (struct extent_buffer *leaf,struct btrfs_key *key,int slot,struct btrfs_key *prev_key)
@@ -1424,6 +1437,8 @@ static int check_extent_item(struct extent_buffer *leaf,struct btrfs_extent_data_ref *dref;struct btrfs_shared_data_ref *sref;u64 seq; +u64 dref_root; +u64 dref_objectid;u64 dref_offset;u64 inline_offset;u8 inline_type;
@@ -1467,11 +1482,26 @@ static int check_extent_item(struct extent_buffer *leaf,*/ case BTRFS_EXTENT_DATA_REF_KEY : dref = (struct btrfs_extent_data_ref *)(&iref->offset); + dref_root =btrfs_extent_data_ref_root (leaf, dref); + dref_objectid =btrfs_extent_data_ref_objectid (leaf, dref); dref_offset =btrfs_extent_data_ref_offset (leaf, dref); seq =hash_extent_data_ref (btrfs_extent_data_ref_root (leaf, dref),btrfs_extent_data_ref_objectid (leaf, dref),btrfs_extent_data_ref_offset (leaf, dref)); +if (unlikely (!is_valid_dref_root (dref_root))) { +extent_err (leaf, slot, +"invalid data ref root value %llu" , + dref_root); +return -EUCLEAN ; + } +if (unlikely (dref_objectid <BTRFS_FIRST_FREE_OBJECTID || + dref_objectid >BTRFS_LAST_FREE_OBJECTID )) { +extent_err (leaf, slot, +"invalid data ref objectid value %llu" , + dref_root); +return -EUCLEAN ; + }if (unlikely (!IS_ALIGNED (dref_offset, fs_info->sectorsize))) { extent_err(leaf, slot,
@@ -1610,6 +1640,8 @@ static int check_extent_data_ref(struct extent_buffer *leaf,return -EUCLEAN ; }for (; ptr < end; ptr +=sizeof (*dref)) { +u64 root; +u64 objectid;u64 offset;/*
@@ -1617,7 +1649,22 @@ static int check_extent_data_ref(struct extent_buffer *leaf,* overflow from the leaf due to hash collisions. */ dref = (struct btrfs_extent_data_ref *)ptr; + root =btrfs_extent_data_ref_root (leaf, dref); + objectid =btrfs_extent_data_ref_objectid (leaf, dref); offset =btrfs_extent_data_ref_offset (leaf, dref); +if (unlikely (!is_valid_dref_root (root))) { +extent_err (leaf, slot, +"invalid extent data backref root value %llu" , + root); +return -EUCLEAN ; + } +if (unlikely (objectid <BTRFS_FIRST_FREE_OBJECTID || + objectid >BTRFS_LAST_FREE_OBJECTID )) { +extent_err (leaf, slot, +"invalid extent data backref objectid value %llu" , + root); +return -EUCLEAN ; + }if (unlikely (!IS_ALIGNED (offset, leaf->fs_info->sectorsize))) { extent_err(leaf, slot, "invalid extent data backref offset, have %llu expect aligned to %u",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/184 ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 6cd23b26b348fa52c88e1adf9c0e48d68e13f95e ]
Some devices indicate click noises at suspend or shutdown when the speakers are unmuted. This patch adds a helper, snd_hda_gen_shutup_speakers(), to work around it. The new function is supposed to be called at suspend or shutdown by the codec driver, and it mutes the speakers.
The mute status isn't cached, hence the original mute state will be restored at resume again.
--- sound/pci/hda/hda_generic.c | 63 +++++++++++++++++++++++++++++++++++++ sound/pci/hda/hda_generic.h | 1 + 2 files changed, 64 insertions(+)
sound/pci/hda/hda_generic.c +63 -0
@@ -4955,6 +4955,69 @@ void snd_hda_gen_stream_pm(struct hda_codec *codec, hda_nid_t nid, bool on) }EXPORT_SYMBOL_GPL (snd_hda_gen_stream_pm); +/* forcibly mute the speaker output without caching; return true if updated */ +static bool force_mute_output_path (struct hda_codec *codec,hda_nid_t nid) +{ +if (!nid) +return false; +if (!nid_has_mute (codec, nid,HDA_OUTPUT )) +return false;/* no mute, skip */ +if (snd_hda_codec_amp_read (codec, nid,0 ,HDA_OUTPUT ,0 ) & +snd_hda_codec_amp_read (codec, nid,1 ,HDA_OUTPUT ,0 ) & +HDA_AMP_MUTE ) +return false;/* both channels already muted, skip */ + +/* direct amp update without caching */ +snd_hda_codec_write (codec, nid,0 ,AC_VERB_SET_AMP_GAIN_MUTE , +AC_AMP_SET_OUTPUT |AC_AMP_SET_LEFT | +AC_AMP_SET_RIGHT |HDA_AMP_MUTE ); +return true; +} + +/** +* snd_hda_gen_shutup_speakers - Forcibly mute the speaker outputs +* @codec: the HDA codec +* +* Forcibly mute the speaker outputs, to be called at suspend or shutdown. +* +* The mute state done by this function isn't cached, hence the original state +* will be restored at resume. +* +* Return true if the mute state has been changed. +*/ +bool snd_hda_gen_shutup_speakers (struct hda_codec *codec) +{ +struct hda_gen_spec *spec = codec->spec; +const int *paths; +const struct nid_path *path; +int i, p, num_paths; +bool updated = false; + +/* if already powered off, do nothing */ +if (!snd_hdac_is_power_on (&codec->core)) +return false; + +if (spec->autocfg.line_out_type ==AUTO_PIN_SPEAKER_OUT ) { + paths = spec->out_paths; + num_paths = spec->autocfg.line_outs; + }else { + paths = spec->speaker_paths; + num_paths = spec->autocfg.speaker_outs; + } + +for (i =0 ; i < num_paths; i++) { + path =snd_hda_get_path_from_idx (codec, paths[i]); +if (!path) +continue ; +for (p =0 ; p < path->depth; p++) +if (force_mute_output_path (codec, path->path[p])) + updated = true; + } + +return updated; +} +EXPORT_SYMBOL_GPL (snd_hda_gen_shutup_speakers); +/** * snd_hda_gen_parse_auto_config - Parse the given BIOS configuration and * set up the hda_gen_spec
sound/pci/hda/hda_generic.h +1 -0
@@ -353,5 +353,6 @@ int snd_hda_gen_add_mute_led_cdev(struct hda_codec *codec,int snd_hda_gen_add_micmute_led_cdev (struct hda_codec *codec,int (*callback)(struct led_classdev *,enum led_brightness )); +bool snd_hda_gen_shutup_speakers (struct hda_codec *codec);#endif /* __SOUND_HDA_GENERIC_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/184 ALSA: hda/conexant: Mute speakers at suspend / shutdown
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 4f61c8fe35202702426cfc0003e15116a01ba885 ]
Use the new helper to mute speakers at suspend / shutdown for avoiding click noises.
--- sound/pci/hda/patch_conexant.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_conexant.c +2 -0
@@ -205,6 +205,8 @@ static void cx_auto_shutdown(struct hda_codec *codec) {struct conexant_spec *spec = codec->spec; +snd_hda_gen_shutup_speakers (codec); +/* Turn the problematic codec into D3 to avoid spurious noises from the internal speaker during (and after) reboot */ cx_auto_turn_eapd (codec, spec->num_eapds, spec->eapds, false);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/184 x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Perry Yuan <[email protected]>
[ Upstream commit bf5641eccf71bcd13a849930e190563c3a19815d ]
Add some new Zen5 models for the 0x1A family.
[ bp: Merge the 0x60 and 0x70 ranges. ]
--- arch/x86/kernel/cpu/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/amd.c +1 -1
@@ -462,7 +462,7 @@ static void bsp_init_amd(struct cpuinfo_x86 *c)switch (c->x86_model) { case 0x00 ... 0x2f: case 0x40 ... 0x4f: - case 0x70 ... 0x7f: + case 0x60 ... 0x7f:setup_force_cpu_cap (X86_FEATURE_ZEN5 );break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/184 ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit e6ce8a28c768dbbad3f818db286cd0f4c7a921a8 ]
The UMP 1.1 spec says that an RPN/NRPN should be sent when one of the following occurs:
* a CC 38 is received
* a subsequent CC 6 is received
* a CC 98, 99, 100, and 101 is received, indicating the last RPN/NRPN message has ended and a new one has started
That said, we should send a partial data even if it's not fully filled. Let's change the UMP conversion helper code to follow that rule.
--- include/sound/ump_convert.h | 1 + sound/core/ump_convert.c | 49 ++++++++++++++++++++++++------------- 2 files changed, 33 insertions(+), 17 deletions(-)
include/sound/ump_convert.h +1 -0
@@ -13,6 +13,7 @@ struct ump_cvt_to_ump_bank {unsigned char cc_nrpn_msb, cc_nrpn_lsb;unsigned char cc_data_msb, cc_data_lsb;unsigned char cc_bank_msb, cc_bank_lsb; +bool cc_data_msb_set, cc_data_lsb_set; };/* context for converting from MIDI1 byte stream to UMP packet */
sound/core/ump_convert.c +32 -17
99 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/184 ALSA: ump: Explicitly reset RPN with Null RPN
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 50a6dd19dca9446475f023eaa652016bfe5b1cbe ]
RPN with 127:127 is treated as a Null RPN, just to reset the parameters, and it's not translated to MIDI2. Although the current code can work as is in most cases, better to implement the RPN reset explicitly for Null message.
--- sound/core/ump_convert.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
sound/core/ump_convert.c +14 -5
@@ -287,6 +287,15 @@ static int cvt_legacy_system_to_ump(struct ump_cvt_to_ump *cvt,return 4 ; } +static void reset_rpn (struct ump_cvt_to_ump_bank *cc) +{ + cc->rpn_set =0 ; + cc->nrpn_set =0 ; + cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; + cc->cc_data_msb = cc->cc_data_lsb =0 ; + cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +} +static int fill_rpn (struct ump_cvt_to_ump_bank *cc,union snd_ump_midi2_msg *midi2,bool flush)
@@ -312,11 +321,7 @@ static int fill_rpn(struct ump_cvt_to_ump_bank *cc, midi2->rpn.data =upscale_14_to_32bit ((cc->cc_data_msb <<7 ) | cc->cc_data_lsb); - cc->rpn_set =0 ; - cc->nrpn_set =0 ; - cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; - cc->cc_data_msb = cc->cc_data_lsb =0 ; - cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +reset_rpn (cc);return 1 ; }
@@ -374,11 +379,15 @@ static int cvt_legacy_cmd_to_ump(struct ump_cvt_to_ump *cvt, ret =fill_rpn (cc, midi2, true); cc->rpn_set =1 ; cc->cc_rpn_msb = buf[2 ]; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_RPN_LSB : ret =fill_rpn (cc, midi2, true); cc->rpn_set =1 ; cc->cc_rpn_lsb = buf[2 ]; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_NRPN_MSB : ret =fill_rpn (cc, midi2, true);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/184 ALSA: seq: ump: Use the common RPN/bank conversion context
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a683030606fa5ff8b722a5e28839d19288011ede ]
The UMP core conversion helper API already defines the context needed to record the bank and RPN/NRPN values, and we can simply re-use the same struct instead of re-defining the same content as a different name.
--- sound/core/seq/seq_ports.h | 14 ++------------ sound/core/seq/seq_ump_convert.c | 10 +++++----- 2 files changed, 7 insertions(+), 17 deletions(-)
sound/core/seq/seq_ports.h +2 -12
@@ -7,6 +7,7 @@#define __SND_SEQ_PORTS_H#include <sound/seq_kernel.h> +#include <sound/ump_convert.h> #include "seq_lock.h" /* list of 'exported' ports */
@@ -42,17 +43,6 @@ struct snd_seq_port_subs_info {int (*close)(void *private_data,struct snd_seq_port_subscribe *info); }; -/* context for converting from legacy control event to UMP packet */ -struct snd_seq_ump_midi2_bank { -bool rpn_set; -bool nrpn_set; -bool bank_set; -unsigned char cc_rpn_msb, cc_rpn_lsb; -unsigned char cc_nrpn_msb, cc_nrpn_lsb; -unsigned char cc_data_msb, cc_data_lsb; -unsigned char cc_bank_msb, cc_bank_lsb; -}; -struct snd_seq_client_port {struct snd_seq_addr addr;/* client/port number */
@@ -88,7 +78,7 @@ struct snd_seq_client_port {unsigned char ump_group;#if IS_ENABLED (CONFIG_SND_SEQ_UMP ) -struct snd_seq_ump_midi2_bank midi2_bank[16 ];/* per channel */ +struct ump_cvt_to_ump_bank midi2_bank[16 ];/* per channel */ #endif };
sound/core/seq/seq_ump_convert.c +5 -5
@@ -368,7 +368,7 @@ static int cvt_ump_midi1_to_midi2(struct snd_seq_client *dest,struct snd_seq_ump_event ev_cvt;const union snd_ump_midi1_msg *midi1 = (const union snd_ump_midi1_msg *)event->ump;union snd_ump_midi2_msg *midi2 = (union snd_ump_midi2_msg *)ev_cvt.ump; -struct snd_seq_ump_midi2_bank *cc; +struct ump_cvt_to_ump_bank *cc; ev_cvt = *event;memset (&ev_cvt.ump,0 ,sizeof (ev_cvt.ump));
@@ -790,7 +790,7 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event, }/* set up the MIDI2 RPN/NRPN packet data from the parsed info */ -static void fill_rpn (struct snd_seq_ump_midi2_bank *cc, +static void fill_rpn (struct ump_cvt_to_ump_bank *cc,union snd_ump_midi2_msg *data,unsigned char channel) {
@@ -822,7 +822,7 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event,unsigned char channel = event->data.control.channel &0x0f ;unsigned char index = event->data.control.param &0x7f ;unsigned char val = event->data.control.value &0x7f ; -struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel]; +struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];/* process special CC's (bank/rpn/nrpn) */ switch (index) {
@@ -887,7 +887,7 @@ static int pgm_ev_to_ump_midi2(const struct snd_seq_event *event, unsigned char status) {unsigned char channel = event->data.control.channel &0x0f ; -struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel]; +struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel]; data->pg.status = status; data->pg.channel = channel;
@@ -924,7 +924,7 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, {unsigned char channel = event->data.control.channel &0x0f ;unsigned char index = event->data.control.param &0x7f ; -struct snd_seq_ump_midi2_bank *cc = &dest_port->midi2_bank[channel]; +struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];unsigned char msb, lsb; msb = (event->data.control.value >>7 ) &0x7f ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/184 ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a4ff92ff0bdd731eca9f0b50b1cbb5aba89be4b2 ]
Just like the core UMP conversion helper, we need to deal with the partially-filled RPN/NRPN data in the sequencer UMP converter as well.
--- sound/core/seq/seq_ump_convert.c | 74 +++++++++++++++++++------------- 1 file changed, 44 insertions(+), 30 deletions(-)
sound/core/seq/seq_ump_convert.c +44 -30
@@ -790,27 +790,39 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event, }/* set up the MIDI2 RPN/NRPN packet data from the parsed info */ -static void fill_rpn (struct ump_cvt_to_ump_bank *cc, -union snd_ump_midi2_msg *data, -unsigned char channel) +static int fill_rpn (struct ump_cvt_to_ump_bank *cc, +union snd_ump_midi2_msg *data, +unsigned char channel, +bool flush) { +if (!(cc->cc_data_lsb_set || cc->cc_data_msb_set)) +return 0 ;// skip +/* when not flushing, wait for complete data set */ +if (!flush && (!cc->cc_data_lsb_set || !cc->cc_data_msb_set)) +return 0 ;// skip +if (cc->rpn_set) { data->rpn.status =UMP_MSG_STATUS_RPN ; data->rpn.bank = cc->cc_rpn_msb; data->rpn.index = cc->cc_rpn_lsb; - cc->rpn_set =0 ; - cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; - }else { + }else if (cc->nrpn_set) { data->rpn.status =UMP_MSG_STATUS_NRPN ; data->rpn.bank = cc->cc_nrpn_msb; data->rpn.index = cc->cc_nrpn_lsb; - cc->nrpn_set =0 ; - cc->cc_nrpn_msb = cc->cc_nrpn_lsb =0 ; + }else { +return 0 ;// skip } + data->rpn.data =upscale_14_to_32bit ((cc->cc_data_msb <<7 ) | cc->cc_data_lsb); data->rpn.channel = channel; + + cc->rpn_set =0 ; + cc->nrpn_set =0 ; + cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; cc->cc_data_msb = cc->cc_data_lsb =0 ; + cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +return 1 ; }/* convert CC event to MIDI 2.0 UMP */
@@ -823,28 +835,34 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event,unsigned char index = event->data.control.param &0x7f ;unsigned char val = event->data.control.value &0x7f ;struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel]; +int ret;/* process special CC's (bank/rpn/nrpn) */ switch (index) {case UMP_CC_RPN_MSB : + ret =fill_rpn (cc, data, channel, true); cc->rpn_set =1 ; cc->cc_rpn_msb = val; -return 0 ;// skip +return ret;case UMP_CC_RPN_LSB : + ret =fill_rpn (cc, data, channel, true); cc->rpn_set =1 ; cc->cc_rpn_lsb = val; -return 0 ;// skip +return ret;case UMP_CC_NRPN_MSB : + ret =fill_rpn (cc, data, channel, true); cc->nrpn_set =1 ; cc->cc_nrpn_msb = val; -return 0 ;// skip +return ret;case UMP_CC_NRPN_LSB : + ret =fill_rpn (cc, data, channel, true); cc->nrpn_set =1 ; cc->cc_nrpn_lsb = val; -return 0 ;// skip +return ret;case UMP_CC_DATA : + cc->cc_data_msb_set =1 ; cc->cc_data_msb = val; -return 0 ;// skip +return fill_rpn (cc, data, channel, false);case UMP_CC_BANK_SELECT : cc->bank_set =1 ; cc->cc_bank_msb = val;
@@ -854,11 +872,9 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event, cc->cc_bank_lsb = val;return 0 ;// skip case UMP_CC_DATA_LSB : + cc->cc_data_lsb_set =1 ; cc->cc_data_lsb = val; -if (!(cc->rpn_set || cc->nrpn_set)) -return 0 ;// skip -fill_rpn (cc, data, channel); -return 1 ; +return fill_rpn (cc, data, channel, false); } data->cc.status = status;
@@ -926,6 +942,7 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event,unsigned char index = event->data.control.param &0x7f ;struct ump_cvt_to_ump_bank *cc = &dest_port->midi2_bank[channel];unsigned char msb, lsb; +int ret; msb = (event->data.control.value >>7 ) &0x7f ; lsb = event->data.control.value &0x7f ;
@@ -939,28 +956,25 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, cc->cc_bank_lsb = lsb;return 0 ;// skip case UMP_CC_RPN_MSB : - cc->cc_rpn_msb = msb; - fallthrough;case UMP_CC_RPN_LSB : - cc->rpn_set =1 ; + ret =fill_rpn (cc, data, channel, true); + cc->cc_rpn_msb = msb; cc->cc_rpn_lsb = lsb; -return 0 ;// skip + cc->rpn_set =1 ; +return ret;case UMP_CC_NRPN_MSB : - cc->cc_nrpn_msb = msb; - fallthrough;case UMP_CC_NRPN_LSB : + ret =fill_rpn (cc, data, channel, true); + cc->cc_nrpn_msb = msb; cc->nrpn_set =1 ; cc->cc_nrpn_lsb = lsb; -return 0 ;// skip +return ret;case UMP_CC_DATA : - cc->cc_data_msb = msb; - fallthrough;case UMP_CC_DATA_LSB : + cc->cc_data_msb_set = cc->cc_data_lsb_set =1 ; + cc->cc_data_msb = msb; cc->cc_data_lsb = lsb; -if (!(cc->rpn_set || cc->nrpn_set)) -return 0 ;// skip -fill_rpn (cc, data, channel); -return 1 ; +return fill_rpn (cc, data, channel, false); } data->cc.status =UMP_MSG_STATUS_CC ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/184 ALSA: seq: ump: Explicitly reset RPN with Null RPN
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 98ea612dd1150adb61cd2a0e93875e1cc77e6b87 ]
RPN with 127:127 is treated as a Null RPN, just to reset the parameters, and it's not translated to MIDI2. Although the current code can work as is in most cases, better to implement the RPN reset explicitly for Null message.
--- sound/core/seq/seq_ump_convert.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
sound/core/seq/seq_ump_convert.c +16 -5
@@ -789,6 +789,15 @@ static int paf_ev_to_ump_midi2(const struct snd_seq_event *event,return 1 ; } +static void reset_rpn (struct ump_cvt_to_ump_bank *cc) +{ + cc->rpn_set =0 ; + cc->nrpn_set =0 ; + cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; + cc->cc_data_msb = cc->cc_data_lsb =0 ; + cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +} +/* set up the MIDI2 RPN/NRPN packet data from the parsed info */ static int fill_rpn(struct ump_cvt_to_ump_bank *cc, union snd_ump_midi2_msg *data,
@@ -817,11 +826,7 @@ static int fill_rpn(struct ump_cvt_to_ump_bank *cc, cc->cc_data_lsb); data->rpn.channel = channel; - cc->rpn_set =0 ; - cc->nrpn_set =0 ; - cc->cc_rpn_msb = cc->cc_rpn_lsb =0 ; - cc->cc_data_msb = cc->cc_data_lsb =0 ; - cc->cc_data_msb_set = cc->cc_data_lsb_set =0 ; +reset_rpn (cc);return 1 ; }
@@ -843,11 +848,15 @@ static int cc_ev_to_ump_midi2(const struct snd_seq_event *event, ret =fill_rpn (cc, data, channel, true); cc->rpn_set =1 ; cc->cc_rpn_msb = val; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_RPN_LSB : ret =fill_rpn (cc, data, channel, true); cc->rpn_set =1 ; cc->cc_rpn_lsb = val; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_NRPN_MSB : ret =fill_rpn (cc, data, channel, true);
@@ -961,6 +970,8 @@ static int ctrl14_ev_to_ump_midi2(const struct snd_seq_event *event, cc->cc_rpn_msb = msb; cc->cc_rpn_lsb = lsb; cc->rpn_set =1 ; +if (cc->cc_rpn_msb ==0x7f && cc->cc_rpn_lsb ==0x7f ) +reset_rpn (cc);return ret;case UMP_CC_NRPN_MSB :case UMP_CC_NRPN_LSB :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/184 net/mlx5: DR, Fix stack guard page was hit error in dr_rule
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yevgeny Kliteynik <[email protected]>
[ Upstream commit 94a3ad6c081381fa9ee523781789802b4ed00faf ]
This patch reduces the size of hw_ste_arr_optimized array that is allocated on stack from 640 bytes (5 match STEs + 5 action STES) to 448 bytes (2 match STEs + 5 action STES).
This fixes the 'stack guard page was hit' issue, while still fitting majority of the usecases (up to 2 match STEs).
--- drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +1 -1
@@ -7,7 +7,7 @@/* don't try to optimize STE allocation if the stack is too constaraining */ #define DR_RULE_MAX_STES_OPTIMIZED 0#else -#define DR_RULE_MAX_STES_OPTIMIZED 5 +#define DR_RULE_MAX_STES_OPTIMIZED 2#endif #define DR_RULE_MAX_STE_CHAIN_OPTIMIZED (DR_RULE_MAX_STES_OPTIMIZED + DR_ACTION_MAX_STES)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/184 smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit ddecea00f87f0c46e9c8339a7c89fb2ff891521a ]
NetApp server requires the file to be open with FILE_READ_EA access in order to support FSCTL_GET_REPARSE_POINT, otherwise it will return STATUS_INVALID_DEVICE_REQUEST. It doesn't make any sense because there's no requirement for FILE_READ_EA bit to be set nor STATUS_INVALID_DEVICE_REQUEST being used for something other than "unsupported reparse points" in MS-FSA.
To fix it and improve compatibility, set FILE_READ_EA & SYNCHRONIZE bits to match what Windows client currently does.
--- fs/smb/client/smb2inode.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/smb/client/smb2inode.c +4 -2
@@ -950,7 +950,8 @@ int smb2_query_path_info(const unsigned int xid, cmds[num_cmds++] =SMB2_OP_GET_REPARSE ; oparms =CIFS_OPARMS (cifs_sb, tcon, full_path, -FILE_READ_ATTRIBUTES |FILE_READ_EA , +FILE_READ_ATTRIBUTES | +FILE_READ_EA |SYNCHRONIZE ,FILE_OPEN , create_options |OPEN_REPARSE_POINT ,ACL_NO_MODE );cifs_get_readable_path (tcon, full_path, &cfile);
@@ -1258,7 +1259,8 @@ int smb2_query_reparse_point(const unsigned int xid,cifs_dbg (FYI ,"%s: path: %s\n" , __func__, full_path);cifs_get_readable_path (tcon, full_path, &cfile); - oparms =CIFS_OPARMS (cifs_sb, tcon, full_path,FILE_READ_ATTRIBUTES , + oparms =CIFS_OPARMS (cifs_sb, tcon, full_path, +FILE_READ_ATTRIBUTES |FILE_READ_EA |SYNCHRONIZE ,FILE_OPEN ,OPEN_REPARSE_POINT ,ACL_NO_MODE ); rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, &in_iov,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/184 ASoC: amd: yc: Support mic on HP 14-em0002la
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bruno Ancona <[email protected]>
[ Upstream commit c118478665f467e57d06b2354de65974b246b82b ]
Add support for the internal microphone for HP 14-em0002la laptop using a quirk entry.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -430,6 +430,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_BOARD_NAME, "8A3E"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"HP" ), + DMI_MATCH(DMI_BOARD_NAME, "8B27"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/184 spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devyn Liu <[email protected]>
[ Upstream commit c3c4f22b7c814a6ee485ce294065836f8ede30fa ]
The speed specified by the user is used to calculate the clk_div based on the max_speed_hz in hisi_calc_effective_speed. A very low speed value can lead to a clk_div larger than the variable range. Avoid this by setting the min_speed_hz so that such a small speed value is rejected. __spi_validate() in spi.c will return -EINVAL for the specified speed_hz lower than min_speed_hz.
--- drivers/spi/spi-hisi-kunpeng.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-hisi-kunpeng.c +1 -0
@@ -495,6 +495,7 @@ static int hisi_spi_probe(struct platform_device *pdev) host->transfer_one = hisi_spi_transfer_one; host->handle_err = hisi_spi_handle_err; host->dev.fwnode = dev->fwnode; + host->min_speed_hz =DIV_ROUND_UP (host->max_speed_hz,CLK_DIV_MAX );hisi_spi_hw_init (hs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/184 platform/x86/amd: pmf: Add quirk for ROG Ally X
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke D. Jones <[email protected]>
[ Upstream commit 4c83ee4bf32ea8e57ae2321906c067d69ad7c41b ]
The ASUS ROG Ally X has the same issue as the G14 where it advertises SPS support but doesn't use it.
--- drivers/platform/x86/amd/pmf/pmf-quirks.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/platform/x86/amd/pmf/pmf-quirks.c +8 -1
@@ -29,6 +29,14 @@ static const struct dmi_system_id fwbug_list[] = { }, .driver_data = &quirk_no_sps_bug, }, + { + .ident = "ROG Ally X", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "RC72LA"), + }, + .driver_data = &quirk_no_sps_bug, + }, {} };
@@ -48,4 +56,3 @@ void amd_pmf_quirks_init(struct amd_pmf_dev *dev) dmi_id->ident); } } -
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/184 platform/x86/amd/pmf: Add new ACPI ID AMDI0107
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Sundar S K <[email protected]>
[ Upstream commit 942810c0e89277d738b7f1b6f379d0a5877999f6 ]
Add new ACPI ID AMDI0107 used by upcoming AMD platform to the PMF supported list of devices.
--- drivers/platform/x86/amd/pmf/core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/amd/pmf/core.c +3 -0
@@ -41,6 +41,7 @@#define AMD_CPU_ID_RMB 0x14b5#define AMD_CPU_ID_PS 0x14e8#define PCI_DEVICE_ID_AMD_1AH_M20H_ROOT 0x1507 +#define PCI_DEVICE_ID_AMD_1AH_M60H_ROOT 0x1122#define PMF_MSG_DELAY_MIN_US 50#define RESPONSE_REGISTER_LOOP_MAX 20000
@@ -249,6 +250,7 @@ static const struct pci_device_id pmf_pci_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_RMB) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_PS) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_ROOT) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_ROOT) }, { } };
@@ -382,6 +384,7 @@ static const struct acpi_device_id amd_pmf_acpi_ids[] = { {"AMDI0102", 0}, {"AMDI0103", 0}, {"AMDI0105", 0}, + {"AMDI0107", 0}, { } };MODULE_DEVICE_TABLE (acpi, amd_pmf_acpi_ids);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/184 btrfs: factor out stripe length calculation into a helper
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 33eb1e5db351e2c0e652d878b66b8a6d4d013135 ]
Currently there are two locations which need to calculate the real length of a stripe (which can be at the end of a chunk, and the chunk size may not always be 64K aligned).
Factor them into a helper as we're going to have a third user soon.
--- fs/btrfs/scrub.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
fs/btrfs/scrub.c +10 -6
@@ -1648,14 +1648,20 @@ static void scrub_reset_stripe(struct scrub_stripe *stripe) } } +static u32 stripe_length (const struct scrub_stripe *stripe) +{ +ASSERT (stripe->bg); + +return min (BTRFS_STRIPE_LEN , + stripe->bg->start + stripe->bg->length - stripe->logical); +} +static void scrub_submit_extent_sector_read (struct scrub_ctx *sctx,struct scrub_stripe *stripe) {struct btrfs_fs_info *fs_info = stripe->bg->fs_info;struct btrfs_bio *bbio =NULL ; -unsigned int nr_sectors =min (BTRFS_STRIPE_LEN , stripe->bg->start + - stripe->bg->length - stripe->logical) >> - fs_info->sectorsize_bits; +unsigned int nr_sectors =stripe_length (stripe) >> fs_info->sectorsize_bits;u64 stripe_len =BTRFS_STRIPE_LEN ;int mirror = stripe->mirror_num;int i;
@@ -1729,9 +1735,7 @@ static void scrub_submit_initial_read(struct scrub_ctx *sctx, {struct btrfs_fs_info *fs_info = sctx->fs_info;struct btrfs_bio *bbio; -unsigned int nr_sectors =min (BTRFS_STRIPE_LEN , stripe->bg->start + - stripe->bg->length - stripe->logical) >> - fs_info->sectorsize_bits; +unsigned int nr_sectors =stripe_length (stripe) >> fs_info->sectorsize_bits;int mirror = stripe->mirror_num;ASSERT (stripe->bg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/184 btrfs: scrub: update last_physical after scrubbing one stripe
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 63447b7dd40c6a9ae8d3bb70c11f4c46731823e3 ]
Currently sctx->stat.last_physical only got updated in the following cases:
- When the last stripe of a non-RAID56 chunk is scrubbed This implies a pitfall, if the last stripe is at the chunk boundary, and we finished the scrub of the whole chunk, we won't update last_physical at all until the next chunk.
- When a P/Q stripe of a RAID56 chunk is scrubbed
This leads the following two problems:
- sctx->stat.last_physical is not updated for a almost full chunk This is especially bad, affecting scrub resume, as the resume would start from last_physical, causing unnecessary re-scrub.
- "btrfs scrub status" will not report any progress for a long time
Fix the problem by properly updating @last_physical after each stripe is scrubbed.
And since we're here, for the sake of consistency, use spin lock to protect the update of @last_physical, just like all the remaining call sites touching sctx->stat.
--- fs/btrfs/scrub.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/btrfs/scrub.c +9 -0
@@ -1875,6 +1875,9 @@ static int flush_scrub_stripes(struct scrub_ctx *sctx) stripe = &sctx->stripes[i];wait_scrub_stripe_io (stripe); +spin_lock (&sctx->stat_lock); + sctx->stat.last_physical = stripe->physical +stripe_length (stripe); +spin_unlock (&sctx->stat_lock);scrub_reset_stripe (stripe); } out:
@@ -2143,7 +2146,9 @@ static int scrub_simple_mirror(struct scrub_ctx *sctx, cur_physical, &found_logical);if (ret >0 ) {/* No more extent, just update the accounting */ +spin_lock (&sctx->stat_lock); sctx->stat.last_physical = physical + logical_length; +spin_unlock (&sctx->stat_lock); ret =0 ;break ; }
@@ -2340,6 +2345,10 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx, stripe_logical += chunk_logical; ret =scrub_raid56_parity_stripe (sctx, scrub_dev, bg, map, stripe_logical); +spin_lock (&sctx->stat_lock); + sctx->stat.last_physical =min (physical +BTRFS_STRIPE_LEN , + physical_end); +spin_unlock (&sctx->stat_lock);if (ret) goto out; goto next;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/184 btrfs: fix qgroup reserve leaks in cow_file_range
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 30479f31d44d47ed00ae0c7453d9b253537005b2 ]
In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent.
Therefore, any errors that occur before the ordered_extent is created must free that reservation, or else the space is leaked. The fstest generic/475 exercises various IO error paths, and is able to trigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear delalloc, we are likely to remove the inode from the delalloc list, so the inodes/pages to not have invalidate/launder called on them in the commit abort path.
This results in failures at the unmount stage of the test that look like:
BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure
BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672
------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 Call Trace: <TASK> ? close_ctree+0x222/0x4d0 [btrfs] ? __warn.cold+0x8e/0xea ? close_ctree+0x222/0x4d0 [btrfs] ? report_bug+0xff/0x140 ? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] generic_shutdown_super+0x70/0x160 kill_anon_super+0x11/0x40 btrfs_kill_super+0x11/0x20 [btrfs] deactivate_locked_super+0x2e/0xa0 cleanup_mnt+0xb5/0x150 task_work_run+0x57/0x80 syscall_exit_to_user_mode+0x121/0x130 do_syscall_64+0xab/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f916847a887 ---[ end trace 0000000000000000 ]--- BTRFS error (device dm-8 state EA): qgroup reserved space leaked
Cases 2 and 3 in the out_reserve path both pertain to this type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the possible errors in btrfs_free_qgroup_data.
--- fs/btrfs/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/inode.c +3 -0
@@ -1586,6 +1586,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, locked_page, &cached, clear_bits, page_ops); +btrfs_qgroup_free_data (inode,NULL , start, cur_alloc_size,NULL ); start += cur_alloc_size; }
@@ -1599,6 +1600,7 @@ static noinline int cow_file_range(struct btrfs_inode *inode, clear_bits |=EXTENT_CLEAR_DATA_RESV ;extent_clear_unlock_delalloc (inode, start, end, locked_page, &cached, clear_bits, page_ops); +btrfs_qgroup_free_data (inode,NULL , start, cur_alloc_size,NULL ); }return ret; }
@@ -2269,6 +2271,7 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode,EXTENT_DO_ACCOUNTING ,PAGE_UNLOCK |PAGE_START_WRITEBACK | PAGE_END_WRITEBACK); +btrfs_qgroup_free_data (inode,NULL , cur_offset, end - cur_offset +1 ,NULL ); }btrfs_free_path (path);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/184 i2c: Fix conditional for substituting empty ACPI functions
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit f17c06c6608ad4ecd2ccf321753fb511812d821b ]
Add IS_ENABLED(CONFIG_I2C) to the conditional around a bunch of ACPI functions.
The conditional around these functions depended only on CONFIG_ACPI. But the functions are implemented in I2C core, so are only present if CONFIG_I2C is enabled.
--- include/linux/i2c.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/i2c.h +1 -1
@@ -1053,7 +1053,7 @@ static inline int of_i2c_get_board_info(struct device *dev,struct acpi_resource ;struct acpi_resource_i2c_serialbus ; -#if IS_ENABLED (CONFIG_ACPI ) +#if IS_ENABLED (CONFIG_ACPI ) &&IS_ENABLED (CONFIG_I2C )bool i2c_acpi_get_i2c_resource (struct acpi_resource *ares,struct acpi_resource_i2c_serialbus **i2c);int i2c_acpi_client_count (struct acpi_device *adev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/184 virtio-net: check feature before configuring the vq coalescing command
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heng Qi <[email protected]>
[ Upstream commit b50f2af9fbc5c00103ca8b72752b15310bd77762 ]
Virtio spec says:
The driver MUST have negotiated the VIRTIO_NET_F_VQ_NOTF_COAL feature when issuing commands VIRTIO_NET_CTRL_NOTF_COAL_VQ_SET and VIRTIO_NET_CTRL_NOTF_COAL_VQ_GET.
So we add the feature negotiation check to virtnet_send_{r,t}x_ctrl_coal_vq_cmd as a basis for the next bugfix patch.
--- drivers/net/virtio_net.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/virtio_net.c +6 -0
@@ -3172,6 +3172,9 @@ static int virtnet_send_rx_ctrl_coal_vq_cmd(struct virtnet_info *vi, {int err; +if (!virtio_has_feature (vi->vdev,VIRTIO_NET_F_VQ_NOTF_COAL )) +return -EOPNOTSUPP ; + err =virtnet_send_ctrl_coal_vq_cmd (vi,rxq2vq (queue), max_usecs, max_packets);if (err)
@@ -3189,6 +3192,9 @@ static int virtnet_send_tx_ctrl_coal_vq_cmd(struct virtnet_info *vi, {int err; +if (!virtio_has_feature (vi->vdev,VIRTIO_NET_F_VQ_NOTF_COAL )) +return -EOPNOTSUPP ; + err =virtnet_send_ctrl_coal_vq_cmd (vi,txq2vq (queue), max_usecs, max_packets);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/184 dma-debug: avoid deadlock between dma debug vs printk and netconsole
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit bd44ca3de49cc1badcff7a96010fa2c64f04868c ]
Currently the dma debugging code can end up indirectly calling printk under the radix_lock. This happens when a radix tree node allocation fails.
This is a problem because the printk code, when used together with netconsole, can end up inside the dma debugging code while trying to transmit a message over netcons.
This creates the possibility of either a circular deadlock on the same CPU, with that CPU trying to grab the radix_lock twice, or an ABBA deadlock between different CPUs, where one CPU grabs the console lock first and then waits for the radix_lock, while the other CPU is holding the radix_lock and is waiting for the console lock.
The trace captured by lockdep is of the ABBA variant.
-> #2 (&dma_entry_hash[i].lock){-.-.}-{2:2}:
_raw_spin_lock_irqsave+0x5a/0x90
debug_dma_map_page+0x79/0x180
dma_map_page_attrs+0x1d2/0x2f0
bnxt_start_xmit+0x8c6/0x1540
netpoll_start_xmit+0x13f/0x180
netpoll_send_skb+0x20d/0x320
netpoll_send_udp+0x453/0x4a0
write_ext_msg+0x1b9/0x460
console_flush_all+0x2ff/0x5a0
console_unlock+0x55/0x180
vprintk_emit+0x2e3/0x3c0
devkmsg_emit+0x5a/0x80
devkmsg_write+0xfd/0x180
do_iter_readv_writev+0x164/0x1b0
vfs_writev+0xf9/0x2b0
do_writev+0x6d/0x110
do_syscall_64+0x80/0x150
entry_SYSCALL_64_after_hwframe+0x4b/0x53-> #0 (console_owner){-.-.}-{0:0}:
__lock_acquire+0x15d1/0x31a0
lock_acquire+0xe8/0x290
console_flush_all+0x2ea/0x5a0
console_unlock+0x55/0x180
vprintk_emit+0x2e3/0x3c0
_printk+0x59/0x80
warn_alloc+0x122/0x1b0
__alloc_pages_slowpath+0x1101/0x1120
__alloc_pages+0x1eb/0x2c0
alloc_slab_page+0x5f/0x150
new_slab+0x2dc/0x4e0
___slab_alloc+0xdcb/0x1390
kmem_cache_alloc+0x23d/0x360
radix_tree_node_alloc+0x3c/0xf0
radix_tree_insert+0xf5/0x230
add_dma_entry+0xe9/0x360
dma_map_page_attrs+0x1d2/0x2f0
__bnxt_alloc_rx_frag+0x147/0x180
bnxt_alloc_rx_data+0x79/0x160
bnxt_rx_skb+0x29/0xc0
bnxt_rx_pkt+0xe22/0x1570
__bnxt_poll_work+0x101/0x390
bnxt_poll+0x7e/0x320
__napi_poll+0x29/0x160
net_rx_action+0x1e0/0x3e0
handle_softirqs+0x190/0x510
run_ksoftirqd+0x4e/0x90
smpboot_thread_fn+0x1a8/0x270
kthread+0x102/0x120
ret_from_fork+0x2f/0x40
ret_from_fork_asm+0x11/0x20This bug is more likely than it seems, because when one CPU has run out of memory, chances are the other has too.
The good news is, this bug is hidden behind the CONFIG_DMA_API_DEBUG, so not many users are likely to trigger it.
--- kernel/dma/debug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/dma/debug.c +4 -1
@@ -416,8 +416,11 @@ static unsigned long long phys_addr(struct dma_debug_entry *entry)* dma_active_cacheline entry to track per event. dma_map_sg(), on the * other hand, consumes a single dma_debug_entry, but inserts 'nents' * entries into the tree. +* +* Use __GFP_NOWARN because the printk from an OOM, to netconsole, could end +* up right back in the DMA debugging code, leading to a deadlock. */ -static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC); +static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC | __GFP_NOWARN);static DEFINE_SPINLOCK (radix_lock);#define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)#define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/184 net: usb: qmi_wwan: add MeiG Smart SRM825L
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZHANG Yuntian <[email protected]>
[ Upstream commit 1ca645a2f74a4290527ae27130c8611391b07dbf ]
Add support for MeiG Smart SRM825L which is based on Qualcomm 315 chip.
T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=2dee ProdID=4d22 Rev= 4.14 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=6f345e48 C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1432,6 +1432,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1546, 0x1312, 4)}, /* u-blox LARA-R6 01B */ {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */ {QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */ + {QMI_FIXED_INTF(0x2dee, 0x4d22, 5)}, /* MeiG Smart SRM825L *//* 4. Gobi 1000 devices */ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/184 ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Stępniak <[email protected]>
[ Upstream commit 23a58b782f864951485d7a0018549729e007cb43 ]
Lenovo Thinkpad E14 Gen 6 (model type 21M3)
needs a quirk entry for internal mic to work.
--- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/amd/yc/acp6x-mach.c +7 -0
@@ -220,6 +220,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "21J6"), } }, + { + .driver_data = &acp6x_card, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "21M3"), + } + }, { .driver_data = &acp6x_card, .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/184 ASoC: codecs: ES8326: button detect issue
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 4684a2df9c5b3fc914377127faf2515aa9049093 ]
We find that we need to set snd_jack_types to 0. If not, there will be a probability of button detection errors
--- sound/soc/codecs/es8326.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/es8326.c +2 -0
@@ -825,6 +825,8 @@ static void es8326_jack_detect_handler(struct work_struct *work)es8326_disable_micbias (es8326->component);if (es8326->jack->status &SND_JACK_HEADPHONE ) {dev_dbg (comp->dev,"Report hp remove event\n" ); +snd_soc_jack_report (es8326->jack,0 , +SND_JACK_BTN_0 |SND_JACK_BTN_1 |SND_JACK_BTN_2 );snd_soc_jack_report (es8326->jack,0 ,SND_JACK_HEADSET );/* mute adc when mic path switch */ regmap_write (es8326->regmap,ES8326_ADC1_SRC ,0x44 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/184 arm64: dts: qcom: x1e80100: Describe the PCIe 6a resources
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <[email protected]>
[ Upstream commit eb57cbe730d10ec8c6505492a9f3252b160e0f1e ]
On both the CRD and QCP, on PCIe 6a sits the NVMe. Add the 3.3V gpio-controlled regulator and the clkreq, perst and wake gpios as resources for the PCIe 6a.
Stable-dep-of: 42b33ad18846 ("arm64: dts: qcom: x1e80100-crd: fix missing PCIe4 gpios")
--- arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 52 +++++++++++++++++++++++ arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 52 +++++++++++++++++++++++ 2 files changed, 104 insertions(+)
arch/arm64/boot/dts/qcom/x1e80100-crd.dts +52 -0
@@ -173,6 +173,20 @@ regulator-always-on; regulator-boot-on; }; + + vreg_nvme: regulator-nvme { + compatible = "regulator-fixed"; + + regulator-name = "VREG_NVME_3P3"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + + gpio = <&tlmm 18 GPIO_ACTIVE_HIGH>; + enable-active-high; + + pinctrl-names = "default"; + pinctrl-0 = <&nvme_reg_en>; + }; }; &apps_rsc {
@@ -655,6 +669,14 @@ }; &pcie6a { + perst-gpios = <&tlmm 152 GPIO_ACTIVE_LOW>; + wake-gpios = <&tlmm 154 GPIO_ACTIVE_LOW>; + + vddpe-3v3-supply = <&vreg_nvme>; + + pinctrl-names = "default"; + pinctrl-0 = <&pcie6a_default>; + status = "okay"; };
@@ -804,6 +826,36 @@ bias-disable; }; + nvme_reg_en: nvme-reg-en-state { + pins = "gpio18"; + function = "gpio"; + drive-strength = <2>; + bias-disable; + }; + + pcie6a_default: pcie2a-default-state { + clkreq-n-pins { + pins = "gpio153"; + function = "pcie6a_clk"; + drive-strength = <2>; + bias-pull-up; + }; + + perst-n-pins { + pins = "gpio152"; + function = "gpio"; + drive-strength = <2>; + bias-pull-down; + }; + + wake-n-pins { + pins = "gpio154"; + function = "gpio"; + drive-strength = <2>; + bias-pull-up; + }; + }; + tpad_default: tpad-default-state { pins = "gpio3"; function = "gpio";
arch/arm64/boot/dts/qcom/x1e80100-qcp.dts +52 -0
70 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/184 arm64: dts: qcom: x1e80100-crd: fix up PCIe6a pinctrl node
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 6e3902c499544291ac4fd1a1bb69f2e9037a0e86 ]
The PCIe6a pinctrl node appears to have been copied from the sc8280xp CRD dts, which has the NVMe on pcie2a and uses some funny indentation.
Fix up the node name to match the x1e80100 use and label and use only tabs for indentation.
Stable-dep-of: 42b33ad18846 ("arm64: dts: qcom: x1e80100-crd: fix missing PCIe4 gpios")
--- arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/qcom/x1e80100-crd.dts +6 -6
@@ -833,7 +833,7 @@ bias-disable; }; - pcie6a_default: pcie2a-default-state { + pcie6a_default: pcie6a-default-state { clkreq-n-pins { pins = "gpio153"; function = "pcie6a_clk";
@@ -849,11 +849,11 @@ }; wake-n-pins { - pins = "gpio154"; - function = "gpio"; - drive-strength = <2>; - bias-pull-up; - }; + pins = "gpio154"; + function = "gpio"; + drive-strength = <2>; + bias-pull-up; + }; }; tpad_default: tpad-default-state {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/184 arm64: dts: qcom: x1e80100-crd: fix missing PCIe4 gpios
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 42b33ad188466292eaac9825544b8be8deddb3cb ]
Add the missing PCIe4 perst, wake and clkreq GPIOs and pin config.
--- arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 29 +++++++++++++++++++++++ 1 file changed, 29 insertions(+)
arch/arm64/boot/dts/qcom/x1e80100-crd.dts +29 -0
@@ -658,6 +658,12 @@ }; &pcie4 { + perst-gpios = <&tlmm 146 GPIO_ACTIVE_LOW>; + wake-gpios = <&tlmm 148 GPIO_ACTIVE_LOW>; + + pinctrl-0 = <&pcie4_default>; + pinctrl-names = "default"; + status = "okay"; };
@@ -833,6 +839,29 @@ bias-disable; }; + pcie4_default: pcie4-default-state { + clkreq-n-pins { + pins = "gpio147"; + function = "pcie4_clk"; + drive-strength = <2>; + bias-pull-up; + }; + + perst-n-pins { + pins = "gpio146"; + function = "gpio"; + drive-strength = <2>; + bias-disable; + }; + + wake-n-pins { + pins = "gpio148"; + function = "gpio"; + drive-strength = <2>; + bias-pull-up; + }; + }; + pcie6a_default: pcie6a-default-state { clkreq-n-pins { pins = "gpio153";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/184 arm64: dts: qcom: x1e80100-qcp: fix up PCIe6a pinctrl node
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 0aab6eaac72ac140dfc5e0a38bf3178497762e43 ]
The PCIe6a pinctrl node appears to have been copied from the sc8280xp CRD dts, which has the NVMe on pcie2a and uses some funny indentation.
Fix up the node name to match the x1e80100 use and label and use only tabs for indentation.
Stable-dep-of: 2ac90e4d2b6d ("arm64: dts: qcom: x1e80100-qcp: fix missing PCIe4 gpios")
--- arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/qcom/x1e80100-qcp.dts +6 -6
@@ -558,7 +558,7 @@ bias-disable; }; - pcie6a_default: pcie2a-default-state { + pcie6a_default: pcie6a-default-state { clkreq-n-pins { pins = "gpio153"; function = "pcie6a_clk";
@@ -574,11 +574,11 @@ }; wake-n-pins { - pins = "gpio154"; - function = "gpio"; - drive-strength = <2>; - bias-pull-up; - }; + pins = "gpio154"; + function = "gpio"; + drive-strength = <2>; + bias-pull-up; + }; }; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/184 arm64: dts: qcom: x1e80100-qcp: fix missing PCIe4 gpios
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 2ac90e4d2b6d6823ca10642ef39595ff1181c3fa ]
Add the missing PCIe4 perst, wake and clkreq GPIOs and pin config.
--- arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 29 +++++++++++++++++++++++ 1 file changed, 29 insertions(+)
arch/arm64/boot/dts/qcom/x1e80100-qcp.dts +29 -0
@@ -469,6 +469,12 @@ }; &pcie4 { + perst-gpios = <&tlmm 146 GPIO_ACTIVE_LOW>; + wake-gpios = <&tlmm 148 GPIO_ACTIVE_LOW>; + + pinctrl-0 = <&pcie4_default>; + pinctrl-names = "default"; + status = "okay"; };
@@ -558,6 +564,29 @@ bias-disable; }; + pcie4_default: pcie4-default-state { + clkreq-n-pins { + pins = "gpio147"; + function = "pcie4_clk"; + drive-strength = <2>; + bias-pull-up; + }; + + perst-n-pins { + pins = "gpio146"; + function = "gpio"; + drive-strength = <2>; + bias-disable; + }; + + wake-n-pins { + pins = "gpio148"; + function = "gpio"; + drive-strength = <2>; + bias-pull-up; + }; + }; + pcie6a_default: pcie6a-default-state { clkreq-n-pins { pins = "gpio153";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/184 selftests: mptcp: add explicit test case for remove/readd
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit b5e2fb832f48bc01d937a053e0550a1465a2f05d ]
Delete and re-create a signal endpoint and ensure that the PM actually deletes and re-create the subflow.
Stable-dep-of: 1c2326fcae4f ("selftests: mptcp: join: check re-adding init endp with != id")
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +29 -0
@@ -3626,6 +3626,35 @@ endpoint_tests() chk_join_nr 6 6 6 chk_rm_nr 4 4 fi + + # remove and re-add + if reset "delete re-add signal" && + mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + pm_nl_set_limits $ns1 1 1 + pm_nl_set_limits $ns2 1 1 + pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal + test_linkfail=4 speed=20 \ + run_tests $ns1 $ns2 10.0.1.1 & + local tests_pid=$! + + wait_mpj $ns2 + pm_nl_check_endpoint "creation" \ + $ns1 10.0.2.1 id 1 flags signal + chk_subflow_nr "before delete" 2 + chk_mptcp_info subflows 1 subflows 1 + + pm_nl_del_endpoint $ns1 1 10.0.2.1 + sleep 0.5 + chk_subflow_nr "after delete" 1 + chk_mptcp_info subflows 0 subflows 0 + + pm_nl_add_endpoint $ns1 10.0.2.1 flags signal + wait_mpj $ns2 + chk_subflow_nr "after re-add" 2 + chk_mptcp_info subflows 1 subflows 1 + mptcp_lib_kill_wait $tests_pid + fi + } # [$1: error message]
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/184 selftests: mptcp: join: check re-using ID of unused ADD_ADDR
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit a13d5aad4dd9a309eecdc33cfd75045bd5f376a3 ]
This test extends "delete re-add signal" to validate the previous commit. An extra address is announced by the server, but this address cannot be used by the client. The result is that no subflow will be established to this address.
Later, the server will delete this extra endpoint, and set a new one, with a valid address, but re-using the same ID. Before the previous commit, the server would not have been able to announce this new address.
While at it, extra checks have been added to validate the expected numbers of MPJ, ADD_ADDR and RM_ADDR.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
Stable-dep-of: 1c2326fcae4f ("selftests: mptcp: join: check re-adding init endp with != id")
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +13 -5
@@ -3630,9 +3630,11 @@ endpoint_tests() # remove and re-add if reset "delete re-add signal" && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then - pm_nl_set_limits $ns1 1 1 - pm_nl_set_limits $ns2 1 1 + pm_nl_set_limits $ns1 0 2 + pm_nl_set_limits $ns2 2 2 pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal + # broadcast IP: no packet for this address will be received on ns1 + pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal test_linkfail=4 speed=20 \ run_tests $ns1 $ns2 10.0.1.1 & local tests_pid=$!
@@ -3644,15 +3646,21 @@ endpoint_tests() chk_mptcp_info subflows 1 subflows 1 pm_nl_del_endpoint $ns1 1 10.0.2.1 + pm_nl_del_endpoint $ns1 2 224.0.0.1 sleep 0.5 chk_subflow_nr "after delete" 1 chk_mptcp_info subflows 0 subflows 0 - pm_nl_add_endpoint $ns1 10.0.2.1 flags signal + pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal + pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal wait_mpj $ns2 - chk_subflow_nr "after re-add" 2 - chk_mptcp_info subflows 1 subflows 1 + chk_subflow_nr "after re-add" 3 + chk_mptcp_info subflows 2 subflows 2 mptcp_lib_kill_wait $tests_pid + + chk_join_nr 3 3 3 + chk_add_nr 4 4 + chk_rm_nr 2 1 invert fi }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/184 selftests: mptcp: join: check re-adding init endp with != id
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit 1c2326fcae4f0c5de8ad0d734ced43a8e5f17dac ]
The initial subflow has a special local ID: 0. It is specific per connection.
When a global endpoint is deleted and re-added later, it can have a different ID, but the kernel should still use the ID 0 if it corresponds to the initial address.
This test validates this behaviour: the endpoint linked to the initial subflow is removed, and re-added with a different ID.
Note that removing the initial subflow will not decrement the 'subflows' counters, which corresponds to the *additional* subflows. On the other hand, when the same endpoint is re-added, it will increment this counter, as it will be seen as an additional subflow this time.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +16 -5
@@ -3630,11 +3630,12 @@ endpoint_tests() # remove and re-add if reset "delete re-add signal" && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then - pm_nl_set_limits $ns1 0 2 - pm_nl_set_limits $ns2 2 2 + pm_nl_set_limits $ns1 0 3 + pm_nl_set_limits $ns2 3 3 pm_nl_add_endpoint $ns1 10.0.2.1 id 1 flags signal # broadcast IP: no packet for this address will be received on ns1 pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal + pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal test_linkfail=4 speed=20 \ run_tests $ns1 $ns2 10.0.1.1 & local tests_pid=$!
@@ -3656,11 +3657,21 @@ endpoint_tests() wait_mpj $ns2 chk_subflow_nr "after re-add" 3 chk_mptcp_info subflows 2 subflows 2 + + pm_nl_del_endpoint $ns1 42 10.0.1.1 + sleep 0.5 + chk_subflow_nr "after delete ID 0" 2 + chk_mptcp_info subflows 2 subflows 2 + + pm_nl_add_endpoint $ns1 10.0.1.1 id 99 flags signal + wait_mpj $ns2 + chk_subflow_nr "after re-add" 3 + chk_mptcp_info subflows 3 subflows 3 mptcp_lib_kill_wait $tests_pid - chk_join_nr 3 3 3 - chk_add_nr 4 4 - chk_rm_nr 2 1 invert + chk_join_nr 4 4 4 + chk_add_nr 5 5 + chk_rm_nr 3 2 invert fi }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/184 selftests: mptcp: join: validate event numbers
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit 20ccc7c5f7a3aa48092441a4b182f9f40418392e ]
This test extends "delete and re-add" and "delete re-add signal" to validate the previous commit: the number of MPTCP events are checked to make sure there are no duplicated or unexpected ones.
A new helper has been introduced to easily check these events. The missing events have been added to the lib.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 74 ++++++++++++++++++- .../testing/selftests/net/mptcp/mptcp_lib.sh | 4 + 2 files changed, 75 insertions(+), 3 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +71 -3
@@ -420,12 +420,17 @@ reset_with_fail() fi } +start_events() +{ + mptcp_lib_events "${ns1}" "${evts_ns1}" evts_ns1_pid + mptcp_lib_events "${ns2}" "${evts_ns2}" evts_ns2_pid +} + reset_with_events() { reset "${1}" || return 1 - mptcp_lib_events "${ns1}" "${evts_ns1}" evts_ns1_pid - mptcp_lib_events "${ns2}" "${evts_ns2}" evts_ns2_pid + start_events } reset_with_tcp_filter()
@@ -3333,6 +3338,36 @@ userspace_pm_chk_get_addr() fi } +# $1: ns ; $2: event type ; $3: count +chk_evt_nr() +{ + local ns=${1} + local evt_name="${2}" + local exp="${3}" + + local evts="${evts_ns1}" + local evt="${!evt_name}" + local count + + evt_name="${evt_name:16}" # without MPTCP_LIB_EVENT_ + [ "${ns}" == "ns2" ] && evts="${evts_ns2}" + + print_check "event ${ns} ${evt_name} (${exp})" + + if [[ "${evt_name}" = "LISTENER_"* ]] && + ! mptcp_lib_kallsyms_has "mptcp_event_pm_listener$"; then + print_skip "event not supported" + return + fi + + count=$(grep -cw "type:${evt}" "${evts}") + if [ "${count}" != "${exp}" ]; then + fail_test "got ${count} events, expected ${exp}" + else + print_ok + fi +} + userspace_tests() { # userspace pm type prevents add_addr
@@ -3572,6 +3607,7 @@ endpoint_tests() if reset_with_tcp_filter "delete and re-add" ns2 10.0.3.2 REJECT OUTPUT && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + start_events pm_nl_set_limits $ns1 0 3 pm_nl_set_limits $ns2 0 3 pm_nl_add_endpoint $ns2 10.0.1.2 id 1 dev ns2eth1 flags subflow
@@ -3623,12 +3659,28 @@ endpoint_tests() mptcp_lib_kill_wait $tests_pid + kill_events_pids + chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_CREATED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_ESTABLISHED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_ANNOUNCED 0 + chk_evt_nr ns1 MPTCP_LIB_EVENT_REMOVED 4 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 6 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 4 + + chk_evt_nr ns2 MPTCP_LIB_EVENT_CREATED 1 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 0 + chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 0 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 6 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 5 # one has been closed before estab + chk_join_nr 6 6 6 chk_rm_nr 4 4 fi # remove and re-add - if reset "delete re-add signal" && + if reset_with_events "delete re-add signal" && mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 0 3 pm_nl_set_limits $ns2 3 3
@@ -3669,6 +3721,22 @@ endpoint_tests() chk_mptcp_info subflows 3 subflows 3 mptcp_lib_kill_wait $tests_pid + kill_events_pids + chk_evt_nr ns1 MPTCP_LIB_EVENT_LISTENER_CREATED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_CREATED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_ESTABLISHED 1 + chk_evt_nr ns1 MPTCP_LIB_EVENT_ANNOUNCED 0 + chk_evt_nr ns1 MPTCP_LIB_EVENT_REMOVED 0 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 4 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 2 + + chk_evt_nr ns2 MPTCP_LIB_EVENT_CREATED 1 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 5 + chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 3 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 4 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_join_nr 4 4 4 chk_add_nr 5 5 chk_rm_nr 3 2 invert
tools/testing/selftests/net/mptcp/mptcp_lib.sh +4 -0
@@ -9,10 +9,14 @@ readonly KSFT_SKIP=4 readonly KSFT_TEST="${MPTCP_LIB_KSFT_TEST:-$(basename "${0}" .sh)}" # These variables are used in some selftests, read-only +declare -rx MPTCP_LIB_EVENT_CREATED=1 # MPTCP_EVENT_CREATED +declare -rx MPTCP_LIB_EVENT_ESTABLISHED=2 # MPTCP_EVENT_ESTABLISHED +declare -rx MPTCP_LIB_EVENT_CLOSED=3 # MPTCP_EVENT_CLOSED declare -rx MPTCP_LIB_EVENT_ANNOUNCED=6 # MPTCP_EVENT_ANNOUNCED declare -rx MPTCP_LIB_EVENT_REMOVED=7 # MPTCP_EVENT_REMOVED declare -rx MPTCP_LIB_EVENT_SUB_ESTABLISHED=10 # MPTCP_EVENT_SUB_ESTABLISHED declare -rx MPTCP_LIB_EVENT_SUB_CLOSED=11 # MPTCP_EVENT_SUB_CLOSED +declare -rx MPTCP_LIB_EVENT_SUB_PRIORITY=13 # MPTCP_EVENT_SUB_PRIORITY declare -rx MPTCP_LIB_EVENT_LISTENER_CREATED=15 # MPTCP_EVENT_LISTENER_CREATED declare -rx MPTCP_LIB_EVENT_LISTENER_CLOSED=16 # MPTCP_EVENT_LISTENER_CLOSED
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/184 selftests: mptcp: join: check re-re-adding ID 0 signal
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
[ Upstream commit f18fa2abf81099d822d842a107f8c9889c86043c ]
This test extends "delete re-add signal" to validate the previous
commit: when the 'signal' endpoint linked to the initial subflow (ID 0) is re-added multiple times, it will re-send the ADD_ADDR with id 0. The client should still be able to re-create this subflow, even if the add_addr_accepted limit has been reached as this special address is not considered as a new address.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- .../testing/selftests/net/mptcp/mptcp_join.sh | 32 ++++++++++++------- 1 file changed, 21 insertions(+), 11 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +21 -11
@@ -3688,7 +3688,7 @@ endpoint_tests() # broadcast IP: no packet for this address will be received on ns1 pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal - test_linkfail=4 speed=20 \ + test_linkfail=4 speed=5 \ run_tests $ns1 $ns2 10.0.1.1 & local tests_pid=$!
@@ -3717,7 +3717,17 @@ endpoint_tests() pm_nl_add_endpoint $ns1 10.0.1.1 id 99 flags signal wait_mpj $ns2 - chk_subflow_nr "after re-add" 3 + chk_subflow_nr "after re-add ID 0" 3 + chk_mptcp_info subflows 3 subflows 3 + + pm_nl_del_endpoint $ns1 99 10.0.1.1 + sleep 0.5 + chk_subflow_nr "after re-delete ID 0" 2 + chk_mptcp_info subflows 2 subflows 2 + + pm_nl_add_endpoint $ns1 10.0.1.1 id 88 flags signal + wait_mpj $ns2 + chk_subflow_nr "after re-re-add ID 0" 3 chk_mptcp_info subflows 3 subflows 3 mptcp_lib_kill_wait $tests_pid
@@ -3727,19 +3737,19 @@ endpoint_tests() chk_evt_nr ns1 MPTCP_LIB_EVENT_ESTABLISHED 1 chk_evt_nr ns1 MPTCP_LIB_EVENT_ANNOUNCED 0 chk_evt_nr ns1 MPTCP_LIB_EVENT_REMOVED 0 - chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 4 - chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_ESTABLISHED 5 + chk_evt_nr ns1 MPTCP_LIB_EVENT_SUB_CLOSED 3 chk_evt_nr ns2 MPTCP_LIB_EVENT_CREATED 1 chk_evt_nr ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 - chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 5 - chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 3 - chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 4 - chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 + chk_evt_nr ns2 MPTCP_LIB_EVENT_ANNOUNCED 6 + chk_evt_nr ns2 MPTCP_LIB_EVENT_REMOVED 4 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_ESTABLISHED 5 + chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 3 - chk_join_nr 4 4 4 - chk_add_nr 5 5 - chk_rm_nr 3 2 invert + chk_join_nr 5 5 5 + chk_add_nr 6 6 + chk_rm_nr 4 3 invert fi }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/184 selftests: mptcp: join: test for flush/re-add endpoints
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <[email protected]>
commit e06959e9eebdfea4654390f53b65cff57691872e upstream.
After having flushed endpoints that didn't cause the creation of new subflows, it is important to check endpoints can be re-created, re-using previously used IDs.
Before the previous commit, the client would not have been able to re-create the subflow that was previously rejected.
The 'Fixes' tag here below is the same as the one from the previous
commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 30 ++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +30 -0
@@ -3752,6 +3752,36 @@ endpoint_tests() chk_rm_nr 4 3 invert fi + # flush and re-add + if reset_with_tcp_filter "flush re-add" ns2 10.0.3.2 REJECT OUTPUT && + mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then + pm_nl_set_limits $ns1 0 2 + pm_nl_set_limits $ns2 1 2 + # broadcast IP: no packet for this address will be received on ns1 + pm_nl_add_endpoint $ns1 224.0.0.1 id 2 flags signal + pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow + test_linkfail=4 speed=20 \ + run_tests $ns1 $ns2 10.0.1.1 & + local tests_pid=$! + + wait_attempt_fail $ns2 + chk_subflow_nr "before flush" 1 + chk_mptcp_info subflows 0 subflows 0 + + pm_nl_flush_endpoint $ns2 + pm_nl_flush_endpoint $ns1 + wait_rm_addr $ns2 0 + ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT + pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow + wait_mpj $ns2 + pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal + wait_mpj $ns2 + mptcp_lib_kill_wait $tests_pid + + chk_join_nr 2 2 2 + chk_add_nr 2 2 + chk_rm_nr 1 0 invert + fi } # [$1: error message]
Greg Kroah-Hartman
maintainerPATCH 40/184 drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit c0d6bd3cd209419cc46ac49562bef1db65d90e70 ]
Assign value to clock to fix the warning below:
"Using uninitialized value res. Field res.clock is uninitialized"
--- drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c +1 -0
@@ -100,6 +100,7 @@ struct amdgpu_afmt_acr amdgpu_afmt_acr(uint32_t clock)amdgpu_afmt_calc_cts (clock, &res.cts_32khz, &res.n_32khz,32000 );amdgpu_afmt_calc_cts (clock, &res.cts_44_1khz, &res.n_44_1khz,44100 );amdgpu_afmt_calc_cts (clock, &res.cts_48khz, &res.n_48khz,48000 ); + res.clock = clock;return res; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/184 Revert "drm/amd/display: Fix incorrect pointer assignment"
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Aberback <[email protected]>
[ Upstream commit 0c9c0674f81add3edb2bb992b3e89be8a44f03db ]
This reverts commit 0a571e8657c40047e6602466abfcb6514a391041.
[Why]
The change being reverted incorrectly assumes that a pointer type was intended, however copying to a new structure is correct. As well, there is no compiler error, it was instead an error in the testing framework being used.
--- drivers/gpu/drm/amd/display/dc/core/dc_state.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_state.c +5 -5
@@ -191,7 +191,7 @@ static void init_state(struct dc *dc, struct dc_state *state)struct dc_state *dc_state_create (struct dc *dc,struct dc_state_create_params *params) {#ifdef CONFIG_DRM_AMD_DC_FP -struct dml2_configuration_options *dml2_opt = &dc->dml2_options; +struct dml2_configuration_options dml2_opt = dc->dml2_options;#endif struct dc_state *state =kvzalloc (sizeof (struct dc_state ),GFP_KERNEL );
@@ -205,11 +205,11 @@ struct dc_state *dc_state_create(struct dc *dc, struct dc_state_create_params *p#ifdef CONFIG_DRM_AMD_DC_FP if (dc->debug.using_dml2) { - dml2_opt->use_clock_dc_limits = false; -dml2_create (dc, dml2_opt, &state->bw_ctx.dml2); + dml2_opt.use_clock_dc_limits = false; +dml2_create (dc, &dml2_opt, &state->bw_ctx.dml2); - dml2_opt->use_clock_dc_limits = true; -dml2_create (dc, dml2_opt, &state->bw_ctx.dml2_dc_power_source); + dml2_opt.use_clock_dc_limits = true; +dml2_create (dc, &dml2_opt, &state->bw_ctx.dml2_dc_power_source); }#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/184 drm/amd/display: Handle the case which quad_part is equal 0
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Siqueira <[email protected]>
[ Upstream commit 02fb803db110dbdac9f0d446180f0f7b545e15ff ]
Add code to handle case when quad_part is 0 in gpu_addr_to_uma().
--- drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/hwss/dcn201/dcn201_hwseq.c +3 -0
@@ -95,8 +95,11 @@ static bool gpu_addr_to_uma(struct dce_hwseq *hwseq, }else if (hwseq->fb_offset.quad_part <= addr->quad_part && addr->quad_part <= hwseq->uma_top.quad_part) { is_in_uma = true; + }else if (addr->quad_part ==0 ) { + is_in_uma = false; }else { is_in_uma = false; +BREAK_TO_DEBUGGER (); }return is_in_uma; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/184 drm/amd/display: Assign linear_pitch_alignment even for VM
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvin Lee <[email protected]>
[ Upstream commit 984debc133efa05e62f5aa1a7a1dd8ca0ef041f4 ]
[Description]
Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/core/dc.c +1 -0
@@ -1421,6 +1421,7 @@ struct dc *dc_create(const struct dc_init_data *init_params)return NULL ;if (init_params->dce_environment ==DCE_ENV_VIRTUAL_HW ) { + dc->caps.linear_pitch_alignment =64 ;if (!dc_construct_ctx (dc, init_params)) goto destruct_dc; }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/184 drm/amdgpu: Handle sg size limit for contiguous allocation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <[email protected]>
[ Upstream commit b2dba064c9bdd18c7dd39066d25453af28451dbf ]
Define macro AMDGPU_MAX_SG_SEGMENT_SIZE 2GB, because struct scatterlist length is unsigned int, and some users of it cast to a signed int, so every segment of sg table is limited to size 2GB maximum.
For contiguous VRAM allocation, don't limit the max buddy block size in order to get contiguous VRAM memory. To workaround the sg table segment size limit, allocate multiple segments if contiguous size is bigger than AMDGPU_MAX_SG_SEGMENT_SIZE.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +6 -6
@@ -31,6 +31,8 @@#include "amdgpu_atomfirmware.h" #include "atom.h" +#define AMDGPU_MAX_SG_SEGMENT_SIZE (2UL << 30) +struct amdgpu_vram_reservation {u64 start;u64 size;
@@ -518,9 +520,7 @@ static int amdgpu_vram_mgr_new(struct ttm_resource_manager *man,else min_block_size = mgr->default_page_size; -/* Limit maximum size to 2GiB due to SG table limitations */ - size =min (remaining_size,2ULL <<30 ); - + size = remaining_size;if ((size >= (u64 )pages_per_block <<PAGE_SHIFT ) && !(size & (((u64 )pages_per_block <<PAGE_SHIFT ) -1 ))) min_block_size = (u64 )pages_per_block <<PAGE_SHIFT ;
@@ -660,7 +660,7 @@ int amdgpu_vram_mgr_alloc_sgt(struct amdgpu_device *adev,amdgpu_res_first (res, offset, length, &cursor);while (cursor.remaining) { num_entries++; -amdgpu_res_next (&cursor, cursor.size); +amdgpu_res_next (&cursor,min (cursor.size,AMDGPU_MAX_SG_SEGMENT_SIZE )); } r =sg_alloc_table (*sgt, num_entries,GFP_KERNEL );
@@ -680,7 +680,7 @@ int amdgpu_vram_mgr_alloc_sgt(struct amdgpu_device *adev,amdgpu_res_first (res, offset, length, &cursor);for_each_sgtable_sg ((*sgt), sg, i) {phys_addr_t phys = cursor.start + adev->gmc.aper_base; -size_t size = cursor.size; +unsigned long size =min (cursor.size,AMDGPU_MAX_SG_SEGMENT_SIZE );dma_addr_t addr; addr = dma_map_resource(dev, phys, size, dir,
@@ -693,7 +693,7 @@ int amdgpu_vram_mgr_alloc_sgt(struct amdgpu_device *adev,sg_dma_address (sg) = addr;sg_dma_len (sg) = size; -amdgpu_res_next (&cursor, cursor.size); +amdgpu_res_next (&cursor, size); }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/184 drm/amdgpu: fix overflowed array index read warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit ebbc2ada5c636a6a63d8316a3408753768f5aa9f ]
Clear overflowed array index read warning by cast operation.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +2 -1
@@ -475,8 +475,9 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf, size_t size, loff_t *pos) { struct amdgpu_ring *ring = file_inode(f)->i_private; -int r, i;uint32_t value, result, early[3 ]; +loff_t i; +int r;if (*pos &3 || size &3 )return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/184 drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 579f0c21baec9e7506b6bb3f60f0a9b6d07693b4 ]
Check the return value of smum_send_msg_to_smc, otherwise we might use an uninitialized variable "now"
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +6 -2
@@ -1036,7 +1036,9 @@ static int smu10_print_clock_levels(struct pp_hwmgr *hwmgr,switch (type) {case PP_SCLK : -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetGfxclkFrequency, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetGfxclkFrequency, &now); +if (ret) +return ret;/* driver only know min/max gfx_clk, Add level 1 for all other gfx clks */ if (now == data->gfx_max_freq_limit/100 )
@@ -1057,7 +1059,9 @@ static int smu10_print_clock_levels(struct pp_hwmgr *hwmgr, i == 2 ? "*" : "");break ;case PP_MCLK : -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetFclkFrequency, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetFclkFrequency, &now); +if (ret) +return ret;for (i =0 ; i < mclk_table->count; i++) size += sprintf(buf + size, "%d: %uMhz %s\n",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/184 drm/amd/pm: fix uninitialized variable warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 7c836905520703dbc8b938993b6d4d718bc739f3 ]
Check the return of function smum_send_msg_to_smc as it may fail to initialize the variable.
--- drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c +1 -1
@@ -99,7 +99,7 @@ static void pp_swctf_delayed_work_handler(struct work_struct *work)struct amdgpu_device *adev = hwmgr->adev;struct amdgpu_dpm_thermal *range = &adev->pm.dpm.thermal; -uint32_t gpu_temperature, size; +uint32_t gpu_temperature, size =sizeof (gpu_temperature);int ret;/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/184 drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 86df36b934640866eb249a4488abb148b985a0d9 ]
Clear warnings that using uninitialized value level when fails to get the value from SMU.
--- .../gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu8_hwmgr.c +12 -3
@@ -584,6 +584,7 @@ static int smu8_init_uvd_limit(struct pp_hwmgr *hwmgr) hwmgr->dyn_state.uvd_clock_voltage_dependency_table;unsigned long clock =0 ;uint32_t level; +int ret;if (NULL == table || table->count <=0 )return -EINVAL ;
@@ -591,7 +592,9 @@ static int smu8_init_uvd_limit(struct pp_hwmgr *hwmgr) data->uvd_dpm.soft_min_clk =0 ; data->uvd_dpm.hard_min_clk =0 ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxUvdLevel, &level); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxUvdLevel, &level); +if (ret) +return ret;if (level < table->count) clock = table->entries[level].vclk;
@@ -611,6 +614,7 @@ static int smu8_init_vce_limit(struct pp_hwmgr *hwmgr) hwmgr->dyn_state.vce_clock_voltage_dependency_table;unsigned long clock =0 ;uint32_t level; +int ret;if (NULL == table || table->count <=0 )return -EINVAL ;
@@ -618,7 +622,9 @@ static int smu8_init_vce_limit(struct pp_hwmgr *hwmgr) data->vce_dpm.soft_min_clk =0 ; data->vce_dpm.hard_min_clk =0 ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxEclkLevel, &level); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxEclkLevel, &level); +if (ret) +return ret;if (level < table->count) clock = table->entries[level].ecclk;
@@ -638,6 +644,7 @@ static int smu8_init_acp_limit(struct pp_hwmgr *hwmgr) hwmgr->dyn_state.acp_clock_voltage_dependency_table;unsigned long clock =0 ;uint32_t level; +int ret;if (NULL == table || table->count <=0 )return -EINVAL ;
@@ -645,7 +652,9 @@ static int smu8_init_acp_limit(struct pp_hwmgr *hwmgr) data->acp_dpm.soft_min_clk =0 ; data->acp_dpm.hard_min_clk =0 ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxAclkLevel, &level); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxAclkLevel, &level); +if (ret) +return ret;if (level < table->count) clock = table->entries[level].acpclk;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/184 drm/amd/pm: fix warning using uninitialized value of max_vid_step
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 17e3bea65cdc453695b2fe4ff26d25d17f5339e9 ]
Check the return of pp_atomfwctrl_get_Voltage_table_v4 as it may fail to initialize max_vid_step
V2: change the check condition (Tim Huang)
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +4 -1
@@ -2571,8 +2571,11 @@ static int vega10_init_smc_table(struct pp_hwmgr *hwmgr) } } -pp_atomfwctrl_get_voltage_table_v4 (hwmgr,VOLTAGE_TYPE_VDDC , + result =pp_atomfwctrl_get_voltage_table_v4 (hwmgr,VOLTAGE_TYPE_VDDC ,VOLTAGE_OBJ_SVID2 , &voltage_table); +PP_ASSERT_WITH_CODE (!result, +"Failed to get voltage table!" , + return result); pp_table->MaxVidStep = voltage_table.max_vid_step; pp_table->GfxDpmVoltageMode =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/184 drm/amd/pm: Fix negative array index read
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit c8c19ebf7c0b202a6a2d37a52ca112432723db5f ]
Avoid using the negative values
for clk_idex as an index into an array pptable->DpmDescriptor.
V2: fix clk_index return check (Tim Huang)
--- .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 27 ++++++++++++++----- 1 file changed, 21 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +21 -6
@@ -1219,19 +1219,22 @@ static int navi10_get_current_clk_freq_by_table(struct smu_context *smu, value); } -static bool navi10_is_support_fine_grained_dpm (struct smu_context *smu,enum smu_clk_type clk_type) +static int navi10_is_support_fine_grained_dpm (struct smu_context *smu,enum smu_clk_type clk_type) {PPTable_t *pptable = smu->smu_table.driver_pptable;DpmDescriptor_t *dpm_desc =NULL ; -uint32_t clk_index =0 ; +int clk_index =0 ; clk_index =smu_cmn_to_asic_specific_index (smu,CMN2ASIC_MAPPING_CLK , clk_type); +if (clk_index <0 ) +return clk_index; + dpm_desc = &pptable->DpmDescriptor[clk_index];/* 0 - Fine grained DPM, 1 - Discrete DPM */ -return dpm_desc->SnapToDiscrete ==0 ; +return dpm_desc->SnapToDiscrete ==0 ?1 :0 ; }static inline bool navi10_od_feature_is_supported (struct smu_11_0_overdrive_table *od_table,enum SMU_11_0_ODFEATURE_CAP cap)
@@ -1287,7 +1290,11 @@ static int navi10_emit_clk_levels(struct smu_context *smu,if (ret)return ret; -if (!navi10_is_support_fine_grained_dpm (smu, clk_type)) { + ret =navi10_is_support_fine_grained_dpm (smu, clk_type); +if (ret <0 ) +return ret; + +if (!ret) {for (i =0 ; i < count; i++) { ret =smu_v11_0_get_dpm_freq_by_index (smu, clk_type, i, &value);
@@ -1496,7 +1503,11 @@ static int navi10_print_clk_levels(struct smu_context *smu,if (ret)return size; -if (!navi10_is_support_fine_grained_dpm (smu, clk_type)) { + ret =navi10_is_support_fine_grained_dpm (smu, clk_type); +if (ret <0 ) +return ret; + +if (!ret) {for (i =0 ; i < count; i++) { ret =smu_v11_0_get_dpm_freq_by_index (smu, clk_type, i, &value);if (ret)
@@ -1665,7 +1676,11 @@ static int navi10_force_clk_levels(struct smu_context *smu,case SMU_UCLK :case SMU_FCLK :/* There is only 2 levels for fine grained DPM */ -if (navi10_is_support_fine_grained_dpm (smu, clk_type)) { + ret =navi10_is_support_fine_grained_dpm (smu, clk_type); +if (ret <0 ) +return ret; + +if (ret) { soft_max_level = (soft_max_level >=1 ?1 :0 ); soft_min_level = (soft_min_level >=1 ?1 :0 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/184 drm/amd/pm: fix uninitialized variable warning for smu_v13
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 6e46b89f40e39e2054f2e179e8e8c3132e7a9d57 ]
Clear warning that using uninitialized variable when the dpm is not enabled and reuse the code for SMU13 to get the boot frequency.
--- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 4 ++ .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 55 +++++++++++++------ .../drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 28 +--------- .../drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 28 +--------- .../drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 28 +--------- 5 files changed, 51 insertions(+), 92 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +4 -0
@@ -298,5 +298,9 @@ int smu_v13_0_enable_uclk_shadow(struct smu_context *smu, bool enable);int smu_v13_0_set_wbrf_exclusion_ranges (struct smu_context *smu,struct freq_band_range *exclusion_ranges); + +int smu_v13_0_get_boot_freq_by_index (struct smu_context *smu, +enum smu_clk_type clk_type, +uint32_t *value);#endif #endif
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +38 -17
73 lines not on this page · raw message
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c +3 -25
@@ -758,31 +758,9 @@ static int smu_v13_0_4_get_dpm_ultimate_freq(struct smu_context *smu,int ret =0 ;if (!smu_v13_0_4_clk_dpm_is_enabled (smu, clk_type)) { -switch (clk_type) { -case SMU_MCLK : -case SMU_UCLK : - clock_limit = smu->smu_table.boot_values.uclk; -break ; -case SMU_FCLK : - clock_limit = smu->smu_table.boot_values.fclk; -break ; -case SMU_GFXCLK : -case SMU_SCLK : - clock_limit = smu->smu_table.boot_values.gfxclk; -break ; -case SMU_SOCCLK : - clock_limit = smu->smu_table.boot_values.socclk; -break ; -case SMU_VCLK : - clock_limit = smu->smu_table.boot_values.vclk; -break ; -case SMU_DCLK : - clock_limit = smu->smu_table.boot_values.dclk; -break ; -default : - clock_limit =0 ; -break ; - } + ret =smu_v13_0_get_boot_freq_by_index (smu, clk_type, &clock_limit); +if (ret) +return ret;/* clock in Mhz unit */ if (min)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c +3 -25
@@ -733,31 +733,9 @@ static int smu_v13_0_5_get_dpm_ultimate_freq(struct smu_context *smu,int ret =0 ;if (!smu_v13_0_5_clk_dpm_is_enabled (smu, clk_type)) { -switch (clk_type) { -case SMU_MCLK : -case SMU_UCLK : - clock_limit = smu->smu_table.boot_values.uclk; -break ; -case SMU_FCLK : - clock_limit = smu->smu_table.boot_values.fclk; -break ; -case SMU_GFXCLK : -case SMU_SCLK : - clock_limit = smu->smu_table.boot_values.gfxclk; -break ; -case SMU_SOCCLK : - clock_limit = smu->smu_table.boot_values.socclk; -break ; -case SMU_VCLK : - clock_limit = smu->smu_table.boot_values.vclk; -break ; -case SMU_DCLK : - clock_limit = smu->smu_table.boot_values.dclk; -break ; -default : - clock_limit =0 ; -break ; - } + ret =smu_v13_0_get_boot_freq_by_index (smu, clk_type, &clock_limit); +if (ret) +return ret;/* clock in Mhz unit */ if (min)
drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +3 -25
@@ -867,31 +867,9 @@ static int yellow_carp_get_dpm_ultimate_freq(struct smu_context *smu,int ret =0 ;if (!yellow_carp_clk_dpm_is_enabled (smu, clk_type)) { -switch (clk_type) { -case SMU_MCLK : -case SMU_UCLK : - clock_limit = smu->smu_table.boot_values.uclk; -break ; -case SMU_FCLK : - clock_limit = smu->smu_table.boot_values.fclk; -break ; -case SMU_GFXCLK : -case SMU_SCLK : - clock_limit = smu->smu_table.boot_values.gfxclk; -break ; -case SMU_SOCCLK : - clock_limit = smu->smu_table.boot_values.socclk; -break ; -case SMU_VCLK : - clock_limit = smu->smu_table.boot_values.vclk; -break ; -case SMU_DCLK : - clock_limit = smu->smu_table.boot_values.dclk; -break ; -default : - clock_limit =0 ; -break ; - } + ret =smu_v13_0_get_boot_freq_by_index (smu, clk_type, &clock_limit); +if (ret) +return ret;/* clock in Mhz unit */ if (min)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/184 drm/amd/pm: fix the Out-of-bounds read warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ]
using index i - 1U may beyond element index for mc_data[] when i = 0.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +3 -2
@@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; }else if ((table->mc_reg_address[i].uc_pre_reg_data &LOW_NIBBLE_MASK ) ==DATA_EQU_PREV ) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1 ]; +if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1 ]; } } num_ranges++;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/184 drm/amdgpu: fix uninitialized scalar variable warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 0fa4c25db8b791f79bc0d5a0cd58aff9ad85186b ]
Clear warning that field bp is uninitialized when calling amdgpu_virt_ras_add_bps.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +2 -0
@@ -395,6 +395,8 @@ static void amdgpu_virt_add_bad_page(struct amdgpu_device *adev,else vram_usage_va = adev->mman.drv_vram_usage_va; +memset (&bp,0 ,sizeof (bp)); +if (bp_block_size) { bp_cnt = bp_block_size /sizeof (uint64_t );for (bp_idx =0 ; bp_idx < bp_cnt; bp_idx++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/184 drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 5fa7d540d95d97ddc021a74583f6b3da4df9c93a ]
Clear warnings that using uninitialized variable when fails to get the valid value from SMU.
--- .../drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 46 ++++++++++++++----- .../amd/pm/powerplay/smumgr/vega10_smumgr.c | 6 ++- 2 files changed, 39 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +34 -12
@@ -354,13 +354,13 @@ static int vega10_odn_initial_default_setting(struct pp_hwmgr *hwmgr)return 0 ; } -static void vega10_init_dpm_defaults (struct pp_hwmgr *hwmgr) +static int vega10_init_dpm_defaults (struct pp_hwmgr *hwmgr) {struct vega10_hwmgr *data = hwmgr->backend; -int i;uint32_t sub_vendor_id, hw_revision;uint32_t top32, bottom32;struct amdgpu_device *adev = hwmgr->adev; +int ret, i;vega10_initialize_power_tune_defaults (hwmgr);
@@ -485,9 +485,12 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr)if (data->registry_data.vr0hot_enabled) data->smu_features[GNLD_VR0HOT ].supported = true; -smum_send_msg_to_smc (hwmgr, + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetSmuVersion, &hwmgr->smu_version); +if (ret) +return ret; +/* ACG firmware has major version 5 */ if ((hwmgr->smu_version &0xff000000 ) ==0x5000000 ) data->smu_features[GNLD_ACG ].supported = true;
@@ -505,10 +508,16 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr) data->smu_features[GNLD_PCC_LIMIT ].supported = true;/* Get the SN to turn into a Unique ID */ -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +if (ret) +return ret; + + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); +if (ret) +return ret; adev->unique_id = ((uint64_t )bottom32 <<32 ) | top32; +return 0 ; }#ifdef PPLIB_VEGA10_EVV_SUPPORT
@@ -882,7 +891,9 @@ static int vega10_hwmgr_backend_init(struct pp_hwmgr *hwmgr)vega10_set_features_platform_caps (hwmgr); -vega10_init_dpm_defaults (hwmgr); + result =vega10_init_dpm_defaults (hwmgr); +if (result) +return result;#ifdef PPLIB_VEGA10_EVV_SUPPORT /* Get leakage voltage based on leakage ID. */
@@ -3913,11 +3924,14 @@ static int vega10_get_gpu_power(struct pp_hwmgr *hwmgr, uint32_t *query) {uint32_t value; +int ret;if (!query)return -EINVAL ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrPkgPwr, &value); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrPkgPwr, &value); +if (ret) +return ret;/* SMC returning actual watts, keep consistent with legacy asics, low 8 bit as 8 fractional bits */ *query = value <<8 ;
@@ -4813,14 +4827,16 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,uint32_t gen_speed, lane_width, current_gen_speed, current_lane_width;PPTable_t *pptable = &(data->smc_state_table.pp_table); -int i, now, size =0 , count =0 ; +int i, ret, now, size =0 , count =0 ;switch (type) {case PP_SCLK :if (data->registry_data.sclk_dpm_key_disabled)break ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentGfxclkIndex, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentGfxclkIndex, &now); +if (ret) +break ;if (hwmgr->pp_one_vf && (hwmgr->dpm_level ==AMD_DPM_FORCED_LEVEL_PROFILE_PEAK ))
@@ -4836,7 +4852,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,if (data->registry_data.mclk_dpm_key_disabled)break ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentUclkIndex, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentUclkIndex, &now); +if (ret) +break ;for (i =0 ; i < mclk_table->count; i++) size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -4847,7 +4865,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,if (data->registry_data.socclk_dpm_key_disabled)break ; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentSocclkIndex, &now); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetCurrentSocclkIndex, &now); +if (ret) +break ;for (i =0 ; i < soc_table->count; i++) size += sprintf(buf + size, "%d: %uMhz %s\n",
@@ -4858,8 +4878,10 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,if (data->registry_data.dcefclk_dpm_key_disabled)break ; -smum_send_msg_to_smc_with_parameter (hwmgr, + ret =smum_send_msg_to_smc_with_parameter (hwmgr, PPSMC_MSG_GetClockFreqMHz,CLK_DCEFCLK , &now); +if (ret) +break ;for (i =0 ; i < dcef_table->count; i++) size += sprintf(buf + size, "%d: %uMhz %s\n",
drivers/gpu/drm/amd/pm/powerplay/smumgr/vega10_smumgr.c +5 -1
@@ -130,13 +130,17 @@ int vega10_get_enabled_smc_features(struct pp_hwmgr *hwmgr, uint64_t *features_enabled) {uint32_t enabled_features; +int ret;if (features_enabled ==NULL )return -EINVAL ; -smum_send_msg_to_smc (hwmgr, + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetEnabledSmuFeatures, &enabled_features); +if (ret) +return ret; + *features_enabled = enabled_features;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/184 drm/xe/gt: Fix assert in L3 bank mask generation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francois Dugast <[email protected]>
[ Upstream commit 8ad0e1810bf23f22cedb8a2664548b15646570c7 ]
What needs to be asserted is that the pattern fits in the number of bits provided by the user in patternbits, otherwise it would be truncated when replicated according to the mask, which is likely not the intended use of this function.
The pattern argument is a bitmap so use find_last_bit() instead of fls(). The bit position starts at index 0 so remove "or equal" from the comparison. XE_MAX_L3_BANK_MASK_BITS would be the returned value if the pattern is 0, which can be the case on some platforms.
v2: Check the result does not overflow the array (Lucas De Marchi)
v3: Use __fls() for long and handle mask == 0 (Lucas De Marchi)
--- drivers/gpu/drm/xe/xe_gt_topology.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_gt_topology.c +3 -1
@@ -108,7 +108,9 @@ gen_l3_mask_from_pattern(struct xe_device *xe, xe_l3_bank_mask_t dst, {unsigned long bit; -xe_assert (xe,fls (mask) <= patternbits); +xe_assert (xe,find_last_bit (pattern,XE_MAX_L3_BANK_MASK_BITS ) < patternbits || +bitmap_empty (pattern,XE_MAX_L3_BANK_MASK_BITS )); +xe_assert (xe, !mask || patternbits * (__fls (mask) +1 ) <=XE_MAX_L3_BANK_MASK_BITS );for_each_set_bit (bit, &mask,32 ) {xe_l3_bank_mask_t shifted_pattern = {};
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/184 drm/amdgpu: avoid reading vf2pf info size from FB
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhigang Luo <[email protected]>
[ Upstream commit 3bcc0ee14768d886cedff65da72d83d375a31a56 ]
VF can't access FB when host is doing mode1 reset. Using sizeof to get vf2pf info size, instead of reading it from vf2pf header stored in FB.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +1 -1
@@ -585,7 +585,7 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) } vf2pf_info->checksum =amd_sriov_msg_checksum ( - vf2pf_info, vf2pf_info->header.size,0 ,0 ); + vf2pf_info,sizeof (*vf2pf_info),0 ,0 );return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/184 drm/amd/display: Ensure array index tg_inst wont be -1
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 687fe329f18ab0ab0496b20ed2cb003d4879d931 ]
[WHY & HOW]tg_inst will be a negative if timing_generator_count equals 0, which should be checked before used.
This fixes 2 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +1 -1
@@ -3508,7 +3508,7 @@ static bool acquire_otg_master_pipe_for_stream(if (pool->dpps[pipe_idx]) pipe_ctx->plane_res.mpcc_inst = pool->dpps[pipe_idx]->inst; -if (pipe_idx >= pool->timing_generator_count) { +if (pipe_idx >= pool->timing_generator_count && pool->timing_generator_count !=0 ) {int tg_inst = pool->timing_generator_count -1 ; pipe_ctx->stream_res.tg = pool->timing_generators[tg_inst];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/184 drm/amd/display: Check gpio_id before used as array index
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ]
[WHY & HOW]GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore should be checked in advance.
This fixes 5 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +11 -2
@@ -239,6 +239,9 @@ static bool is_pin_busy( enum gpio_id id, uint32_t en) { +if (id ==GPIO_ID_UNKNOWN ) +return false; +return service->busyness[id][en]; }
@@ -247,6 +250,9 @@ static void set_pin_busy( enum gpio_id id, uint32_t en) { +if (id ==GPIO_ID_UNKNOWN ) +return ; + service->busyness[id][en] = true; }
@@ -255,6 +261,9 @@ static void set_pin_free( enum gpio_id id, uint32_t en) { +if (id ==GPIO_ID_UNKNOWN ) +return ; + service->busyness[id][en] = false; }
@@ -263,7 +272,7 @@ enum gpio_result dal_gpio_service_lock( enum gpio_id id, uint32_t en) { -if (!service->busyness[id]) { +if (id !=GPIO_ID_UNKNOWN && !service->busyness[id]) {ASSERT_CRITICAL (false);return GPIO_RESULT_OPEN_FAILED ; }
@@ -277,7 +286,7 @@ enum gpio_result dal_gpio_service_unlock( enum gpio_id id, uint32_t en) { -if (!service->busyness[id]) { +if (id !=GPIO_ID_UNKNOWN && !service->busyness[id]) {ASSERT_CRITICAL (false);return GPIO_RESULT_OPEN_FAILED ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/184 drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 84723eb6068c50610c5c0893980d230d7afa2105 ]
[Why]
Coverity reports OVERRUN warning. Should abort amdgpu_dm initialize.
[How]
Return failure to amdgpu_dm_init.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -1
@@ -4466,7 +4466,10 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)/* There is one primary plane per CRTC */ primary_planes = dm->dc->caps.max_streams; -ASSERT (primary_planes <=AMDGPU_MAX_PLANES ); +if (primary_planes >AMDGPU_MAX_PLANES ) { +DRM_ERROR ("DM: Plane nums out of 6 planes\n" ); +return -EINVAL ; + }/* * Initialize primary planes, implicit planes for legacy IOCTLS.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/184 drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit cf8b16857db702ceb8d52f9219a4613363e2b1cf ]
[Why]
Coverity report OVERRUN warning. There are only max_links elements within dc->links. link count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31.
[How]
Make sure link count less than max_links.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +7 -7
@@ -4587,17 +4587,17 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) } } +if (link_cnt >MAX_LINKS ) { +DRM_ERROR ( +"KMS: Cannot support more than %d display indexes\n" , +MAX_LINKS ); + goto fail; + } +/* loops over all connectors on the board */ for (i =0 ; i < link_cnt; i++) {struct dc_link *link =NULL ; -if (i >AMDGPU_DM_MAX_DISPLAY_INDEX ) { -DRM_ERROR ( -"KMS: Cannot support more than %d display indexes\n" , -AMDGPU_DM_MAX_DISPLAY_INDEX ); -continue ; - } - link =dc_get_link_at_index (dm->dc, i);if (link->connector_signal ==SIGNAL_TYPE_VIRTUAL ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/184 drm/amd/display: Fix incorrect size calculation for loop
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 3941a3aa4b653b69876d894d08f3fff1cc965267 ]
[WHY]fe_clk_en has size of 5 but sizeof(fe_clk_en) has byte size 20 which is lager than the array size.
[HOW]
Divide byte size 20 by its element size.
This fixes 2 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn35/dcn35_dccg.c +1 -1
@@ -940,7 +940,7 @@ static uint8_t dccg35_get_other_enabled_symclk_fe(struct dccg *dccg, uint32_t st/* for DPMST, this backend could be used by multiple front end. only disable the backend if this stream_enc_ins is the last active stream enc connected to this back_end*/ uint8_t i; -for (i =0 ; i != link_enc_inst && i <sizeof (fe_clk_en); i++) { +for (i =0 ; i != link_enc_inst && i <ARRAY_SIZE (fe_clk_en); i++) {if (fe_clk_en[i] && be_clk_sel[i] == link_enc_inst) num_enabled_symclk_fe++; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/184 drm/amd/display: Check index for aux_rd_interval before using
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 9ba2ea6337b4f159aecb177555a6a81da92d302e ]
aux_rd_interval has size of 7 and should be checked.
This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.
--- .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c +2 -2
@@ -914,10 +914,10 @@ static enum dc_status configure_lttpr_mode_non_transparent(/* Driver does not need to train the first hop. Skip DPCD read and clear * AUX_RD_INTERVAL for DPTX-to-DPIA hop. */ -if (link->ep_type ==DISPLAY_ENDPOINT_USB4_DPIA ) +if (link->ep_type ==DISPLAY_ENDPOINT_USB4_DPIA && repeater_cnt >0 && repeater_cnt <MAX_REPEATER_CNT ) link->dpcd_caps.lttpr_caps.aux_rd_interval[--repeater_cnt] =0 ; -for (repeater_id = repeater_cnt; repeater_id >0 ; repeater_id--) { +for (repeater_id = repeater_cnt; repeater_id >0 && repeater_id <MAX_REPEATER_CNT ; repeater_id--) { aux_interval_address =DP_TRAINING_AUX_RD_INTERVAL_PHY_REPEATER1 + ((DP_REPEATER_CONFIGURATION_AND_STATUS_SIZE ) * (repeater_id -1 )); core_link_read_dpcd(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/184 drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 5524fa301ba649f8cf00848f91468e0ba7e4f24c ]
[Why & How]
ASSERT if return NULL from kcalloc.
--- drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c +1 -0
@@ -165,6 +165,7 @@ static void dpcd_extend_address_range( *out_address = new_addr_range.start; *out_size =ADDRESS_RANGE_SIZE (new_addr_range.start, new_addr_range.end); *out_data =kcalloc (*out_size,sizeof (**out_data),GFP_KERNEL ); +ASSERT (*out_data); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/184 drm/amd/display: Add array index check for hdcp ddc access
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 4e70c0f5251c25885c31ee84a31f99a01f7cf50e ]
[Why]
Coverity reports OVERRUN warning. Do not check if array index valid.
[How]
Check msg_id valid and valid array index.
--- .../drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +24 -4
@@ -156,11 +156,16 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp,uint32_t cur_size =0 ;uint32_t data_offset =0 ; -if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID ) { +if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >=MOD_HDCP_MESSAGE_ID_MAX )return MOD_HDCP_STATUS_DDC_FAILURE ; - }if (is_dp_hdcp (hdcp)) { +int num_dpcd_addrs =sizeof (hdcp_dpcd_addrs) / +sizeof (hdcp_dpcd_addrs[0 ]); +if (msg_id >= num_dpcd_addrs) +return MOD_HDCP_STATUS_DDC_FAILURE ; +while (buf_len >0 ) { cur_size =MIN (buf_len,HDCP_MAX_AUX_TRANSACTION_SIZE ); success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle,
@@ -175,6 +180,11 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, data_offset += cur_size; } }else { +int num_i2c_offsets =sizeof (hdcp_i2c_offsets) / +sizeof (hdcp_i2c_offsets[0 ]); +if (msg_id >= num_i2c_offsets) +return MOD_HDCP_STATUS_DDC_FAILURE ; + success = hdcp->config.ddc.funcs.read_i2c( hdcp->config.ddc.handle, HDCP_I2C_ADDR,
@@ -219,11 +229,16 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp,uint32_t cur_size =0 ;uint32_t data_offset =0 ; -if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID ) { +if (msg_id ==MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >=MOD_HDCP_MESSAGE_ID_MAX )return MOD_HDCP_STATUS_DDC_FAILURE ; - }if (is_dp_hdcp (hdcp)) { +int num_dpcd_addrs =sizeof (hdcp_dpcd_addrs) / +sizeof (hdcp_dpcd_addrs[0 ]); +if (msg_id >= num_dpcd_addrs) +return MOD_HDCP_STATUS_DDC_FAILURE ; +while (buf_len >0 ) { cur_size =MIN (buf_len,HDCP_MAX_AUX_TRANSACTION_SIZE ); success = hdcp->config.ddc.funcs.write_dpcd(
@@ -239,6 +254,11 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, data_offset += cur_size; } }else { +int num_i2c_offsets =sizeof (hdcp_i2c_offsets) / +sizeof (hdcp_i2c_offsets[0 ]); +if (msg_id >= num_i2c_offsets) +return MOD_HDCP_STATUS_DDC_FAILURE ; + hdcp->buf[0 ] = hdcp_i2c_offsets[msg_id];memmove (&hdcp->buf[1 ], buf, buf_len); success = hdcp->config.ddc.funcs.write_i2c(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/184 drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit b38a4815f79b87efb196cd5121579fc51e29a7fb ]
[WHY & HOW]num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets - 1].
This fixes an OVERRUN issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +2 -1
@@ -484,7 +484,8 @@ static void build_watermark_ranges(struct clk_bw_params *bw_params, struct pp_sm ranges->reader_wm_sets[num_valid_sets].max_fill_clk_mhz =PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX ;/* Modify previous watermark range to cover up to max */ - ranges->reader_wm_sets[num_valid_sets -1 ].max_fill_clk_mhz =PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX ; +if (num_valid_sets >0 ) + ranges->reader_wm_sets[num_valid_sets -1 ].max_fill_clk_mhz =PP_SMU_WM_SET_RANGE_CLK_UNCONSTRAINED_MAX ; } num_valid_sets++; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/184 drm/amd/display: Check msg_id before processing transcation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit fa71face755e27dc44bc296416ebdf2c67163316 ]
[WHY & HOW]HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid array index, and it needs checking before used.
This fixes 4 OVERRUN issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c +15 -2
@@ -128,13 +128,21 @@ static bool hdmi_14_process_transaction(const uint8_t hdcp_i2c_addr_link_primary =0x3a ;/* 0x74 >> 1*/ const uint8_t hdcp_i2c_addr_link_secondary =0x3b ;/* 0x76 >> 1*/ struct i2c_command i2c_command; -uint8_t offset = hdcp_i2c_offsets[message_info->msg_id]; +uint8_t offset;struct i2c_payload i2c_payloads[] = { - { true,0 ,1 , &offset }, + { true,0 ,1 ,0 },/* actual hdcp payload, will be filled later, zeroed for now*/ {0 } }; +if (message_info->msg_id ==HDCP_MESSAGE_ID_INVALID ) { +DC_LOG_ERROR ("%s: Invalid message_info msg_id - %d\n" , __func__, message_info->msg_id); +return false; + } + + offset = hdcp_i2c_offsets[message_info->msg_id]; + i2c_payloads[0 ].data = &offset; +switch (message_info->link) {case HDCP_LINK_SECONDARY : i2c_payloads[0 ].address = hdcp_i2c_addr_link_secondary;
@@ -308,6 +316,11 @@ static bool dp_11_process_transaction( struct dc_link *link, struct hdcp_protection_message *message_info) { +if (message_info->msg_id ==HDCP_MESSAGE_ID_INVALID ) { +DC_LOG_ERROR ("%s: Invalid message_info msg_id - %d\n" , __func__, message_info->msg_id); +return false; + } + return dpcd_access_helper( link, message_info->length,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/184 drm/amd/display: Release state memory if amdgpu_dm_create_color_properties fail
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 52cbcf980509e6190740dd1e2a1a437e8fb8101b ]
[Why]
Coverity reports RESOURCE_LEAK warning. State memory is not released if dm_create_color_properties fail.
[How]
Call kfree(state) before return.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -1
@@ -4129,8 +4129,11 @@ static int amdgpu_dm_mode_config_init(struct amdgpu_device *adev) }#ifdef AMD_PRIVATE_COLOR -if (amdgpu_dm_create_color_properties (adev)) +if (amdgpu_dm_create_color_properties (adev)) { +dc_state_release (state->context); +kfree (state);return -ENOMEM ; + }#endif r =amdgpu_dm_audio_init (adev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/184 drm/amd/display: Check link_index before accessing dc->links[]
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 8aa2864044b9d13e95fe224f32e808afbf79ecdf ]
[WHY & HOW]
dc->links[] has max size of MAX_LINKS and NULL is return when trying to access with out-of-bound index.
This fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c +3 -0
@@ -37,6 +37,9 @@#include "dce/dce_i2c.h" struct dc_link *dc_get_link_at_index (struct dc *dc,uint32_t link_index) { +if (link_index >=MAX_LINKS ) +return NULL ; +return dc->links[link_index]; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/184 drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 871cd9d881fa791d3f82885000713de07041c0ae ]
[Why]
Coverity reports NULL_RETURN warning.
[How]
Add otg_master NULL check.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +3 -0
@@ -2283,6 +2283,9 @@ void resource_log_pipe_topology_update(struct dc *dc, struct dc_state *state) state->stream_status[stream_idx].mall_stream_config.paired_stream); otg_master =resource_get_otg_master_for_stream ( &state->res_ctx, state->streams[phantom_stream_idx]); +if (!otg_master) +continue ; +resource_log_pipe_for_stream (dc, state, otg_master, stream_idx); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/184 drm/amd/display: Fix Coverity INTERGER_OVERFLOW within construct_integrated_info
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 176abbcc71952e23009a6ed194fd203b99646884 ]
[Why]
For substrcation, coverity reports integer overflow warning message when variable type is uint32_t.
[How]
Change varaible type to int32_t.
--- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 4 ++-- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +2 -2
@@ -2551,8 +2551,8 @@ static enum bp_result construct_integrated_info(/* Sort voltage table from low to high*/ if (result ==BP_RESULT_OK ) { -uint32_t i; -uint32_t j; +int32_t i; +int32_t j;for (i =1 ; i <NUMBER_OF_DISP_CLK_VOLTAGE ; ++i) {for (j = i; j >0 ; --j) {
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +5 -2
@@ -2920,8 +2920,11 @@ static enum bp_result construct_integrated_info(struct atom_common_table_header *header;struct atom_data_revision revision; -uint32_t i; -uint32_t j; +int32_t i; +int32_t j; + +if (!info) +return result;if (info &&DATA_TABLES (integratedsysteminfo)) { header = GET_IMAGE(struct atom_common_table_header,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/184 drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit c6077aa66fa230d12f37fef01161ef080d13b726 ]
[Why]
For subtraction, coverity reports integer overflow warning message when variable type is uint32_t.
[How]
Change variable type to int32_t.
--- drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +2 -2
@@ -56,7 +56,7 @@ struct gpio_service *dal_gpio_service_create( struct dc_context *ctx) {struct gpio_service *service; -uint32_t index_of_id; +int32_t index_of_id; service =kzalloc (sizeof (struct gpio_service ),GFP_KERNEL );
@@ -112,7 +112,7 @@ struct gpio_service *dal_gpio_service_create(return service; failure_2: -while (index_of_id) { +while (index_of_id >0 ) { --index_of_id;kfree (service->busyness[index_of_id]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/184 drm/amd/display: Release clck_src memory if clk_src_construct fails
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 674704a5dabe4a434645fdd11e35437f4e06dfc4 ]
[Why]
Coverity reports RESOURCE_LEAK for some implemenations of clock_source_create. Do not release memory of clk_src if contructor fails.
[How]
Free clk_src if contructor fails.
--- .../gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c | 1 + .../gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c | 1 + .../gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c | 4 ++-- .../gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + .../gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c | 1 + 5 files changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c +1 -0
@@ -1538,6 +1538,7 @@ struct resource_pool *dce83_create_resource_pool(if (dce83_construct (num_virtual_links, dc, pool))return &pool->base; +kfree (pool);BREAK_TO_DEBUGGER ();return NULL ; }
drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c +1 -0
@@ -1864,6 +1864,7 @@ static struct clock_source *dcn30_clock_source_create(return &clk_src->base; } +kfree (clk_src);BREAK_TO_DEBUGGER ();return NULL ; }
drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c +2 -2
@@ -1660,8 +1660,8 @@ static struct clock_source *dcn31_clock_source_create(return &clk_src->base; } -BREAK_TO_DEBUGGER ();kfree (clk_src); +BREAK_TO_DEBUGGER ();return NULL ; }
@@ -1821,8 +1821,8 @@ static struct clock_source *dcn30_clock_source_create(return &clk_src->base; } -BREAK_TO_DEBUGGER ();kfree (clk_src); +BREAK_TO_DEBUGGER ();return NULL ; }
drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +1 -0
@@ -1716,6 +1716,7 @@ static struct clock_source *dcn35_clock_source_create(return &clk_src->base; } +kfree (clk_src);BREAK_TO_DEBUGGER ();return NULL ; }
drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c +1 -0
@@ -1696,6 +1696,7 @@ static struct clock_source *dcn35_clock_source_create(return &clk_src->base; } +kfree (clk_src);BREAK_TO_DEBUGGER ();return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/184 drm/amd/display: Spinlock before reading event
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit ae13c8a5cff92015b9a3eb7cee65ebc75859487f ]
[WHY & HOW]
A read of acrtc_attach->base.state->event was not locked so moving it inside the spinlock.
This fixes a LOCK_EVASION issue reported by Coverity.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -8
@@ -8645,15 +8645,13 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, bundle->stream_update.vrr_infopacket = &acrtc_state->stream->vrr_infopacket; } - }else if (cursor_update && acrtc_state->active_planes >0 && - acrtc_attach->base.state->event) { -drm_crtc_vblank_get (pcrtc); - + }else if (cursor_update && acrtc_state->active_planes >0 ) {spin_lock_irqsave (&pcrtc->dev->event_lock, flags); - - acrtc_attach->event = acrtc_attach->base.state->event; - acrtc_attach->base.state->event =NULL ; - +if (acrtc_attach->base.state->event) { +drm_crtc_vblank_get (pcrtc); + acrtc_attach->event = acrtc_attach->base.state->event; + acrtc_attach->base.state->event =NULL ; + }spin_unlock_irqrestore (&pcrtc->dev->event_lock, flags); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/184 drm/amd/display: Fix Coverity INTEGER_OVERFLOW within decide_fallback_link_setting_max_bw_policy
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 83c0c8361347cf43937348e8ca0a487679c003ae ]
[Why]
For addtion (uint8_t) variable + constant 1, coverity generates message below:
Truncation due to cast operation on "cur_idx + 1" from 32 to 8 bits.
Then Coverity assume result is 32 bits value be saved into 8 bits variable. When result is used as index to access array, Coverity suspects index invalid.
[How]
Change varaible type to uint32_t.
--- .../gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c +1 -1
@@ -534,7 +534,7 @@ static bool decide_fallback_link_setting_max_bw_policy(struct dc_link_settings *cur, enum link_training_result training_result) { - uint8_t cur_idx = 0, next_idx; + uint32_t cur_idx = 0, next_idx;bool found = false;if (training_result ==LINK_TRAINING_ABORT )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/184 drm/amd/display: Ensure index calculation will not overflow
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 8e2734bf444767fed787305ccdcb36a2be5301a2 ]
[WHY & HOW]
Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will never overflow and exceess array size.
This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c +3 -4
@@ -1453,10 +1453,9 @@ void dcn_bw_update_from_pplib_fclks(ASSERT (fclks->num_levels); vmin0p65_idx =0 ; - vmid0p72_idx = fclks->num_levels - - (fclks->num_levels >2 ?3 : (fclks->num_levels >1 ?2 :1 )); - vnom0p8_idx = fclks->num_levels - (fclks->num_levels >1 ?2 :1 ); - vmax0p9_idx = fclks->num_levels -1 ; + vmid0p72_idx = fclks->num_levels >2 ? fclks->num_levels -3 :0 ; + vnom0p8_idx = fclks->num_levels >1 ? fclks->num_levels -2 :0 ; + vmax0p9_idx = fclks->num_levels >0 ? fclks->num_levels -1 :0 ; dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 =32 * (fclks->data[vmin0p65_idx].clocks_in_khz /1000.0 ) /1000.0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/184 drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit a54f7e866cc73a4cb71b8b24bb568ba35c8969df ]
[Why]
Coverity reports Memory - illegal accesses.
[How]
Skip inactive planes.
--- drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c +6 -1
@@ -1099,8 +1099,13 @@ void ModeSupportAndSystemConfiguration(struct display_mode_lib *mode_lib)// Total Available Pipes Support Check for (k =0 ; k < mode_lib->vba.NumberOfActivePlanes; ++k) { - total_pipes += mode_lib->vba.DPPPerPlane[k]; pipe_idx =get_pipe_idx (mode_lib, k); +if (pipe_idx ==-1 ) { +ASSERT (0 ); +continue ;// skip inactive planes + } + total_pipes += mode_lib->vba.DPPPerPlane[k]; +if (mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz >0.0 ) mode_lib->vba.DPPCLK[k] = mode_lib->vba.cache_pipes[pipe_idx].clks_cfg.dppclk_mhz;else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/184 drm/amd/display: Fix writeback job lock evasion within dm_crtc_high_irq
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 922c2877827dcc474f3079e464773ab31ac13b79 ]
[Why]
Coverity report LOCK_EVASION warning. Access acrtc->wb_pending without lock wb_conn->job_lock.
[How]
Lock wb_conn->job_lock before accessingacrtc->wb_pending.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -5
@@ -594,12 +594,14 @@ static void dm_crtc_high_irq(void *interrupt_params)if (!acrtc)return ; -if (acrtc->wb_pending) { -if (acrtc->wb_conn) { -spin_lock_irqsave (&acrtc->wb_conn->job_lock, flags); +if (acrtc->wb_conn) { +spin_lock_irqsave (&acrtc->wb_conn->job_lock, flags); + +if (acrtc->wb_pending) { job =list_first_entry_or_null (&acrtc->wb_conn->job_queue, struct drm_writeback_job, list_entry); + acrtc->wb_pending = false;spin_unlock_irqrestore (&acrtc->wb_conn->job_lock, flags);if (job) {
@@ -617,8 +619,7 @@ static void dm_crtc_high_irq(void *interrupt_params) acrtc->dm_irq_params.stream, 0); } }else -DRM_ERROR ("%s: no amdgpu_crtc wb_conn\n" , __func__); - acrtc->wb_pending = false; +spin_unlock_irqrestore (&acrtc->wb_conn->job_lock, flags); } vrr_active =amdgpu_dm_crtc_vrr_active_irq (acrtc);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/184 drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hersen Wu <[email protected]>
[ Upstream commit 188fd1616ec43033cedbe343b6579e9921e2d898 ]
[Why]
Coverity reports OVERRUN warning. soc.num_states could be 40. But array range of bw_params->clk_table.entries is 8.
[How]
Assert if soc.num_states greater than 8.
--- drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 10 ++++++++++ 4 files changed, 40 insertions(+)
drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c +10 -0
@@ -304,6 +304,16 @@ void dcn302_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz *16 ; } +/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. +* MAX_NUM_DPM_LVL is 8. +* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. +* DC__VOLTAGE_STATES is 40. +*/ +if (num_states >MAX_NUM_DPM_LVL ) { +ASSERT (0 ); +return ; + } + dcn3_02_soc.num_states = num_states;for (i =0 ; i < dcn3_02_soc.num_states; i++) { dcn3_02_soc.clock_limits[i].state = i;
drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c +10 -0
@@ -310,6 +310,16 @@ void dcn303_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz *16 ; } +/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. +* MAX_NUM_DPM_LVL is 8. +* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. +* DC__VOLTAGE_STATES is 40. +*/ +if (num_states >MAX_NUM_DPM_LVL ) { +ASSERT (0 ); +return ; + } + dcn3_03_soc.num_states = num_states;for (i =0 ; i < dcn3_03_soc.num_states; i++) { dcn3_03_soc.clock_limits[i].state = i;
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +10 -0
@@ -3232,6 +3232,16 @@ void dcn32_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_pa dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz *16 ; } +/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. +* MAX_NUM_DPM_LVL is 8. +* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. +* DC__VOLTAGE_STATES is 40. +*/ +if (num_states >MAX_NUM_DPM_LVL ) { +ASSERT (0 ); +return ; + } + dcn3_2_soc.num_states = num_states;for (i =0 ; i < dcn3_2_soc.num_states; i++) { dcn3_2_soc.clock_limits[i].state = i;
drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +10 -0
@@ -803,6 +803,16 @@ void dcn321_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz *16 ; } +/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. +* MAX_NUM_DPM_LVL is 8. +* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. +* DC__VOLTAGE_STATES is 40. +*/ +if (num_states >MAX_NUM_DPM_LVL ) { +ASSERT (0 ); +return ; + } + dcn3_21_soc.num_states = num_states;for (i =0 ; i < dcn3_21_soc.num_states; i++) { dcn3_21_soc.clock_limits[i].state = i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/184 drm/amd/amdgpu: Check tbo resource pointer
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asad Kamal <[email protected]>
[ Upstream commit 6cd2b872643bb29bba01a8ac739138db7bd79007 ]
Validate tbo resource pointer, skip if NULL
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -1
@@ -5012,7 +5012,8 @@ static int amdgpu_device_recover_vram(struct amdgpu_device *adev) shadow = vmbo->shadow;/* No need to recover an evicted BO */ -if (shadow->tbo.resource->mem_type !=TTM_PL_TT || +if (!shadow->tbo.resource || + shadow->tbo.resource->mem_type !=TTM_PL_TT || shadow->tbo.resource->start ==AMDGPU_BO_INVALID_OFFSET || shadow->parent->tbo.resource->mem_type !=TTM_PL_VRAM )continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/184 drm/xe: Demote CCS_MODE info to debug only
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Vivi <[email protected]>
[ Upstream commit e9c190b9b8e7e07bc0ef0ba9b87321fa37b456c5 ]
This information is printed in any gt_reset, which actually occurs in any runtime resume, what can be so verbose in production build. Let's demote it to debug only.
--- drivers/gpu/drm/xe/xe_gt_ccs_mode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_gt_ccs_mode.c +2 -2
@@ -68,8 +68,8 @@ static void __xe_gt_apply_ccs_mode(struct xe_gt *gt, u32 num_engines)xe_mmio_write32 (gt,CCS_MODE , mode); -xe_gt_info (gt,"CCS_MODE=%x config:%08x, num_engines:%d, num_slices:%d\n" , - mode, config, num_engines, num_slices); +xe_gt_dbg (gt,"CCS_MODE=%x config:%08x, num_engines:%d, num_slices:%d\n" , + mode, config, num_engines, num_slices); }void xe_gt_apply_ccs_mode (struct xe_gt *gt)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/184 drm/drm-bridge: Drop conditionals around of_node pointers
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sui Jingfeng <[email protected]>
[ Upstream commit ad3323a6ccb7d43bbeeaa46d5311c43d5d361fc7 ]
Having conditional around the of_node pointer of the drm_bridge structure is not necessary, since drm_bridge structure always has the of_node as its member.
Let's drop the conditional to get a better looks, please also note that this is following the already accepted commitments. see commit d8dfccde2709 ("drm/bridge: Drop conditionals around of_node pointers") for reference.
--- drivers/gpu/drm/drm_bridge.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/gpu/drm/drm_bridge.c +0 -5
@@ -353,13 +353,8 @@ int drm_bridge_attach(struct drm_encoder *encoder, struct drm_bridge *bridge, bridge->encoder =NULL ;list_del (&bridge->chain_node); -#ifdef CONFIG_OF DRM_ERROR ("failed to attach bridge %pOF to encoder %s: %d\n" , bridge->of_node, encoder->name, ret); -#else -DRM_ERROR ("failed to attach bridge to encoder %s: %d\n" , - encoder->name, ret); -#endif return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/184 drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit b2871de6961d24d421839fbfa4aa3008ec9170d5 ]
1. Fix a issue that using uninitialized mask to get the ultimate frequency.
2. Check return of smu_cmn_send_smc_msg_with_param to avoid using uninitialized variable residency.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c +14 -0
@@ -976,6 +976,18 @@ static int vangogh_get_dpm_ultimate_freq(struct smu_context *smu, } }if (min) { + ret =vangogh_get_profiling_clk_mask (smu, +AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK , +NULL , +NULL , + &mclk_mask, + &fclk_mask, + &soc_mask); +if (ret) + goto failed; + + vclk_mask = dclk_mask =0 ; +switch (clk_type) {case SMU_UCLK :case SMU_MCLK :
@@ -2450,6 +2462,8 @@ static u32 vangogh_set_gfxoff_residency(struct smu_context *smu, bool start) ret =smu_cmn_send_smc_msg_with_param (smu, SMU_MSG_LogGfxOffResidency, start, &residency); +if (ret) +return ret;if (!start) adev->gfx.gfx_off_residency = residency;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/184 drm/amdgpu/pm: Fix uninitialized variable warning for smu10
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 336c8f558d596699d3d9814a45600139b2f23f27 ]
Check return value of smum_send_msg_to_smc to fix uninitialized variable varning
--- .../drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c | 21 +++++++++++++---- .../drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 20 ++++++++++++---- .../drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 23 ++++++++++++++----- 3 files changed, 48 insertions(+), 16 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c +16 -5
@@ -1554,7 +1554,10 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr, }if (input[0 ] ==0 ) { -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); +if (ret) +return ret; +if (input[1 ] < min_freq) {pr_err ("Fine grain setting minimum sclk (%ld) MHz is less than the minimum allowed (%d) MHz\n" , input[1 ], min_freq);
@@ -1562,7 +1565,10 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr, } smu10_data->gfx_actual_soft_min_freq = input[1 ]; }else if (input[0 ] ==1 ) { -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); +if (ret) +return ret; +if (input[1 ] > max_freq) {pr_err ("Fine grain setting maximum sclk (%ld) MHz is greater than the maximum allowed (%d) MHz\n" , input[1 ], max_freq);
@@ -1577,10 +1583,15 @@ static int smu10_set_fine_grain_clk_vol(struct pp_hwmgr *hwmgr,pr_err ("Input parameter number not correct\n" );return -EINVAL ; } -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); - + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMinGfxclkFrequency, &min_freq); +if (ret) +return ret; smu10_data->gfx_actual_soft_min_freq = min_freq; + + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_GetMaxGfxclkFrequency, &max_freq); +if (ret) +return ret; + smu10_data->gfx_actual_soft_max_freq = max_freq; }else if (type ==PP_OD_COMMIT_DPM_TABLE ) {if (size !=0 ) {
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c +15 -5
@@ -293,12 +293,12 @@ static int vega12_set_features_platform_caps(struct pp_hwmgr *hwmgr)return 0 ; } -static void vega12_init_dpm_defaults (struct pp_hwmgr *hwmgr) +static int vega12_init_dpm_defaults (struct pp_hwmgr *hwmgr) {struct vega12_hwmgr *data = (struct vega12_hwmgr *)(hwmgr->backend);struct amdgpu_device *adev = hwmgr->adev;uint32_t top32, bottom32; -int i; +int i, ret; data->smu_features[GNLD_DPM_PREFETCHER ].smu_feature_id =FEATURE_DPM_PREFETCHER_BIT ;
@@ -364,10 +364,16 @@ static void vega12_init_dpm_defaults(struct pp_hwmgr *hwmgr) }/* Get the SN to turn into a Unique ID */ -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +if (ret) +return ret; + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); +if (ret) +return ret; adev->unique_id = ((uint64_t )bottom32 <<32 ) | top32; + +return 0 ; }static int vega12_set_private_data_based_on_pptable (struct pp_hwmgr *hwmgr)
@@ -410,7 +416,11 @@ static int vega12_hwmgr_backend_init(struct pp_hwmgr *hwmgr)vega12_set_features_platform_caps (hwmgr); -vega12_init_dpm_defaults (hwmgr); + result =vega12_init_dpm_defaults (hwmgr); +if (result) { +pr_err ("%s failed\n" , __func__); +return result; + }/* Parse pptable data read from VBIOS */ vega12_set_private_data_based_on_pptable (hwmgr);
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +17 -6
@@ -328,12 +328,12 @@ static int vega20_set_features_platform_caps(struct pp_hwmgr *hwmgr)return 0 ; } -static void vega20_init_dpm_defaults (struct pp_hwmgr *hwmgr) +static int vega20_init_dpm_defaults (struct pp_hwmgr *hwmgr) {struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);struct amdgpu_device *adev = hwmgr->adev;uint32_t top32, bottom32; -int i; +int i, ret; data->smu_features[GNLD_DPM_PREFETCHER ].smu_feature_id =FEATURE_DPM_PREFETCHER_BIT ;
@@ -404,10 +404,17 @@ static void vega20_init_dpm_defaults(struct pp_hwmgr *hwmgr) }/* Get the SN to turn into a Unique ID */ -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumTop32, &top32); +if (ret) +return ret; + + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_ReadSerialNumBottom32, &bottom32); +if (ret) +return ret; adev->unique_id = ((uint64_t )bottom32 <<32 ) | top32; + +return 0 ; }static int vega20_set_private_data_based_on_pptable (struct pp_hwmgr *hwmgr)
@@ -427,6 +434,7 @@ static int vega20_hwmgr_backend_init(struct pp_hwmgr *hwmgr) {struct vega20_hwmgr *data;struct amdgpu_device *adev = hwmgr->adev; +int result; data =kzalloc (sizeof (struct vega20_hwmgr ),GFP_KERNEL );if (data ==NULL )
@@ -452,8 +460,11 @@ static int vega20_hwmgr_backend_init(struct pp_hwmgr *hwmgr)vega20_set_features_platform_caps (hwmgr); -vega20_init_dpm_defaults (hwmgr); - + result =vega20_init_dpm_defaults (hwmgr); +if (result) { +pr_err ("%s failed\n" , __func__); +return result; + }/* Parse pptable data read from VBIOS */ vega20_set_private_data_based_on_pptable (hwmgr);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/184 drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit df4409d8a04dd39d7f2aa0c5f528a56b99eaaa13 ]
Assign an default value to agc_btc_response in failed case
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +7 -2
@@ -2361,15 +2361,20 @@ static int vega10_acg_enable(struct pp_hwmgr *hwmgr) {struct vega10_hwmgr *data = hwmgr->backend;uint32_t agc_btc_response; +int ret;if (data->smu_features[GNLD_ACG ].supported) {if (0 ==vega10_enable_smc_features (hwmgr, true, data->smu_features[GNLD_DPM_PREFETCHER ].smu_feature_bitmap)) data->smu_features[GNLD_DPM_PREFETCHER ].enabled = true; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_InitializeAcg,NULL ); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_InitializeAcg,NULL ); +if (ret) +return ret; -smum_send_msg_to_smc (hwmgr, PPSMC_MSG_RunAcgBtc, &agc_btc_response); + ret =smum_send_msg_to_smc (hwmgr, PPSMC_MSG_RunAcgBtc, &agc_btc_response); +if (ret) + agc_btc_response =0 ;if (1 == agc_btc_response) {if (1 == data->acg_loop_state)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/184 drm/amdgpu: Fix the uninitialized variable warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 7e39d7ec35883a168343ea02f40e260e176c6c63 ]
Check the user input and phy_id value range to fix "Using uninitialized value phy_id"
--- drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c +4 -0
@@ -135,6 +135,10 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __umutex_unlock (&psp->securedisplay_context.mutex);break ;case 2 : +if (size <3 || phy_id >=TA_SECUREDISPLAY_MAX_PHY ) { +dev_err (adev->dev,"Invalid input: %s\n" , str); +return -EINVAL ; + }mutex_lock (&psp->securedisplay_context.mutex);psp_prep_securedisplay_cmd_buf (psp, &securedisplay_cmd,TA_SECUREDISPLAY_COMMAND__SEND_ROI_CRC );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/184 drm/amdgpu: Fix out-of-bounds write warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit be1684930f5262a622d40ce7a6f1423530d87f89 ]
Check the ring type value to fix the out-of-bounds write warning
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +1 -1
@@ -354,7 +354,7 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring, ring->max_dw = max_dw; ring->hw_prio = hw_prio; -if (!ring->no_scheduler) { +if (!ring->no_scheduler && ring->funcs->type <AMDGPU_HW_IP_NUM ) { hw_ip = ring->funcs->type; num_sched = &adev->gpu_sched[hw_ip][hw_prio].num_scheds; adev->gpu_sched[hw_ip][hw_prio].sched[(*num_sched)++] =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/184 drm/amdkfd: Check debug trap enable before write dbg_ev_file
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin.Cao <[email protected]>
[ Upstream commit 547033b593063eb85bfdf9b25a5f1b8fd1911be2 ]
In interrupt context, write dbg_ev_file will be run by work queue. It will cause write dbg_ev_file execution after debug_trap_disable, which will cause NULL pointer access.
v2: cancel work "debug_event_workarea" before set dbg_ev_file as NULL.
--- drivers/gpu/drm/amd/amdkfd/kfd_debug.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_debug.c +3 -1
@@ -103,7 +103,8 @@ void debug_event_write_work_handler(struct work_struct *work) struct kfd_process, debug_event_workarea); -kernel_write (process->dbg_ev_file, &write_data,1 , &pos); +if (process->debug_trap_enabled && process->dbg_ev_file) +kernel_write (process->dbg_ev_file, &write_data,1 , &pos); }/* update process/device/queue exception status, write to descriptor
@@ -645,6 +646,7 @@ int kfd_dbg_trap_disable(struct kfd_process *target)else if (target->runtime_info.runtime_state !=DEBUG_RUNTIME_STATE_DISABLED ) target->runtime_info.runtime_state =DEBUG_RUNTIME_STATE_ENABLED ; +cancel_work_sync (&target->debug_event_workarea);fput (target->dbg_ev_file); target->dbg_ev_file =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/184 drm/amdgpu: fix uninitialized variable warning for amdgpu_xgmi
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 8f184f8e7a07fddc33ee4e6a38b717c770c3aedd ]
Clear warning that using uninitialized variable current_node.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +3 -0
@@ -434,6 +434,9 @@ static ssize_t amdgpu_xgmi_show_connected_port_num(struct device *dev, } } +if (i == top->num_nodes) +return -EINVAL ; +for (i =0 ; i < top->num_nodes; i++) {for (j =0 ; j < top->nodes[i].num_links; j++)/* node id in sysfs starts from 1 rather than 0 so +1 here */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/184 drm/amdgpu: fix uninitialized variable warning for jpeg_v4
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 9e5da942594034ec377ba8c0caa9c15e1d26ba08 ]
Clear warning that using uninitialized variable r.
--- drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c +1 -1
@@ -187,7 +187,7 @@ static int jpeg_v4_0_5_hw_init(void *handle) {struct amdgpu_device *adev = (struct amdgpu_device *)handle;struct amdgpu_ring *ring; -int r, i; +int i, r =0 ;// TODO: Enable ring test with DPG support if (adev->pg_flags &AMD_PG_SUPPORT_JPEG_DPG ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/184 drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit d768394fa99467bcf2703bde74ddc96eeb0b71fa ]
Check the fb_channel_number range to avoid the array out-of-bounds read error
--- drivers/gpu/drm/amd/amdgpu/df_v1_7.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/df_v1_7.c +2 -0
@@ -70,6 +70,8 @@ static u32 df_v1_7_get_hbm_channel_number(struct amdgpu_device *adev)int fb_channel_number; fb_channel_number = adev->df.funcs->get_fb_channel_number (adev); +if (fb_channel_number >=ARRAY_SIZE (df_v1_7_channel_number)) + fb_channel_number =0 ;return df_v1_7_channel_number[fb_channel_number]; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/184 drm/amdgpu: Fix uninitialized variable warning in amdgpu_info_ioctl
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit 0991e49d2b73bb4189f83a49eb41cdf16976bbf6 ]
Check the return value of amdgpu_xcp_get_inst_details, otherwise we may use an uninitialized variable inst_mask
--- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +9 -2
@@ -623,25 +623,32 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)switch (type) {case AMD_IP_BLOCK_TYPE_GFX : ret =amdgpu_xcp_get_inst_details (xcp,AMDGPU_XCP_GFX , &inst_mask); +if (ret) +return ret; count =hweight32 (inst_mask);break ;case AMD_IP_BLOCK_TYPE_SDMA : ret =amdgpu_xcp_get_inst_details (xcp,AMDGPU_XCP_SDMA , &inst_mask); +if (ret) +return ret; count =hweight32 (inst_mask);break ;case AMD_IP_BLOCK_TYPE_JPEG : ret =amdgpu_xcp_get_inst_details (xcp,AMDGPU_XCP_VCN , &inst_mask); +if (ret) +return ret; count =hweight32 (inst_mask) * adev->jpeg.num_jpeg_rings;break ;case AMD_IP_BLOCK_TYPE_VCN : ret =amdgpu_xcp_get_inst_details (xcp,AMDGPU_XCP_VCN , &inst_mask); +if (ret) +return ret; count =hweight32 (inst_mask);break ;default :return -EINVAL ; } -if (ret) -return ret; +return copy_to_user (out, &count,min (size,4u )) ? -EFAULT :0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/184 drm/amdgpu: fix ucode out-of-bounds read warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 8944acd0f9db33e17f387fdc75d33bb473d7936f ]
Clear warning that read ucode[] may out-of-bounds.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +3 -0
@@ -213,6 +213,9 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,struct amdgpu_firmware_info *ucode; id =fw_type_convert (cgs_device, type); +if (id >=AMDGPU_UCODE_ID_MAXIMUM ) +return -EINVAL ; + ucode = &adev->firmware.ucode[id];if (ucode->fw ==NULL )return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/184 drm/amdgpu: fix mc_data out-of-bounds read warning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 51dfc0a4d609fe700750a62f41447f01b8c9ea50 ]
Clear warning that read mc_data[i-1] may out-of-bounds.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +2 -0
@@ -1484,6 +1484,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev, (u32 )le32_to_cpu (*((u32 *)reg_data + j)); j++; }else if ((reg_table->mc_reg_address[i].pre_reg_data &LOW_NIBBLE_MASK ) ==DATA_EQU_PREV ) { +if (i ==0 ) +continue ; reg_table->mc_reg_table_entry[num_ranges].mc_data[i] = reg_table->mc_reg_table_entry[num_ranges].mc_data[i -1 ]; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/184 drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chen <[email protected]>
[ Upstream commit 10f624ef239bd136cdcc5bbc626157a57b938a31 ]
Currently oem_id is defined as uint8_t[6] and casted to uint64_t* in some use case. This would lead code scanner to complain about access beyond. Re-define it in union to enforce 8-byte size and alignment to avoid potential issue.
--- drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 2 -- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 +-- drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 5 ++++- 3 files changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_crat.h +0 -2
@@ -42,8 +42,6 @@#define CRAT_OEMTABLEID_LENGTH 8#define CRAT_RESERVED_LENGTH 6 -#define CRAT_OEMID_64BIT_MASK ((1ULL << (CRAT_OEMID_LENGTH * 8)) - 1) -/* Compute Unit flags */ #define COMPUTE_UNIT_CPU (1 << 0)/* Create Virtual CRAT for CPU */ #define COMPUTE_UNIT_GPU (1 << 1)/* Create Virtual CRAT for GPU */
drivers/gpu/drm/amd/amdkfd/kfd_topology.c +1 -2
@@ -958,8 +958,7 @@ static void kfd_update_system_properties(void) dev =list_last_entry (&topology_device_list, struct kfd_topology_device, list);if (dev) { - sys_props.platform_id = - (*((uint64_t *)dev->oem_id)) &CRAT_OEMID_64BIT_MASK ; + sys_props.platform_id = dev->oem_id64; sys_props.platform_oem = *((uint64_t *)dev->oem_table_id); sys_props.platform_rev = dev->oem_revision; }
drivers/gpu/drm/amd/amdkfd/kfd_topology.h +4 -1
@@ -154,7 +154,10 @@ struct kfd_topology_device {struct attribute attr_gpuid;struct attribute attr_name;struct attribute attr_props; -uint8_t oem_id[CRAT_OEMID_LENGTH ]; +union { +uint8_t oem_id[CRAT_OEMID_LENGTH ]; +uint64_t oem_id64; + };uint8_t oem_table_id[CRAT_OEMTABLEID_LENGTH ];uint32_t oem_revision; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/184 drm/xe/hwmon: Remove unwanted write permission for currN_label
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthik Poosa <[email protected]>
[ Upstream commit 515f08972355e160f896f612347121fbb685e740 ]
Change umode of currN_label from 0644 to 0444 as write permission not needed for label.
--- drivers/gpu/drm/xe/xe_hwmon.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_hwmon.c +7 -2
@@ -551,12 +551,17 @@ xe_hwmon_curr_is_visible(const struct xe_hwmon *hwmon, u32 attr, int channel) {u32 uval; +/* hwmon sysfs attribute of current available only for package */ +if (channel !=CHANNEL_PKG ) +return 0 ; +switch (attr) {case hwmon_curr_crit: -case hwmon_curr_label: -if (channel ==CHANNEL_PKG )return (xe_hwmon_pcode_read_i1 (hwmon->gt, &uval) || (uval &POWER_SETUP_I1_WATTS )) ?0 :0644 ; +case hwmon_curr_label: +return (xe_hwmon_pcode_read_i1 (hwmon->gt, &uval) || + (uval &POWER_SETUP_I1_WATTS )) ?0 :0444 ;break ;default :return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/184 apparmor: fix possible NULL pointer dereference
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leesoo Ahn <[email protected]>
[ Upstream commit 3dd384108d53834002be5630132ad5c3f32166ad ]
profile->parent->dents[AAFS_PROF_DIR] could be NULL only if its parent is made from __create_missing_ancestors(..) and 'ent->old' is NULL in aa_replace_profiles(..).
In that case, it must return an error code and the code, -ENOENT represents its state that the path of its parent is not existed yet.
BUG: kernel NULL pointer dereference, address: 0000000000000030 PGD 0 P4D 0 PREEMPT SMP PTI CPU: 4 PID: 3362 Comm: apparmor_parser Not tainted 6.8.0-24-generic #24 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:aafs_create.constprop.0+0x7f/0x130 Code: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae RSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82baac10 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007be9f22cf740(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000030 CR3: 0000000134b08000 CR4: 00000000000006f0 Call Trace: <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? kernelmode_fixup_or_oops+0xb2/0x140 ? __bad_area_nosemaphore+0x1a5/0x2c0 ? find_vma+0x34/0x60 ? bad_area_nosemaphore+0x16/0x30 ? do_user_addr_fault+0x2a2/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? aafs_create.constprop.0+0x7f/0x130 ? aafs_create.constprop.0+0x51/0x130 __aafs_profile_mkdir+0x3d6/0x480 aa_replace_profiles+0x83f/0x1270 policy_update+0xe3/0x180 profile_load+0xbc/0x150 ? rw_verify_area+0x47/0x140 vfs_write+0x100/0x480 ? __x64_sys_openat+0x55/0xa0 ? syscall_exit_to_user_mode+0x86/0x260 ksys_write+0x73/0x100 __x64_sys_write+0x19/0x30 x64_sys_call+0x7e/0x25c0 do_syscall_64+0x7f/0x180 entry_SYSCALL_64_after_hwframe+0x78/0x80 RIP: 0033:0x7be9f211c574 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 RSP: 002b:00007ffd26f2b8c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00005d504415e200 RCX: 00007be9f211c574 RDX: 0000000000001fc1 RSI: 00005d504418bc80 RDI: 0000000000000004 RBP: 0000000000001fc1 R08: 0000000000001fc1 R09: 0000000080000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00005d504418bc80 R13: 0000000000000004 R14: 00007ffd26f2b9b0 R15: 00007ffd26f2ba30 </TASK> Modules linked in: snd_seq_dummy snd_hrtimer qrtr snd_hda_codec_generic snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device i2c_i801 snd_timer i2c_smbus qxl snd soundcore drm_ttm_helper lpc_ich ttm joydev input_leds serio_raw mac_hid binfmt_misc msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs qemu_fw_cfg ip_tables x_tables autofs4 hid_generic usbhid hid ahci libahci psmouse virtio_rng xhci_pci xhci_pci_renesas CR2: 0000000000000030 ---[ end trace 0000000000000000 ]--- RIP: 0010:aafs_create.constprop.0+0x7f/0x130 Code: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae RSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82baac10 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007be9f22cf740(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000030 CR3: 0000000134b08000 CR4: 00000000000006f0
--- security/apparmor/apparmorfs.c | 4 ++++ 1 file changed, 4 insertions(+)
security/apparmor/apparmorfs.c +4 -0
@@ -1692,6 +1692,10 @@ int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)struct aa_profile *p; p =aa_deref_parent (profile); dent =prof_dir (p); +if (!dent) { + error = -ENOENT ; + goto fail2; + }/* adding to parent that previously didn't have children */ dent =aafs_create_dir ("profiles" , dent);if (IS_ERR (dent))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/184 wifi: ath12k: initialize ret in ath12k_qmi_load_file_target_mem()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit bb0b0a6b96e6de854cb1e349e17bd0e8bf421a59 ]
smatch flagged the following issue:
drivers/net/wireless/ath/ath12k/qmi.c:2619 ath12k_qmi_load_file_target_mem() error: uninitialized symbol 'ret'.
The reality is that 'ret' is initialized in every path through ath12k_qmi_load_file_target_mem() except one, the case where the input 'len' is 0, and hence the "while (remaining)" loop is never entered. But to make sure this case is also handled, add an initializer to the declaration of 'ret'.
No functional changes, compile tested only.
--- drivers/net/wireless/ath/ath12k/qmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/qmi.c +1 -1
@@ -2538,7 +2538,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab,struct qmi_wlanfw_bdf_download_resp_msg_v01 resp = {};struct qmi_txn txn;const u8 *temp = data; -int ret; +int ret =0 ;u32 remaining = len; req =kzalloc (sizeof (*req),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/184 wifi: ath11k: initialize ret in ath11k_qmi_load_file_target_mem()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 199f149e97dc7be80e5eed4b232529c1d1aa8055 ]
smatch flagged the following issue:
drivers/net/wireless/ath/ath11k/qmi.c:2401 ath11k_qmi_load_file_target_mem() error: uninitialized symbol 'ret'.
The reality is that 'ret' is initialized in every path through ath11k_qmi_load_file_target_mem() except one, the case where the input 'len' is 0, and hence the "while (remaining)" loop is never entered. But to make sure this case is also handled, add an initializer to the declaration of 'ret'.
No functional changes, compile tested only.
--- drivers/net/wireless/ath/ath11k/qmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/qmi.c +1 -1
@@ -2293,7 +2293,7 @@ static int ath11k_qmi_load_file_target_mem(struct ath11k_base *ab,struct qmi_txn txn;const u8 *temp = data;void __iomem *bdf_addr =NULL ; -int ret; +int ret =0 ;u32 remaining = len; req =kzalloc (sizeof (*req),GFP_KERNEL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/184 wifi: ath12k: initialize ret in ath12k_dp_rxdma_ring_sel_config_wcn7850()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Johnson <[email protected]>
[ Upstream commit 3b9344740843d965e9e37fba30620b3b1c0afa4f ]
smatch flagged the following issue:
drivers/net/wireless/ath/ath12k/dp_rx.c:4065 ath12k_dp_rxdma_ring_sel_config_wcn7850() error: uninitialized symbol 'ret'.
In ath12k_dp_rxdma_ring_sel_config_wcn7850() if it were ever the case that ab->hw_params->num_rxdma_per_pdev was 0 then 'ret' would be uninitialized when it is returned. This should never be the case, but to be safe and to quiet smatch, add an initializer to the declaration of 'ret'.
No functional changes, compile tested only.
--- drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/dp_rx.c +1 -1
@@ -4058,7 +4058,7 @@ int ath12k_dp_rxdma_ring_sel_config_wcn7850(struct ath12k_base *ab)struct ath12k_dp *dp = &ab->dp;struct htt_rx_ring_tlv_filter tlv_filter = {0 };u32 ring_id; -int ret; +int ret =0 ;u32 hal_rx_desc_sz = ab->hal.hal_desc_sz;int i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/184 drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit df0a9bd92fbbd3fcafcb2bce6463c9228a3e6868 ]
Check the input value for CUSTOM profile mode setting on legacy SOCs. Otherwise we may use uninitalized value of input[]
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 2 +- drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +1 -1
@@ -5641,7 +5641,7 @@ static int smu7_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, uint mode = input[size];switch (mode) {case PP_SMC_POWER_PROFILE_CUSTOM : -if (size <8 && size !=0 ) +if (size !=8 && size !=0 )return -EINVAL ;/* If only CUSTOM is passed in, use the saved values. Check * that we actually have a CUSTOM profile by ensuring that
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +6 -2
@@ -4102,9 +4102,11 @@ static int vega20_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, uiif (power_profile_mode ==PP_SMC_POWER_PROFILE_CUSTOM ) {struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend); -if (size ==0 && !data->is_custom_profile_set) + +if (size !=10 && size !=0 )return -EINVAL ; -if (size <10 && size !=0 ) + +if (size ==0 && !data->is_custom_profile_set)return -EINVAL ; result = vega20_get_activity_monitor_coeff(hwmgr,
@@ -4166,6 +4168,8 @@ static int vega20_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui activity_monitor.Fclk_PD_Data_error_coeff = input[8 ]; activity_monitor.Fclk_PD_Data_error_rate_coeff = input[9 ];break ; +default : +return -EINVAL ; } result = vega20_set_activity_monitor_coeff(hwmgr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/184 drm/amdgpu/pm: Check input value for power profile setting on smu11, smu13 and smu14
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Jun <[email protected]>
[ Upstream commit adb9de4dd207fb1264ea70b9eacab9f70ee4707a ]
Check the input value for CUSTOM profile mode setting on smu 11, smu13 and smu14. Otherwise we use uninitialized value of input[]
--- drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 5 +++++ drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 4 ++++ drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 4 ++++ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 5 +++++ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 4 ++++ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 5 +++++ 6 files changed, 27 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +5 -0
@@ -1416,6 +1416,9 @@ static int arcturus_set_power_profile_mode(struct smu_context *smu,if ((profile_mode ==PP_SMC_POWER_PROFILE_CUSTOM ) && (smu->smc_fw_version >=0x360d00 )) { +if (size !=10 ) +return -EINVAL ; + ret = smu_cmn_update_table(smu, SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -1449,6 +1452,8 @@ static int arcturus_set_power_profile_mode(struct smu_context *smu, activity_monitor.Mem_PD_Data_error_coeff = input[8 ]; activity_monitor.Mem_PD_Data_error_rate_coeff = input[9 ];break ; +default : +return -EINVAL ; } ret = smu_cmn_update_table(smu,
drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +4 -0
@@ -2021,6 +2021,8 @@ static int navi10_set_power_profile_mode(struct smu_context *smu, long *input, u }if (smu->power_profile_mode ==PP_SMC_POWER_PROFILE_CUSTOM ) { +if (size !=10 ) +return -EINVAL ; ret = smu_cmn_update_table(smu, SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -2064,6 +2066,8 @@ static int navi10_set_power_profile_mode(struct smu_context *smu, long *input, u activity_monitor.Mem_PD_Data_error_coeff = input[8 ]; activity_monitor.Mem_PD_Data_error_rate_coeff = input[9 ];break ; +default : +return -EINVAL ; } ret = smu_cmn_update_table(smu,
drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +4 -0
@@ -1722,6 +1722,8 @@ static int sienna_cichlid_set_power_profile_mode(struct smu_context *smu, long * }if (smu->power_profile_mode ==PP_SMC_POWER_PROFILE_CUSTOM ) { +if (size !=10 ) +return -EINVAL ; ret = smu_cmn_update_table(smu, SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -1765,6 +1767,8 @@ static int sienna_cichlid_set_power_profile_mode(struct smu_context *smu, long * activity_monitor->Mem_PD_Data_error_coeff = input[8 ]; activity_monitor->Mem_PD_Data_error_rate_coeff = input[9 ];break ; +default : +return -EINVAL ; } ret = smu_cmn_update_table(smu,
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +5 -0
@@ -2495,6 +2495,9 @@ static int smu_v13_0_0_set_power_profile_mode(struct smu_context *smu, }if (smu->power_profile_mode ==PP_SMC_POWER_PROFILE_CUSTOM ) { +if (size !=9 ) +return -EINVAL ; + ret = smu_cmn_update_table(smu, SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -2526,6 +2529,8 @@ static int smu_v13_0_0_set_power_profile_mode(struct smu_context *smu, activity_monitor->Fclk_PD_Data_error_coeff = input[7 ]; activity_monitor->Fclk_PD_Data_error_rate_coeff = input[8 ];break ; +default : +return -EINVAL ; } ret = smu_cmn_update_table(smu,
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +4 -0
@@ -2450,6 +2450,8 @@ static int smu_v13_0_7_set_power_profile_mode(struct smu_context *smu, long *inp }if (smu->power_profile_mode ==PP_SMC_POWER_PROFILE_CUSTOM ) { +if (size !=8 ) +return -EINVAL ; ret = smu_cmn_update_table(smu, SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -2478,6 +2480,8 @@ static int smu_v13_0_7_set_power_profile_mode(struct smu_context *smu, long *inp activity_monitor->Fclk_MinActiveFreq = input[6 ]; activity_monitor->Fclk_BoosterFreq = input[7 ];break ; +default : +return -EINVAL ; } ret = smu_cmn_update_table(smu,
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c +5 -0
@@ -1364,6 +1364,9 @@ static int smu_v14_0_2_set_power_profile_mode(struct smu_context *smu, }if (smu->power_profile_mode ==PP_SMC_POWER_PROFILE_CUSTOM ) { +if (size !=9 ) +return -EINVAL ; + ret = smu_cmn_update_table(smu, SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
@@ -1395,6 +1398,8 @@ static int smu_v14_0_2_set_power_profile_mode(struct smu_context *smu, activity_monitor->Fclk_PD_Data_error_coeff = input[7 ]; activity_monitor->Fclk_PD_Data_error_rate_coeff = input[8 ];break ; +default : +return -EINVAL ; } ret = smu_cmn_update_table(smu,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/184 drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David (Ming Qiang) Wu <[email protected]>
[ Upstream commit 10fe1a79cd1bff3048e13120e93c02f8ecd05e9d ]
We do not directly enable/disable VCN IRQ in vcn 5.0.0. And we do not handle the IRQ state as well. So the calls to disable IRQ and set state are removed. This effectively gets rid of the warining of
"WARN_ON(!amdgpu_irq_enabled(adev, src, type))"
in amdgpu_irq_put().
--- drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c | 19 ------------------- 1 file changed, 19 deletions(-)
drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c +0 -19
@@ -229,8 +229,6 @@ static int vcn_v5_0_0_hw_fini(void *handle)for (i =0 ; i < adev->vcn.num_vcn_inst; ++i) {if (adev->vcn.harvest_config & (1 << i))continue ; - -amdgpu_irq_put (adev, &adev->vcn.inst[i].irq,0 ); }return 0 ;
@@ -1232,22 +1230,6 @@ static int vcn_v5_0_0_set_powergating_state(void *handle, enum amd_powergating_sreturn ret; } -/** -* vcn_v5_0_0_set_interrupt_state - set VCN block interrupt state -* -* @adev: amdgpu_device pointer -* @source: interrupt sources -* @type: interrupt types -* @state: interrupt states -* -* Set VCN block interrupt state -*/ -static int vcn_v5_0_0_set_interrupt_state (struct amdgpu_device *adev,struct amdgpu_irq_src *source, -unsigned type,enum amdgpu_interrupt_state state) -{ -return 0 ; -} -/** * vcn_v5_0_0_process_interrupt - process VCN block interrupt *
@@ -1293,7 +1275,6 @@ static int vcn_v5_0_0_process_interrupt(struct amdgpu_device *adev, struct amdgp }static const struct amdgpu_irq_src_funcs vcn_v5_0_0_irq_funcs = { - .set = vcn_v5_0_0_set_interrupt_state, .process = vcn_v5_0_0_process_interrupt, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/184 drm/amdgpu: Fix the warning division or modulo by zero
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ]
Checks the partition mode and returns an error for an invalid mode.
--- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +6 -0
@@ -501,6 +501,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr,if (mode ==AMDGPU_AUTO_COMPUTE_PARTITION_MODE ) { mode =__aqua_vanjaram_get_auto_mode (xcp_mgr); +if (mode ==AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE ) { +dev_err (adev->dev, +"Invalid config, no compatible compute partition mode found, available memory partitions: %d" , + adev->gmc.num_mem_partitions); +return -EINVAL ; + } }else if (!__aqua_vanjaram_is_valid_mode (xcp_mgr, mode)) { dev_err(adev->dev, "Invalid compute partition mode requested, requested: %s, available memory partitions: %d",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/184 drm/amdgpu: fix dereference after null check
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit b1f7810b05d1950350ac2e06992982974343e441 ]
check the pointer hive before use.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +1 -1
@@ -5727,7 +5727,7 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,* to put adev in the 1st position. */ INIT_LIST_HEAD (&device_list); -if (!amdgpu_sriov_vf (adev) && (adev->gmc.xgmi.num_physical_nodes >1 )) { +if (!amdgpu_sriov_vf (adev) && (adev->gmc.xgmi.num_physical_nodes >1 ) && hive) {list_for_each_entry (tmp_adev, &hive->device_list, gmc.xgmi.head) {list_add_tail (&tmp_adev->reset_list, &device_list);if (adev->shutdown)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/184 drm/amdgpu: fix the waring dereferencing hive
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 1940708ccf5aff76de4e0b399f99267c93a89193 ]
Check the amdgpu_hive_info *hive that maybe is NULL.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +3 -0
@@ -1375,6 +1375,9 @@ static void psp_xgmi_reflect_topology_info(struct psp_context *psp,uint8_t dst_num_links = node_info.num_links; hive =amdgpu_get_xgmi_hive (psp->adev); +if (WARN_ON (!hive)) +return ; +list_for_each_entry (mirror_adev, &hive->device_list, gmc.xgmi.head) {struct psp_xgmi_topology_info *mirror_top_info;int j;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/184 drm/amd/pm: check specific index for aldebaran
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 0ce8ef2639c112ae203c985b758389e378630aac ]
Check for specific indexes that may be invalid values.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +2 -1
@@ -1886,7 +1886,8 @@ static int aldebaran_mode2_reset(struct smu_context *smu) index =smu_cmn_to_asic_specific_index (smu,CMN2ASIC_MAPPING_MSG , SMU_MSG_GfxDeviceDriverReset); - +if (index <0 ) +return -EINVAL ;mutex_lock (&smu->message_lock);if (smu->smc_fw_version >=0x00441400 ) { ret =smu_cmn_send_msg_without_waiting (smu, (uint16_t )index,SMU_RESET_MODE_2 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/184 drm/amd/pm: check specific index for smu13
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit a3ac9d1c9751f00026c2d98b802ec8a98626c3ed ]
Check for specific indexes that may be invalid values.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +2 -0
@@ -2333,6 +2333,8 @@ static int smu_v13_0_6_mode2_reset(struct smu_context *smu) index =smu_cmn_to_asic_specific_index (smu,CMN2ASIC_MAPPING_MSG , SMU_MSG_GfxDeviceDriverReset); +if (index <0 ) +return index;mutex_lock (&smu->message_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/184 drm/amdgpu: the warning dereferencing obj for nbio_v7_4
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit d190b459b2a4304307c3468ed97477b808381011 ]
if ras_manager obj null, don't print NBIO err data
--- drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c +1 -1
@@ -387,7 +387,7 @@ static void nbio_v7_4_handle_ras_controller_intr_no_bifring(struct amdgpu_deviceelse WREG32_SOC15 (NBIO ,0 , mmBIF_DOORBELL_INT_CNTL, bif_doorbell_intr_cntl); -if (!ras->disable_ras_err_cnt_harvest) { +if (ras && !ras->disable_ras_err_cnt_harvest && obj) {/* * clear error status after ras_controller_intr * according to hw team and count ue number
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/184 drm/amdgpu: fix the warning bad bit shift operation for aca_error_type type
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit e6ae021adb79e5f4c4bc4362dd651d7b8b646340 ]
Filter invalid aca error types before performing a shift operation.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c +1 -1
@@ -534,7 +534,7 @@ int amdgpu_aca_get_error_data(struct amdgpu_device *adev, struct aca_handle *hanif (aca_handle_is_valid (handle))return -EOPNOTSUPP ; -if (!(BIT (type) & handle->mask)) +if ((type <0 ) || (!(BIT (type) & handle->mask)))return 0 ;return __aca_get_error_data (adev, handle, type, err_data, qctx);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/184 drm/amd/pm: check negtive return for table entries
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit f76059fe14395b37ba8d997eb0381b1b9e80a939 ]
Function hwmgr->hwmgr_func->get_num_of_pp_table_entries(hwmgr) returns a negative number
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c +8 -5
@@ -30,9 +30,8 @@ int psm_init_power_state_table(struct pp_hwmgr *hwmgr) {int result;unsigned int i; -unsigned int table_entries;struct pp_power_state *state; -int size; +int size, table_entries;if (hwmgr->hwmgr_func->get_num_of_pp_table_entries ==NULL )return 0 ;
@@ -40,15 +39,19 @@ int psm_init_power_state_table(struct pp_hwmgr *hwmgr)if (hwmgr->hwmgr_func->get_power_state_size ==NULL )return 0 ; - hwmgr->num_ps = table_entries = hwmgr->hwmgr_func->get_num_of_pp_table_entries (hwmgr); + table_entries = hwmgr->hwmgr_func->get_num_of_pp_table_entries (hwmgr); - hwmgr->ps_size = size = hwmgr->hwmgr_func->get_power_state_size (hwmgr) + + size = hwmgr->hwmgr_func->get_power_state_size (hwmgr) +sizeof (struct pp_power_state ); -if (table_entries ==0 || size ==0 ) { +if (table_entries <=0 || size ==0 ) {pr_warn ("Please check whether power state management is supported on this asic\n" ); + hwmgr->num_ps =0 ; + hwmgr->ps_size =0 ;return 0 ; } + hwmgr->num_ps = table_entries; + hwmgr->ps_size = size; hwmgr->ps =kcalloc (table_entries, size,GFP_KERNEL );if (hwmgr->ps ==NULL )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/184 wifi: rtw89: ser: avoid multiple deinit on same CAM
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit cea4066588308fa932b6b03486c608efff1d761c ]
We did deinit CAM in STA iteration in VIF loop. But, the STA iteration missed to restrict the target VIF. So, if there are multiple VIFs, we would deinit a CAM multiple times. Now, fix it.
--- drivers/net/wireless/realtek/rtw89/ser.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/ser.c +6 -2
@@ -308,9 +308,13 @@ static void ser_reset_vif(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)static void ser_sta_deinit_cam_iter (void *data,struct ieee80211_sta *sta) { -struct rtw89_vif *rtwvif = (struct rtw89_vif *)data; -struct rtw89_dev *rtwdev = rtwvif->rtwdev; +struct rtw89_vif *target_rtwvif = (struct rtw89_vif *)data;struct rtw89_sta *rtwsta = (struct rtw89_sta *)sta->drv_priv; +struct rtw89_vif *rtwvif = rtwsta->rtwvif; +struct rtw89_dev *rtwdev = rtwvif->rtwdev; + +if (rtwvif != target_rtwvif) +return ;if (rtwvif->net_type ==RTW89_NET_TYPE_AP_MODE || sta->tdls)rtw89_cam_deinit_addr_cam (rtwdev, &rtwsta->addr_cam);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/184 drm/xe: Fix the warning conditions
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Himal Prasad Ghimiray <[email protected]>
[ Upstream commit 4c0be90e6874b8af30541c37689780fc7c8276c9 ]
The maximum timeout display uses in xe_pcode_request is 3 msec, add the warning in cases the function is misused with higher timeouts.
Add a warning if pcode_try_request is not passed the timeout parameter greater than 0.
--- drivers/gpu/drm/xe/xe_pcode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_pcode.c +5 -1
@@ -10,6 +10,7 @@#include <drm/drm_managed.h> +#include "xe_assert.h" #include "xe_device.h" #include "xe_gt.h" #include "xe_mmio.h"
@@ -124,6 +125,8 @@ static int pcode_try_request(struct xe_gt *gt, u32 mbox, {int slept, wait =10 ; +xe_gt_assert (gt, timeout_us >0 ); +for (slept =0 ; slept < timeout_us; slept += wait) {if (locked) *status = pcode_mailbox_rw(gt, mbox, &request, NULL, 1, true,
@@ -169,6 +172,8 @@ int xe_pcode_request(struct xe_gt *gt, u32 mbox, u32 request,u32 status;int ret; +xe_gt_assert (gt, timeout_base_ms <=3 ); +mutex_lock (>->pcode.lock); ret = pcode_try_request(gt, mbox, request, reply_mask, reply, &status,
@@ -188,7 +193,6 @@ int xe_pcode_request(struct xe_gt *gt, u32 mbox, u32 request,*/ drm_err (>_to_xe (gt)->drm,"PCODE timeout, retrying with preemption disabled\n" ); -drm_WARN_ON_ONCE (>_to_xe (gt)->drm, timeout_base_ms >1 );preempt_disable (); ret =pcode_try_request (gt, mbox, request, reply_mask, reply, &status, true,50 *1000 , true);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/184 drm/kfd: Correct pinned buffer handling at kfd restore and validate process
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaogang Chen <[email protected]>
[ Upstream commit f326d7cc745683f53052b84382bd10567b45cd5d ]
This reverts commit 8a774fe912ff ("drm/amdgpu: avoid restore process run into dead loop") since buffer got pinned is not related whether it needs mapping
And skip buffer validation at kfd driver if the buffer has been pinned.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +5 -4
@@ -415,6 +415,10 @@ static int amdgpu_amdkfd_bo_validate(struct amdgpu_bo *bo, uint32_t domain, "Called with userptr BO"))return -EINVAL ; +/* bo has been pinned, not need validate it */ +if (bo->tbo.pin_count) +return 0 ; +amdgpu_bo_placement_from_domain (bo, domain); ret =ttm_bo_validate (&bo->tbo, &bo->placement, &ctx);
@@ -2712,7 +2716,7 @@ static int confirm_valid_user_pages_locked(struct amdkfd_process_info *process_i/* keep mem without hmm range at userptr_inval_list */ if (!mem->range) -continue ; +continue ;/* Only check mem with hmm range associated */ valid = amdgpu_ttm_tt_get_user_pages_done(
@@ -2957,9 +2961,6 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence __rcu *if (!attachment->is_mapped)continue ; -if (attachment->bo_va->base.bo->tbo.pin_count) -continue ; -kfd_mem_dmaunmap_attachment (mem, attachment); ret =update_gpuvm_pte (mem, attachment, &sync_obj);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/184 drm/amdgpu: fix compiler side-effect check issue for RAS_EVENT_LOG()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <[email protected]>
[ Upstream commit b712d7c20133b67f13aa134e7534369f19e1214f ]
create a new helper function to avoid compiler 'side-effect' check about RAS_EVENT_LOG() macro.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 18 ++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h | 13 ++++++------- 2 files changed, 24 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +18 -0
@@ -4504,3 +4504,21 @@ int amdgpu_ras_reserve_page(struct amdgpu_device *adev, uint64_t pfn)return ret; } + +void amdgpu_ras_event_log_print (struct amdgpu_device *adev,u64 event_id, +const char *fmt, ...) +{ +struct va_format vaf; +va_list args; + +va_start (args, fmt); + vaf.fmt = fmt; + vaf.va = &args; + +if (amdgpu_ras_event_id_is_valid (adev, event_id)) +dev_printk (KERN_INFO , adev->dev,"{%llu}%pV" , event_id, &vaf); +else +dev_printk (KERN_INFO , adev->dev,"%pV" , &vaf); + +va_end (args); +}
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h +6 -7
@@ -67,13 +67,8 @@ struct amdgpu_iv_entry;/* The high three bits indicates socketid */ #define AMDGPU_RAS_GET_FEATURES (val) ((val) & ~AMDGPU_RAS_FEATURES_SOCKETID_MASK) -#define RAS_EVENT_LOG (_adev, _id, _fmt, ...) \ -do { \ - if (amdgpu_ras_event_id_is_valid((_adev), (_id))) \ - dev_info((_adev)->dev, "{%llu}" _fmt, (_id), ##__VA_ARGS__); \ - else \ - dev_info((_adev)->dev, _fmt, ##__VA_ARGS__); \ -} while (0) +#define RAS_EVENT_LOG (adev, id, fmt, ...) \ + amdgpu_ras_event_log_print((adev), (id), (fmt), ##__VA_ARGS__);enum amdgpu_ras_block {AMDGPU_RAS_BLOCK__UMC =0 ,
@@ -956,4 +951,8 @@ int amdgpu_ras_put_poison_req(struct amdgpu_device *adev, enum amdgpu_ras_block block, uint16_t pasid, pasid_notify pasid_fn, void *data, uint32_t reset); +__printf(3, 4) +void amdgpu_ras_event_log_print (struct amdgpu_device *adev,u64 event_id, +const char *fmt, ...); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/184 drm/amd/display: Fix pipe addition logic in calc_blocks_to_ungate DCN35
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Susanto <[email protected]>
[ Upstream commit 3aec7a5af4d6248b7462b7d1eb597f06d35f5ee0 ]
[Why]
Missing check for when there is new pipe configuration but both cur_pipe and new_pipe are both populated causing update_state of DSC for that instance not being updated correctly.
This causes some display mode changes to cause underflow since DSCCLK is still gated when the display requires DSC.
[How]
Added another condition in the new pipe addition branch that checks if there is a new pipe configuration and if it is not the same as cur_pipe. cur_pipe does not necessarily have to be NULL to go in this branch.
--- drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c +2 -1
@@ -1077,7 +1077,8 @@ void dcn35_calc_blocks_to_ungate(struct dc *dc, struct dc_state *context,continue ;if ((!cur_pipe->plane_state && new_pipe->plane_state) || - (!cur_pipe->stream && new_pipe->stream)) { + (!cur_pipe->stream && new_pipe->stream) || + (cur_pipe->stream != new_pipe->stream && new_pipe->stream)) {// New pipe addition for (j =0 ; j <PG_HW_PIPE_RESOURCES_NUM_ELEMENT ; j++) {if (j ==PG_HUBP && new_pipe->plane_res.hubp)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/184 drm/amdgpu: Queue KFD reset workitem in VF FED
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Skvortsov <[email protected]>
[ Upstream commit 5434bc03f52de2ec57d6ce684b1853928f508cbc ]
The guest recovery sequence is buggy in Fatal Error when both FLR & KFD reset workitems are queued at the same time. In addition, FLR guest recovery sequence is out of order when PF/VF communication breaks due to a GPU fatal error
As a temporary work around, perform a KFD style reset (Initiate reset request from the guest) inside the pf2vf thread on FED.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +1 -1
@@ -602,7 +602,7 @@ static void amdgpu_virt_update_vf2pf_work_item(struct work_struct *work) amdgpu_sriov_runtime(adev) && !amdgpu_in_reset(adev)) {amdgpu_ras_set_fed (adev, true);if (amdgpu_reset_domain_schedule (adev->reset_domain, - &adev->virt.flr_work)) + &adev->kfd.reset_work))return ;else dev_err (adev->dev,"Failed to queue work! at %s" , __func__);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/184 drm/amdgpu: update type of buf size to u32 for eeprom functions
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Zhou <[email protected]>
[ Upstream commit 2aadb520bfacec12527effce3566f8df55e5d08e ]
Avoid overflow issue.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.c +3 -3
@@ -179,7 +179,7 @@ static int __amdgpu_eeprom_xfer(struct i2c_adapter *i2c_adap, u32 eeprom_addr,* Returns the number of bytes read/written; -errno on error. */ static int amdgpu_eeprom_xfer (struct i2c_adapter *i2c_adap,u32 eeprom_addr, -u8 *eeprom_buf,u16 buf_size,bool read) +u8 *eeprom_buf,u32 buf_size,bool read) {const struct i2c_adapter_quirks *quirks = i2c_adap->quirks;u16 limit;
@@ -225,7 +225,7 @@ static int amdgpu_eeprom_xfer(struct i2c_adapter *i2c_adap, u32 eeprom_addr,int amdgpu_eeprom_read (struct i2c_adapter *i2c_adap,u32 eeprom_addr,u8 *eeprom_buf, -u16 bytes) +u32 bytes) {return amdgpu_eeprom_xfer (i2c_adap, eeprom_addr, eeprom_buf, bytes, true);
@@ -233,7 +233,7 @@ int amdgpu_eeprom_read(struct i2c_adapter *i2c_adap,int amdgpu_eeprom_write (struct i2c_adapter *i2c_adap,u32 eeprom_addr,u8 *eeprom_buf, -u16 bytes) +u32 bytes) {return amdgpu_eeprom_xfer (i2c_adap, eeprom_addr, eeprom_buf, bytes, false);
drivers/gpu/drm/amd/amdgpu/amdgpu_eeprom.h +2 -2
@@ -28,10 +28,10 @@int amdgpu_eeprom_read (struct i2c_adapter *i2c_adap,u32 eeprom_addr,u8 *eeprom_buf, -u16 bytes); +u32 bytes);int amdgpu_eeprom_write (struct i2c_adapter *i2c_adap,u32 eeprom_addr,u8 *eeprom_buf, -u16 bytes); +u32 bytes);#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/184 wifi: iwlwifi: remove fw_running op
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar S Matityahu <[email protected]>
[ Upstream commit 37733bffda3285d18bd1d72c14b3a1cf39c56a5e ]
fw_running assumes that memory can be retrieved only after alive. This assumption is no longer true as we support dump before alive. To avoid invalid access to the NIC, check that STATUS_DEVICE_ENABLED bit in trans status is set before dumping instead of the prior check.
--- drivers/net/wireless/intel/iwlwifi/fw/debugfs.c | 3 +-- drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 1 - drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ------ 3 files changed, 1 insertion(+), 9 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/debugfs.c +1 -2
@@ -230,8 +230,7 @@ static ssize_t iwl_dbgfs_send_hcmd_write(struct iwl_fw_runtime *fwrt, char *buf, .data = { NULL, }, }; -if (fwrt->ops && fwrt->ops->fw_running && - !fwrt->ops->fw_running (fwrt->ops_ctx)) +if (!iwl_trans_fw_running (fwrt->trans))return -EIO ;if (count < header_size +1 || count >1024 *4 )
drivers/net/wireless/intel/iwlwifi/fw/runtime.h +0 -1
@@ -19,7 +19,6 @@struct iwl_fw_runtime_ops {void (*dump_start)(void *ctx);void (*dump_end)(void *ctx); -bool (*fw_running)(void *ctx);int (*send_hcmd)(void *ctx,struct iwl_host_cmd *host_cmd);bool (*d3_debug_enable)(void *ctx); };
drivers/net/wireless/intel/iwlwifi/mvm/ops.c +0 -6
@@ -770,11 +770,6 @@ static void iwl_mvm_fwrt_dump_end(void *ctx)mutex_unlock (&mvm->mutex); } -static bool iwl_mvm_fwrt_fw_running (void *ctx) -{ -return iwl_mvm_firmware_running (ctx); -} -static int iwl_mvm_fwrt_send_hcmd (void *ctx,struct iwl_host_cmd *host_cmd) {struct iwl_mvm *mvm = (struct iwl_mvm *)ctx;
@@ -795,7 +790,6 @@ static bool iwl_mvm_d3_debug_enable(void *ctx)static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = { .dump_start = iwl_mvm_fwrt_dump_start, .dump_end = iwl_mvm_fwrt_dump_end, - .fw_running = iwl_mvm_fwrt_fw_running, .send_hcmd = iwl_mvm_fwrt_send_hcmd, .d3_debug_enable = iwl_mvm_d3_debug_enable, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/184 wifi: cfg80211: restrict operation during radar detection
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 2d33ecf5d0148671c74e68e18755b9411a7ba923 ]
Just like it's not currently possible to start radar detection while already operating, it shouldn't be possible to start operating while radar detection is running. Fix that.
Also, improve the check whether operating (carrier might not be up if e.g. attempting to join IBSS).
--- net/wireless/ibss.c | 5 ++++- net/wireless/mesh.c | 5 ++++- net/wireless/nl80211.c | 21 +++++++++++++++------ 3 files changed, 23 insertions(+), 8 deletions(-)
net/wireless/ibss.c +4 -1
@@ -3,7 +3,7 @@* Some IBSS support code for cfg80211. * * Copyright 2009 Johannes Berg <[email protected]> -* Copyright (C) 2020-2023 Intel Corporation +* Copyright (C) 2020-2024 Intel Corporation */ #include <linux/etherdevice.h>
@@ -94,6 +94,9 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,lockdep_assert_held (&rdev->wiphy.mtx); +if (wdev->cac_started) +return -EBUSY ; +if (wdev->u.ibss.ssid_len)return -EALREADY ;
net/wireless/mesh.c +4 -1
@@ -1,7 +1,7 @@// SPDX-License-Identifier: GPL-2.0 /* * Portions -* Copyright (C) 2022-2023 Intel Corporation +* Copyright (C) 2022-2024 Intel Corporation */ #include <linux/ieee80211.h> #include <linux/export.h>
@@ -127,6 +127,9 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,if (!rdev->ops->join_mesh)return -EOPNOTSUPP ; +if (wdev->cac_started) +return -EBUSY ; +if (!setup->chandef.chan) {/* if no channel explicitly given, use preset channel */ setup->chandef = wdev->u.mesh.preset_chandef;
net/wireless/nl80211.c +15 -6
@@ -5965,6 +5965,9 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)if (!rdev->ops->start_ap)return -EOPNOTSUPP ; +if (wdev->cac_started) +return -EBUSY ; +if (wdev->links[link_id].ap.beacon_interval)return -EALREADY ;
@@ -9957,6 +9960,17 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,flush_delayed_work (&rdev->dfs_update_channels_wk); +switch (wdev->iftype) { +case NL80211_IFTYPE_AP : +case NL80211_IFTYPE_P2P_GO : +case NL80211_IFTYPE_MESH_POINT : +case NL80211_IFTYPE_ADHOC : +break ; +default : +/* caution - see cfg80211_beaconing_iface_active() below */ +return -EINVAL ; + } +wiphy_lock (wiphy); dfs_region =reg_get_dfs_region (wiphy);
@@ -9987,12 +10001,7 @@ static int nl80211_start_radar_detection(struct sk_buff *skb, goto unlock; } -if (netif_carrier_ok (dev)) { - err = -EBUSY ; - goto unlock; - } - -if (wdev->cac_started) { +if (cfg80211_beaconing_iface_active (wdev) || wdev->cac_started) { err = -EBUSY ; goto unlock; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/184 cpufreq: scmi: Avoid overflow of target_freq in fast switch
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jagadeesh Kona <[email protected]>
[ Upstream commit 074cffb5020ddcaa5fafcc55655e5da6ebe8c831 ]
Conversion of target_freq to HZ in scmi_cpufreq_fast_switch() can lead to overflow if the multiplied result is greater than UINT_MAX, since type of target_freq is unsigned int. Avoid this overflow by assigning target_freq to unsigned long variable for converting it to HZ.
--- drivers/cpufreq/scmi-cpufreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/scmi-cpufreq.c +2 -2
@@ -63,9 +63,9 @@ static unsigned int scmi_cpufreq_fast_switch(struct cpufreq_policy *policy, unsigned int target_freq) {struct scmi_data *priv = policy->driver_data; +unsigned long freq = target_freq; -if (!perf_ops->freq_set (ph, priv->domain_id, - target_freq *1000 , true)) +if (!perf_ops->freq_set (ph, priv->domain_id, freq *1000 , true))return target_freq;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/184 PCI: al: Check IORESOURCE_BUS existence during probe
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit a9927c2cac6e9831361e43a14d91277818154e6a ]
If IORESOURCE_BUS is not provided in Device Tree it will be fabricated in of_pci_parse_bus_range(), so NULL pointer dereference should not happen here.
But that's hard to verify, so check for NULL anyway.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/pci/controller/dwc/pcie-al.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/pci/controller/dwc/pcie-al.c +13 -3
@@ -242,18 +242,24 @@ static struct pci_ops al_child_pci_ops = { .write = pci_generic_config_write, }; -static void al_pcie_config_prepare (struct al_pcie *pcie) +static int al_pcie_config_prepare (struct al_pcie *pcie) {struct al_pcie_target_bus_cfg *target_bus_cfg;struct dw_pcie_rp *pp = &pcie->pci->pp;unsigned int ecam_bus_mask; +struct resource_entry *ft;u32 cfg_control_offset; +struct resource *bus;u8 subordinate_bus;u8 secondary_bus;u32 cfg_control;u32 reg; -struct resource *bus =resource_list_first_type (&pp->bridge->windows,IORESOURCE_BUS )->res; + ft =resource_list_first_type (&pp->bridge->windows,IORESOURCE_BUS ); +if (!ft) +return -ENODEV ; + + bus = ft->res; target_bus_cfg = &pcie->target_bus_cfg; ecam_bus_mask = (pcie->ecam_size >>PCIE_ECAM_BUS_SHIFT ) -1 ;
@@ -287,6 +293,8 @@ static void al_pcie_config_prepare(struct al_pcie *pcie)FIELD_PREP (CFG_CONTROL_SEC_BUS_MASK , secondary_bus);al_pcie_controller_writel (pcie, cfg_control_offset, reg); + +return 0 ; }static int al_pcie_host_init (struct dw_pcie_rp *pp)
@@ -305,7 +313,9 @@ static int al_pcie_host_init(struct dw_pcie_rp *pp)if (rc)return rc; -al_pcie_config_prepare (pcie); + rc =al_pcie_config_prepare (pcie); +if (rc) +return rc;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/184 remoteproc: mediatek: Zero out only remaining bytes of IPI buffer
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 9dbd9962cfe56d210be5232349851420b5f9c8f6 ]
In scp_ipi_handler(), instead of zeroing out the entire shared buffer, which may be as large as 600 bytes, overwrite it with the received data, then zero out only the remaining bytes.
--- drivers/remoteproc/mtk_scp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/remoteproc/mtk_scp.c +1 -1
@@ -117,8 +117,8 @@ static void scp_ipi_handler(struct mtk_scp *scp)return ; } -memset (scp->share_buf,0 , scp_sizes->ipi_share_buffer_size);memcpy_fromio (scp->share_buf, &rcv_obj->share_buf, len); +memset (&scp->share_buf[len],0 , scp_sizes->ipi_share_buffer_size - len);handler (scp->share_buf, len, ipi_desc[id].priv);scp_ipi_unlock (scp, id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/184 wifi: iwlwifi: mvm: use only beacon BSS load for active links
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit d9b7531fe98a0c2a0387270557cf0a514c28dd28 ]
For active links, don't take information that may have been received in probe responses, as those are not protected. For inactive links, there may not be a choice.
--- drivers/net/wireless/intel/iwlwifi/mvm/link.c | 14 ++++++++++++-- .../net/wireless/intel/iwlwifi/mvm/tests/links.c | 1 + 2 files changed, 13 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/link.c +12 -2
@@ -504,17 +504,27 @@ iwl_mvm_get_puncturing_factor(const struct ieee80211_bss_conf *link_conf)static unsigned int iwl_mvm_get_chan_load (struct ieee80211_bss_conf *link_conf) { +struct ieee80211_vif *vif = link_conf->vif;struct iwl_mvm_vif_link_info *mvm_link =iwl_mvm_vif_from_mac80211 (link_conf->vif)->link[link_conf->link_id];const struct element *bss_load_elem;const struct ieee80211_bss_load_elem *bss_load;enum nl80211_band band = link_conf->chanreq.oper.chan->band; +const struct cfg80211_bss_ies *ies;unsigned int chan_load;u32 chan_load_by_us;rcu_read_lock (); - bss_load_elem =ieee80211_bss_get_elem (link_conf->bss, -WLAN_EID_QBSS_LOAD ); +if (ieee80211_vif_link_active (vif, link_conf->link_id)) + ies =rcu_dereference (link_conf->bss->beacon_ies); +else + ies =rcu_dereference (link_conf->bss->ies); + +if (ies) + bss_load_elem =cfg80211_find_elem (WLAN_EID_QBSS_LOAD , + ies->data, ies->len); +else + bss_load_elem =NULL ;/* If there isn't BSS Load element, take the defaults */ if (!bss_load_elem ||
drivers/net/wireless/intel/iwlwifi/mvm/tests/links.c +1 -0
@@ -208,6 +208,7 @@ static void setup_link_conf(struct kunit *test) bss_load->channel_util = params->channel_util;rcu_assign_pointer (bss.ies, ies); +rcu_assign_pointer (bss.beacon_ies, ies); }static void test_link_grading (struct kunit *test)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/184 wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit a0ca76e5b7d550fcd74753d5fdaaf23f1a9bfdb4 ]
It's not valid to call ieee80211_bss_info_change_notify() with an sdata that's an MLD, remove the FIXME comment (it's not true) and add a warning.
--- net/mac80211/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/main.c +2 -1
@@ -337,6 +337,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,might_sleep (); +WARN_ON_ONCE (ieee80211_vif_is_mld (&sdata->vif)); +if (!changed || sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )return ;
@@ -369,7 +371,6 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,if (changed & ~BSS_CHANGED_VIF_CFG_FLAGS ) {u64 ch = changed & ~BSS_CHANGED_VIF_CFG_FLAGS ; -/* FIXME: should be for each link */ trace_drv_link_info_changed (local, sdata, &sdata->vif.bss_conf, changed);if (local->ops->link_info_changed)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/184 hwspinlock: Introduce hwspin_lock_bust()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Maina <[email protected]>
[ Upstream commit 7c327d56597d8de1680cf24e956b704270d3d84a ]
When a remoteproc crashes or goes down unexpectedly this can result in a state where locks held by the remoteproc will remain locked possibly resulting in deadlock. This new API hwspin_lock_bust() allows hwspinlock implementers to define a bust operation for freeing previously acquired hwspinlocks after verifying ownership of the acquired lock.
--- Documentation/locking/hwspinlock.rst | 11 ++++++++++ drivers/hwspinlock/hwspinlock_core.c | 28 ++++++++++++++++++++++++ drivers/hwspinlock/hwspinlock_internal.h | 3 +++ include/linux/hwspinlock.h | 6 +++++ 4 files changed, 48 insertions(+)
Documentation/locking/hwspinlock.rst +11 -0
@@ -85,6 +85,17 @@ is already free). Should be called from a process context (might sleep). +:: + + int hwspin_lock_bust(struct hwspinlock *hwlock, unsigned int id); + +After verifying the owner of the hwspinlock, release a previously acquired +hwspinlock; returns 0 on success, or an appropriate error code on failure +(e.g. -EOPNOTSUPP if the bust operation is not defined for the specific +hwspinlock). + +Should be called from a process context (might sleep). + :: int hwspin_lock_timeout(struct hwspinlock *hwlock, unsigned int timeout);
drivers/hwspinlock/hwspinlock_core.c +28 -0
@@ -305,6 +305,34 @@ void __hwspin_unlock(struct hwspinlock *hwlock, int mode, unsigned long *flags) }EXPORT_SYMBOL_GPL (__hwspin_unlock); +/** +* hwspin_lock_bust() - bust a specific hwspinlock +* @hwlock: a previously-acquired hwspinlock which we want to bust +* @id: identifier of the remote lock holder, if applicable +* +* This function will bust a hwspinlock that was previously acquired as +* long as the current owner of the lock matches the id given by the caller. +* +* Context: Process context. +* +* Returns: 0 on success, or -EINVAL if the hwspinlock does not exist, or +* the bust operation fails, and -EOPNOTSUPP if the bust operation is not +* defined for the hwspinlock. +*/ +int hwspin_lock_bust (struct hwspinlock *hwlock,unsigned int id) +{ +if (WARN_ON (!hwlock)) +return -EINVAL ; + +if (!hwlock->bank->ops->bust) { +pr_err ("bust operation not defined\n" ); +return -EOPNOTSUPP ; + } + +return hwlock->bank->ops->bust (hwlock, id); +} +EXPORT_SYMBOL_GPL (hwspin_lock_bust); +/** * of_hwspin_lock_simple_xlate - translate hwlock_spec to return a lock id * @hwlock_spec: hwlock specifier as found in the device tree
drivers/hwspinlock/hwspinlock_internal.h +3 -0
@@ -21,6 +21,8 @@ struct hwspinlock_device;* @trylock: make a single attempt to take the lock. returns 0 on * failure and true on success. may _not_ sleep. * @unlock: release the lock. always succeed. may _not_ sleep. +* @bust: optional, platform-specific bust handler, called by hwspinlock +* core to bust a specific lock. * @relax: optional, platform-specific relax handler, called by hwspinlock * core while spinning on a lock, between two successive * invocations of @trylock. may _not_ sleep.
@@ -28,6 +30,7 @@ struct hwspinlock_device;struct hwspinlock_ops {int (*trylock)(struct hwspinlock *lock);void (*unlock)(struct hwspinlock *lock); +int (*bust)(struct hwspinlock *lock,unsigned int id);void (*relax)(struct hwspinlock *lock); };
include/linux/hwspinlock.h +6 -0
@@ -68,6 +68,7 @@ int __hwspin_lock_timeout(struct hwspinlock *, unsigned int, int,int __hwspin_trylock (struct hwspinlock *,int ,unsigned long *);void __hwspin_unlock (struct hwspinlock *,int ,unsigned long *);int of_hwspin_lock_get_id_byname (struct device_node *np,const char *name); +int hwspin_lock_bust (struct hwspinlock *hwlock,unsigned int id);int devm_hwspin_lock_free (struct device *dev,struct hwspinlock *hwlock);struct hwspinlock *devm_hwspin_lock_request (struct device *dev); struct hwspinlock *devm_hwspin_lock_request_specific(struct device *dev,
@@ -127,6 +128,11 @@ void __hwspin_unlock(struct hwspinlock *hwlock, int mode, unsigned long *flags) { } +static inline int hwspin_lock_bust (struct hwspinlock *hwlock,unsigned int id) +{ +return 0 ; +} +static inline int of_hwspin_lock_get_id (struct device_node *np,int index) {return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/184 soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lew <[email protected]>
[ Upstream commit 2e3f0d693875db698891ffe89a18121bda5b95b8 ]
Add qcom_smem_bust_hwspin_lock_by_host to enable remoteproc to bust the hwspin_lock owned by smem. In the event the remoteproc crashes unexpectedly, the remoteproc driver can invoke this API to try and bust the hwspin_lock and release the lock if still held by the remoteproc device.
--- drivers/soc/qcom/smem.c | 26 ++++++++++++++++++++++++++ include/linux/soc/qcom/smem.h | 2 ++ 2 files changed, 28 insertions(+)
drivers/soc/qcom/smem.c +26 -0
@@ -359,6 +359,32 @@ static struct qcom_smem *__smem;/* Timeout (ms) for the trylock of remote spinlocks */ #define HWSPINLOCK_TIMEOUT 1000 +/* The qcom hwspinlock id is always plus one from the smem host id */ +#define SMEM_HOST_ID_TO_HWSPINLOCK_ID (__x) ((__x) + 1) + +/** +* qcom_smem_bust_hwspin_lock_by_host() - bust the smem hwspinlock for a host +* @host: remote processor id +* +* Busts the hwspin_lock for the given smem host id. This helper is intended +* for remoteproc drivers that manage remoteprocs with an equivalent smem +* driver instance in the remote firmware. Drivers can force a release of the +* smem hwspin_lock if the rproc unexpectedly goes into a bad state. +* +* Context: Process context. +* +* Returns: 0 on success, otherwise negative errno. +*/ +int qcom_smem_bust_hwspin_lock_by_host (unsigned int host) +{ +/* This function is for remote procs, so ignore SMEM_HOST_APPS */ +if (host ==SMEM_HOST_APPS || host >=SMEM_HOST_COUNT ) +return -EINVAL ; + +return hwspin_lock_bust (__smem->hwlock,SMEM_HOST_ID_TO_HWSPINLOCK_ID (host)); +} +EXPORT_SYMBOL_GPL (qcom_smem_bust_hwspin_lock_by_host); +/** * qcom_smem_is_available() - Check if SMEM is available *
include/linux/soc/qcom/smem.h +2 -0
@@ -14,4 +14,6 @@ phys_addr_t qcom_smem_virt_to_phys(void *p);int qcom_smem_get_soc_id (u32 *id); +int qcom_smem_bust_hwspin_lock_by_host (unsigned int host); +#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/184 remoteproc: qcom_q6v5_pas: Add hwspinlock bust on stop
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Maina <[email protected]>
[ Upstream commit 568b13b65078e2b557ccf47674a354cecd1db641 ]
When remoteproc goes down unexpectedly this results in a state where any acquired hwspinlocks will remain locked possibly resulting in deadlock. In order to ensure all locks are freed we include a call to qcom_smem_bust_hwspin_lock_by_host() during remoteproc shutdown.
For qcom_q6v5_pas remoteprocs, each remoteproc has an assigned smem host_id. Remoteproc can pass this id to smem to try and bust the lock on remoteproc stop.
This edge case only occurs with q6v5_pas watchdog crashes. The error fatal case has handling to clear the hwspinlock before the error fatal interrupt is triggered.
--- drivers/remoteproc/qcom_q6v5_pas.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/remoteproc/qcom_q6v5_pas.c +11 -0
@@ -52,6 +52,7 @@ struct adsp_data {const char *ssr_name;const char *sysmon_name;int ssctl_id; +unsigned int smem_host_id;int region_assign_idx;int region_assign_count;
@@ -81,6 +82,7 @@ struct qcom_adsp {int lite_pas_id;unsigned int minidump_id;int crash_reason_smem; +unsigned int smem_host_id;bool decrypt_shutdown;const char *info_name;
@@ -399,6 +401,9 @@ static int adsp_stop(struct rproc *rproc)if (handover)qcom_pas_handover (&adsp->q6v5); +if (adsp->smem_host_id) + ret =qcom_smem_bust_hwspin_lock_by_host (adsp->smem_host_id); +return ret; }
@@ -727,6 +732,7 @@ static int adsp_probe(struct platform_device *pdev) adsp->pas_id = desc->pas_id; adsp->lite_pas_id = desc->lite_pas_id; adsp->info_name = desc->sysmon_name; + adsp->smem_host_id = desc->smem_host_id; adsp->decrypt_shutdown = desc->decrypt_shutdown; adsp->region_assign_idx = desc->region_assign_idx; adsp->region_assign_count =min_t (int,MAX_ASSIGN_COUNT , desc->region_assign_count);
@@ -1196,6 +1202,7 @@ static const struct adsp_data sm8550_adsp_resource = { .ssr_name = "lpass", .sysmon_name = "adsp", .ssctl_id = 0x14, + .smem_host_id = 2, };static const struct adsp_data sm8550_cdsp_resource = {
@@ -1216,6 +1223,7 @@ static const struct adsp_data sm8550_cdsp_resource = { .ssr_name = "cdsp", .sysmon_name = "cdsp", .ssctl_id = 0x17, + .smem_host_id = 5, };static const struct adsp_data sm8550_mpss_resource = {
@@ -1236,6 +1244,7 @@ static const struct adsp_data sm8550_mpss_resource = { .ssr_name = "mpss", .sysmon_name = "modem", .ssctl_id = 0x12, + .smem_host_id = 1, .region_assign_idx = 2, .region_assign_count = 1, .region_assign_vmid = QCOM_SCM_VMID_MSS_MSA,
@@ -1275,6 +1284,7 @@ static const struct adsp_data sm8650_cdsp_resource = { .ssr_name = "cdsp", .sysmon_name = "cdsp", .ssctl_id = 0x17, + .smem_host_id = 5, .region_assign_idx = 2, .region_assign_count = 1, .region_assign_shared = true,
@@ -1299,6 +1309,7 @@ static const struct adsp_data sm8650_mpss_resource = { .ssr_name = "mpss", .sysmon_name = "modem", .ssctl_id = 0x12, + .smem_host_id = 1, .region_assign_idx = 2, .region_assign_count = 3, .region_assign_vmid = QCOM_SCM_VMID_MSS_MSA,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/184 RDMA/efa: Properly handle unexpected AQ completions
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Margolin <[email protected]>
[ Upstream commit 2d0e7ba468eae365f3c4bc9266679e1f8dd405f0 ]
Do not try to handle admin command completion if it has an unexpected command id and print a relevant error message.
--- drivers/infiniband/hw/efa/efa_com.c | 30 ++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-)
drivers/infiniband/hw/efa/efa_com.c +17 -13
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause /* -* Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All rights reserved. +* Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All rights reserved. */ #include "efa_com.h"
@@ -406,8 +406,8 @@ static struct efa_comp_ctx *efa_com_submit_admin_cmd(struct efa_com_admin_queuereturn comp_ctx; } -static void efa_com_handle_single_admin_completion (struct efa_com_admin_queue *aq, -struct efa_admin_acq_entry *cqe) +static int efa_com_handle_single_admin_completion (struct efa_com_admin_queue *aq, +struct efa_admin_acq_entry *cqe) {struct efa_comp_ctx *comp_ctx;u16 cmd_id;
@@ -416,11 +416,11 @@ static void efa_com_handle_single_admin_completion(struct efa_com_admin_queue *a EFA_ADMIN_ACQ_COMMON_DESC_COMMAND_ID); comp_ctx =efa_com_get_comp_ctx (aq, cmd_id, false); -if (!comp_ctx) { +if (comp_ctx->status !=EFA_CMD_SUBMITTED ) {ibdev_err (aq->efa_dev, -"comp_ctx is NULL. Changing the admin queue running state\n" ); -clear_bit (EFA_AQ_STATE_RUNNING_BIT , &aq->state); -return ; +"Received completion with unexpected command id[%d], sq producer: %d, sq consumer: %d, cq consumer: %d\n" , + cmd_id, aq->sq.pc, aq->sq.cc, aq->cq.cc); +return -EINVAL ; } comp_ctx->status =EFA_CMD_COMPLETED ;
@@ -428,14 +428,17 @@ static void efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aif (!test_bit (EFA_AQ_STATE_POLLING_BIT , &aq->state))complete (&comp_ctx->wait_event); + +return 0 ; }static void efa_com_handle_admin_completion (struct efa_com_admin_queue *aq) {struct efa_admin_acq_entry *cqe;u16 queue_size_mask; -u16 comp_num =0 ; +u16 comp_cmds =0 ;u8 phase; +int err;u16 ci; queue_size_mask = aq->depth -1 ;
@@ -453,10 +456,12 @@ static void efa_com_handle_admin_completion(struct efa_com_admin_queue *aq)* phase bit was validated */ dma_rmb (); -efa_com_handle_single_admin_completion (aq, cqe); + err =efa_com_handle_single_admin_completion (aq, cqe); +if (!err) + comp_cmds++; + aq->cq.cc++; ci++; - comp_num++;if (ci == aq->depth) { ci =0 ; phase = !phase;
@@ -465,10 +470,9 @@ static void efa_com_handle_admin_completion(struct efa_com_admin_queue *aq) cqe = &aq->cq.entries[ci]; } - aq->cq.cc += comp_num; aq->cq.phase = phase; - aq->sq.cc += comp_num; -atomic64_add (comp_num, &aq->stats.completed_cmd); + aq->sq.cc += comp_cmds; +atomic64_add (comp_cmds, &aq->stats.completed_cmd); }static int efa_com_comp_status_to_errno (u8 comp_status)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/184 ionic: fix potential irq name truncation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shannon Nelson <[email protected]>
[ Upstream commit 3eb76e71b16e8ba5277bf97617aef51f5e64dbe4 ]
Address a warning about potential string truncation based on the string buffer sizes. We can add some hints to the string format specifier to set limits on the resulting possible string to squelch the complaints.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +1 -1
@@ -242,7 +242,7 @@ static int ionic_request_irq(struct ionic_lif *lif, struct ionic_qcq *qcq) name =dev_name (dev);snprintf (intr->name,sizeof (intr->name), -"%s-%s-%s" ,IONIC_DRV_NAME , name, q->name); +"%.5s-%.16s-%.8s" ,IONIC_DRV_NAME , name, q->name);return devm_request_irq (dev, intr->vector, ionic_isr,0 , intr->name, &qcq->napi);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/184 pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ken Sloat <[email protected]>
[ Upstream commit 56f45266df67aa0f5b2a6881c8c4d16dbfff6b7d ]
This timer HW supports 8, 16 and 32-bit timer widths. This driver currently uses a u32 to store the max possible value of the timer. However, statements perform addition of 2 in xilinx_pwm_apply() when calculating the period_cycles and duty_cycles values. Since priv->max is a u32, this will result in an overflow to 1 which will not only be incorrect but fail on range comparison. This results in making it impossible to set the PWM in this timer mode.
There are two obvious solutions to the current problem:
1. Cast each instance where overflow occurs to u64.
2. Change priv->max from a u32 to a u64.
Solution #1 requires more code modifications, and leaves opportunity to introduce similar overflows if other math statements are added in the future. These may also go undetected if running in non 32-bit timer modes.
Solution #2 is the much smaller and cleaner approach and thus the chosen method in this patch.
This was tested on a Zynq UltraScale+ with multiple instances of the PWM IP.
--- include/clocksource/timer-xilinx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/clocksource/timer-xilinx.h +1 -1
@@ -41,7 +41,7 @@ struct regmap;struct xilinx_timer_priv {struct regmap *map;struct clk *clk; -u32 max; +u64 max; };/**
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/184 rcu/nocb: Remove buggy bypass lock contention mitigation
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
[ Upstream commit e4f78057291608f6968a6789c5ebb3bde7d95504 ]
The bypass lock contention mitigation assumes there can be at most 2 contenders on the bypass lock, following this scheme:
1) One kthread takes the bypass lock
2) Another one spins on it and increment the contended counter
3) A third one (a bypass enqueuer) sees the contended counter on and busy loops waiting on it to decrement.
However this assumption is wrong. There can be only one CPU to find the lock contended because call_rcu() (the bypass enqueuer) is the only bypass lock acquire site that may not already hold the NOCB lock beforehand, all the other sites must first contend on the NOCB lock. Therefore step 2) is impossible.
The other problem is that the mitigation assumes that contenders all belong to the same rdp CPU, which is also impossible for a raw spinlock. In theory the warning could trigger if the enqueuer holds the bypass lock and another CPU flushes the bypass queue concurrently but this is prevented from all flush users:
1) NOCB kthreads only flush if they successfully _tried_ to lock the bypass lock. So no contention management here.
2) Flush on callbacks migration happen remotely when the CPU is offline. No concurrency against bypass enqueue.
3) Flush on deoffloading happen either locally with IRQs disabled or remotely when the CPU is not yet online. No concurrency against bypass enqueue.
4) Flush on barrier entrain happen either locally with IRQs disabled or remotely when the CPU is offline. No concurrency against bypass enqueue.
For those reasons, the bypass lock contention mitigation isn't needed and is even wrong. Remove it but keep the warning reporting a contended bypass lock on a remote CPU, to keep unexpected contention awareness.
--- kernel/rcu/tree.h | 1 - kernel/rcu/tree_nocb.h | 32 ++++++-------------------------- 2 files changed, 6 insertions(+), 27 deletions(-)
kernel/rcu/tree.h +0 -1
@@ -223,7 +223,6 @@ struct rcu_data {struct swait_queue_head nocb_state_wq;/* For offloading state changes */ struct task_struct *nocb_gp_kthread;raw_spinlock_t nocb_lock;/* Guard following pair of fields. */ -atomic_t nocb_lock_contended;/* Contention experienced. */ int nocb_defer_wakeup;/* Defer wakeup of nocb_kthread. */ struct timer_list nocb_timer;/* Enforce finite deferral. */ unsigned long nocb_gp_adv_time;/* Last call_rcu() CB adv (jiffies). */
kernel/rcu/tree_nocb.h +6 -26
@@ -91,8 +91,7 @@ module_param(nocb_nobypass_lim_per_jiffy, int, 0);/* * Acquire the specified rcu_data structure's ->nocb_bypass_lock. If the -* lock isn't immediately available, increment ->nocb_lock_contended to -* flag the contention. +* lock isn't immediately available, perform minimal sanity check. */ static void rcu_nocb_bypass_lock(struct rcu_data *rdp) __acquires(&rdp->nocb_bypass_lock)
@@ -100,29 +99,12 @@ static void rcu_nocb_bypass_lock(struct rcu_data *rdp)lockdep_assert_irqs_disabled ();if (raw_spin_trylock (&rdp->nocb_bypass_lock))return ; -atomic_inc (&rdp->nocb_lock_contended); +/* +* Contention expected only when local enqueue collide with +* remote flush from kthreads. +*/ WARN_ON_ONCE (smp_processor_id () != rdp->cpu); -smp_mb__after_atomic ();/* atomic_inc() before lock. */ raw_spin_lock (&rdp->nocb_bypass_lock); -smp_mb__before_atomic ();/* atomic_dec() after lock. */ -atomic_dec (&rdp->nocb_lock_contended); -} - -/* -* Spinwait until the specified rcu_data structure's ->nocb_lock is -* not contended. Please note that this is extremely special-purpose, -* relying on the fact that at most two kthreads and one CPU contend for -* this lock, and also that the two kthreads are guaranteed to have frequent -* grace-period-duration time intervals between successive acquisitions -* of the lock. This allows us to use an extremely simple throttling -* mechanism, and further to apply it only to the CPU doing floods of -* call_rcu() invocations. Don't try this at home! -*/ -static void rcu_nocb_wait_contended (struct rcu_data *rdp) -{ -WARN_ON_ONCE (smp_processor_id () != rdp->cpu); -while (WARN_ON_ONCE (atomic_read (&rdp->nocb_lock_contended))) -cpu_relax (); }/*
@@ -510,7 +492,6 @@ static bool rcu_nocb_try_bypass(struct rcu_data *rdp, struct rcu_head *rhp, }// We need to use the bypass. -rcu_nocb_wait_contended (rdp);rcu_nocb_bypass_lock (rdp); ncbs =rcu_cblist_n_cbs (&rdp->nocb_bypass);rcu_segcblist_inc_len (&rdp->cblist);/* Must precede enqueue. */
@@ -1678,12 +1659,11 @@ static void show_rcu_nocb_state(struct rcu_data *rdp)sprintf (bufw,"%ld" , rsclp->gp_seq[RCU_WAIT_TAIL ]);sprintf (bufr,"%ld" , rsclp->gp_seq[RCU_NEXT_READY_TAIL ]); - pr_info(" CB %d^%d->%d %c%c%c%c%c%c F%ld L%ld C%d %c%c%s%c%s%c%c q%ld %c CPU %d%s\n", + pr_info(" CB %d^%d->%d %c%c%c%c%c F%ld L%ld C%d %c%c%s%c%s%c%c q%ld %c CPU %d%s\n", rdp->cpu, rdp->nocb_gp_rdp->cpu, nocb_next_rdp ? nocb_next_rdp->cpu : -1, "kK"[!!rdp->nocb_cb_kthread], "bB"[raw_spin_is_locked(&rdp->nocb_bypass_lock)], - "cC"[!!atomic_read(&rdp->nocb_lock_contended)], "lL"[raw_spin_is_locked(&rdp->nocb_lock)], "sS"[!!rdp->nocb_cb_sleep], ".W"[swait_active(&rdp->nocb_cb_wq)],
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/184 media: v4l2-cci: Always assign *val
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 7417b1b1f36cc214dc458e717278a27a912d3b51 ]
Always assign *val to 0 in cci_read(). This has the benefit of not requiring initialisation of the variables data is read to using cci_read(). Once smatch is fixed, it could catch the use of uninitialised reads.
--- drivers/media/v4l2-core/v4l2-cci.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/media/v4l2-core/v4l2-cci.c +9 -0
@@ -23,6 +23,15 @@ int cci_read(struct regmap *map, u32 reg, u64 *val, int *err)u8 buf[8 ];int ret; +/* +* TODO: Fix smatch. Assign *val to 0 here in order to avoid +* failing a smatch check on caller when the caller proceeds to +* read *val without initialising it on caller's side. *val is set +* to a valid value whenever this function returns 0 but smatch +* can't figure that out currently. +*/ + *val =0 ; +if (err && *err)return *err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/184 usbip: Dont submit special requests twice
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Holesch <[email protected]>
[ Upstream commit 8b6b386f9aa936ed0c190446c71cf59d4a507690 ]
Skip submitting URBs, when identical requests were already sent in tweak_special_requests(). Instead call the completion handler directly to return the result of the URB.
Even though submitting those requests twice should be harmless, there are USB devices that react poorly to some duplicated requests.
One example is the ChipIdea controller implementation in U-Boot: The second SET_CONFIGURATION request makes U-Boot disable and re-enable all endpoints. Re-enabling an endpoint in the ChipIdea controller, however, was broken until U-Boot commit b272c8792502 ("usb: ci: Fix gadget reinit").
--- drivers/usb/usbip/stub_rx.c | 77 ++++++++++++++++++++++++------------- 1 file changed, 50 insertions(+), 27 deletions(-)
drivers/usb/usbip/stub_rx.c +50 -27
@@ -144,53 +144,62 @@ static int tweak_set_configuration_cmd(struct urb *urb)if (err && err != -ENODEV )dev_err (&sdev->udev->dev,"can't set config #%d, error %d\n" , config, err); -return 0 ; +return err; }static int tweak_reset_device_cmd (struct urb *urb) {struct stub_priv *priv = (struct stub_priv *) urb->context;struct stub_device *sdev = priv->sdev; +int err;dev_info (&urb->dev->dev,"usb_queue_reset_device\n" ); -if (usb_lock_device_for_reset (sdev->udev,NULL ) <0 ) { + err =usb_lock_device_for_reset (sdev->udev,NULL ); +if (err <0 ) {dev_err (&urb->dev->dev,"could not obtain lock to reset device\n" ); -return 0 ; +return err; } -usb_reset_device (sdev->udev); + err =usb_reset_device (sdev->udev);usb_unlock_device (sdev->udev); -return 0 ; +return err; }/* * clear_halt, set_interface, and set_configuration require special tricks. +* Returns 1 if request was tweaked, 0 otherwise. */ -static void tweak_special_requests (struct urb *urb) +static int tweak_special_requests (struct urb *urb) { +int err; +if (!urb || !urb->setup_packet) -return ; +return 0 ;if (usb_pipetype (urb->pipe) !=PIPE_CONTROL ) -return ; +return 0 ;if (is_clear_halt_cmd (urb))/* tweak clear_halt */ -tweak_clear_halt_cmd (urb); + err =tweak_clear_halt_cmd (urb);else if (is_set_interface_cmd (urb))/* tweak set_interface */ -tweak_set_interface_cmd (urb); + err =tweak_set_interface_cmd (urb);else if (is_set_configuration_cmd (urb))/* tweak set_configuration */ -tweak_set_configuration_cmd (urb); + err =tweak_set_configuration_cmd (urb);else if (is_reset_device_cmd (urb)) -tweak_reset_device_cmd (urb); -else + err =tweak_reset_device_cmd (urb); +else {usbip_dbg_stub_rx ("no need to tweak\n" ); +return 0 ; + } + +return !err; }/*
@@ -468,6 +477,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,int support_sg =1 ;int np =0 ;int ret, i; +int is_tweaked;if (pipe ==-1 )return ;
@@ -580,8 +590,11 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, priv->urbs[i]->pipe = pipe; priv->urbs[i]->complete = stub_complete; -/* no need to submit an intercepted request, but harmless? */ -tweak_special_requests (priv->urbs[i]); +/* +* all URBs belong to a single PDU, so a global is_tweaked flag is +* enough +*/ + is_tweaked =tweak_special_requests (priv->urbs[i]);masking_bogus_flags (priv->urbs[i]); }
@@ -594,22 +607,32 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,/* urb is now ready to submit */ for (i =0 ; i < priv->num_urbs; i++) { - ret =usb_submit_urb (priv->urbs[i],GFP_KERNEL ); +if (!is_tweaked) { + ret =usb_submit_urb (priv->urbs[i],GFP_KERNEL ); -if (ret ==0 ) -usbip_dbg_stub_rx ("submit urb ok, seqnum %u\n" , - pdu->base.seqnum); -else { -dev_err (&udev->dev,"submit_urb error, %d\n" , ret); -usbip_dump_header (pdu); -usbip_dump_urb (priv->urbs[i]); +if (ret ==0 ) +usbip_dbg_stub_rx ("submit urb ok, seqnum %u\n" , + pdu->base.seqnum); +else { +dev_err (&udev->dev,"submit_urb error, %d\n" , ret); +usbip_dump_header (pdu); +usbip_dump_urb (priv->urbs[i]); +/* +* Pessimistic. +* This connection will be discarded. +*/ +usbip_event_add (ud,SDEV_EVENT_ERROR_SUBMIT ); +break ; + } + }else {/* -* Pessimistic. -* This connection will be discarded. +* An identical URB was already submitted in +* tweak_special_requests(). Skip submitting this URB to not +* duplicate the request. */ -usbip_event_add (ud,SDEV_EVENT_ERROR_SUBMIT ); -break ; + priv->urbs[i]->status =0 ; +stub_complete (priv->urbs[i]); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/184 usb: typec: ucsi: Fix null pointer dereference in trace
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Pandit-Subedi <[email protected]>
[ Upstream commit 99516f76db48e1a9d54cdfed63c1babcee4e71a5 ]
ucsi_register_altmode checks IS_ERR for the alt pointer and treats NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled, ucsi_register_displayport returns NULL which causes a NULL pointer dereference in trace. Rather than return NULL, call typec_port_register_altmode to register DisplayPort alternate mode as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.
--- drivers/usb/typec/ucsi/ucsi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/ucsi/ucsi.h +1 -1
@@ -496,7 +496,7 @@ ucsi_register_displayport(struct ucsi_connector *con, bool override, int offset, struct typec_altmode_desc *desc) { - return NULL; + return typec_port_register_altmode(con->port, desc); } static inline void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/184 drm/xe: Use missing lock in relay_needs_worker
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <[email protected]>
[ Upstream commit 8b01f970ee890574b3607c85781354a765c849bd ]
Add missing lock that is protecting relay->incoming_actions.
--- drivers/gpu/drm/xe/xe_guc_relay.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_guc_relay.c +8 -1
@@ -757,7 +757,14 @@ static void relay_process_incoming_action(struct xe_guc_relay *relay)static bool relay_needs_worker (struct xe_guc_relay *relay) { -return !list_empty (&relay->incoming_actions); +bool is_empty; + +spin_lock (&relay->lock); + is_empty =list_empty (&relay->incoming_actions); +spin_unlock (&relay->lock); + +return !is_empty; + }static void relay_kick_worker (struct xe_guc_relay *relay)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/184 fsnotify: clear PARENT_WATCHED flags lazily
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 172e422ffea20a89bfdc672741c1aad6fbb5044e ]
In some setups directories can have many (usually negative) dentries. Hence __fsnotify_update_child_dentry_flags() function can take a significant amount of time. Since the bulk of this function happens under inode->i_lock this causes a significant contention on the lock when we remove the watch from the directory as the __fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask() races with __fsnotify_update_child_dentry_flags() calls from __fsnotify_parent() happening on children. This can lead upto softlockup reports reported by users.
Fix the problem by calling fsnotify_update_children_dentry_flags() to set PARENT_WATCHED flags only when parent starts watching children.
When parent stops watching children, clear false positive PARENT_WATCHED flags lazily in __fsnotify_parent() for each accessed child.
--- fs/notify/fsnotify.c | 31 +++++++++++++++++++++---------- fs/notify/fsnotify.h | 2 +- fs/notify/mark.c | 32 +++++++++++++++++++++++++++++--- include/linux/fsnotify_backend.h | 8 +++++--- 4 files changed, 56 insertions(+), 17 deletions(-)
fs/notify/fsnotify.c +21 -10
@@ -117,17 +117,13 @@ void fsnotify_sb_free(struct super_block *sb)* parent cares. Thus when an event happens on a child it can quickly tell * if there is a need to find a parent and send the event to the parent. */ -void __fsnotify_update_child_dentry_flags (struct inode *inode) +void fsnotify_set_children_dentry_flags (struct inode *inode) {struct dentry *alias; -int watched;if (!S_ISDIR (inode->i_mode))return ; -/* determine if the children should tell inode about their events */ - watched =fsnotify_inode_watches_children (inode); -spin_lock (&inode->i_lock);/* run all of the dentries associated with this inode. Since this is a * directory, there damn well better only be one item on this list */
@@ -143,10 +139,7 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode)continue ;spin_lock_nested (&child->d_lock,DENTRY_D_LOCK_NESTED ); -if (watched) - child->d_flags |=DCACHE_FSNOTIFY_PARENT_WATCHED ; -else - child->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED ; + child->d_flags |=DCACHE_FSNOTIFY_PARENT_WATCHED ;spin_unlock (&child->d_lock); }spin_unlock (&alias->d_lock);
@@ -154,6 +147,24 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode)spin_unlock (&inode->i_lock); } +/* +* Lazily clear false positive PARENT_WATCHED flag for child whose parent had +* stopped watching children. +*/ +static void fsnotify_clear_child_dentry_flag (struct inode *pinode, +struct dentry *dentry) +{ +spin_lock (&dentry->d_lock); +/* +* d_lock is a sufficient barrier to prevent observing a non-watched +* parent state from before the fsnotify_set_children_dentry_flags() +* or fsnotify_update_flags() call that had set PARENT_WATCHED. +*/ +if (!fsnotify_inode_watches_children (pinode)) + dentry->d_flags &= ~DCACHE_FSNOTIFY_PARENT_WATCHED ; +spin_unlock (&dentry->d_lock); +} +/* Are inode/sb/mount interested in parent and name info with this event? */ static bool fsnotify_event_needs_parent (struct inode *inode,__u32 mnt_mask,__u32 mask)
@@ -228,7 +239,7 @@ int __fsnotify_parent(struct dentry *dentry, __u32 mask, const void *data, p_inode = parent->d_inode; p_mask =fsnotify_inode_watches_children (p_inode);if (unlikely (parent_watched && !p_mask)) -__fsnotify_update_child_dentry_flags (p_inode); +fsnotify_clear_child_dentry_flag (p_inode, dentry);/* * Include parent/name in notification either if some notification
fs/notify/fsnotify.h +1 -1
@@ -93,7 +93,7 @@ static inline void fsnotify_clear_marks_by_sb(struct super_block *sb)* update the dentry->d_flags of all of inode's children to indicate if inode cares * about events that happen to its children. */ -extern void __fsnotify_update_child_dentry_flags (struct inode *inode); +extern void fsnotify_set_children_dentry_flags (struct inode *inode);extern struct kmem_cache *fsnotify_mark_connector_cachep;
fs/notify/mark.c +29 -3
@@ -250,6 +250,24 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)return fsnotify_update_iref (conn, want_iref); } +static bool fsnotify_conn_watches_children ( +struct fsnotify_mark_connector *conn) +{ +if (conn->type !=FSNOTIFY_OBJ_TYPE_INODE ) +return false; + +return fsnotify_inode_watches_children (fsnotify_conn_inode (conn)); +} + +static void fsnotify_conn_set_children_dentry_flags ( +struct fsnotify_mark_connector *conn) +{ +if (conn->type !=FSNOTIFY_OBJ_TYPE_INODE ) +return ; + +fsnotify_set_children_dentry_flags (fsnotify_conn_inode (conn)); +} +/* * Calculate mask of events for a list of marks. The caller must make sure * connector and connector->obj cannot disappear under us. Callers achieve
@@ -258,15 +276,23 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)*/ void fsnotify_recalc_mask (struct fsnotify_mark_connector *conn) { +bool update_children; +if (!conn)return ;spin_lock (&conn->lock); + update_children = !fsnotify_conn_watches_children (conn);__fsnotify_recalc_mask (conn); + update_children &=fsnotify_conn_watches_children (conn);spin_unlock (&conn->lock); -if (conn->type ==FSNOTIFY_OBJ_TYPE_INODE ) -__fsnotify_update_child_dentry_flags ( -fsnotify_conn_inode (conn)); +/* +* Set children's PARENT_WATCHED flags only if parent started watching. +* When parent stops watching, we clear false positive PARENT_WATCHED +* flags lazily in __fsnotify_parent(). +*/ +if (update_children) +fsnotify_conn_set_children_dentry_flags (conn); }/* Free all connectors queued for freeing once SRCU period ends */
include/linux/fsnotify_backend.h +5 -3
@@ -594,12 +594,14 @@ static inline __u32 fsnotify_parent_needed_mask(__u32 mask)static inline int fsnotify_inode_watches_children (struct inode *inode) { +__u32 parent_mask =READ_ONCE (inode->i_fsnotify_mask); +/* FS_EVENT_ON_CHILD is set if the inode may care */ -if (!(inode->i_fsnotify_mask &FS_EVENT_ON_CHILD )) +if (!(parent_mask &FS_EVENT_ON_CHILD ))return 0 ;/* this inode might care about child events, does it care about the * specific set of events that can happen on a child? */ -return inode->i_fsnotify_mask &FS_EVENTS_POSS_ON_CHILD ; +return parent_mask &FS_EVENTS_POSS_ON_CHILD ; }/*
@@ -613,7 +615,7 @@ static inline void fsnotify_update_flags(struct dentry *dentry)/* * Serialisation of setting PARENT_WATCHED on the dentries is provided * by d_lock. If inotify_inode_watched changes after we have taken -* d_lock, the following __fsnotify_update_child_dentry_flags call will +* d_lock, the following fsnotify_set_children_dentry_flags call will * find our entry, so it will spin until we complete here, and update * us with the new state. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/184 net: remove NULL-pointer net parameter in ip_metrics_convert
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 61e2bbafb00e4b9a5de45e6448a7b6b818658576 ]
When I was doing some experiments, I found that when using the first parameter, namely, struct net, in ip_metrics_convert() always triggers NULL pointer crash. Then I digged into this part, realizing that we can remove this one due to its uselessness.
--- include/net/ip.h | 3 +-- include/net/tcp.h | 2 +- net/ipv4/fib_semantics.c | 5 ++--- net/ipv4/metrics.c | 8 ++++---- net/ipv4/tcp_cong.c | 11 +++++------ net/ipv6/route.c | 2 +- 6 files changed, 14 insertions(+), 17 deletions(-)
include/net/ip.h +1 -2
@@ -506,8 +506,7 @@ static inline unsigned int ip_skb_dst_mtu(struct sock *sk,return mtu -lwtunnel_headroom (skb_dst (skb)->lwtstate, mtu); } -struct dst_metrics *ip_fib_metrics_init (struct net *net,struct nlattr *fc_mx, -int fc_mx_len, +struct dst_metrics *ip_fib_metrics_init (struct nlattr *fc_mx,int fc_mx_len,struct netlink_ext_ack *extack);static inline void ip_fib_metrics_put (struct dst_metrics *fib_metrics) {
include/net/tcp.h +1 -1
@@ -1216,7 +1216,7 @@ extern struct tcp_congestion_ops tcp_reno;struct tcp_congestion_ops *tcp_ca_find (const char *name);struct tcp_congestion_ops *tcp_ca_find_key (u32 key); -u32 tcp_ca_get_key_by_name (struct net *net,const char *name,bool *ecn_ca); +u32 tcp_ca_get_key_by_name (const char *name,bool *ecn_ca);#ifdef CONFIG_INET char *tcp_ca_get_name_by_key (u32 key,char *buffer);#else
net/ipv4/fib_semantics.c +2 -3
@@ -1030,7 +1030,7 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)bool ecn_ca = false;nla_strscpy (tmp, nla,sizeof (tmp)); - val =tcp_ca_get_key_by_name (fi->fib_net, tmp, &ecn_ca); + val =tcp_ca_get_key_by_name (tmp, &ecn_ca); }else {if (nla_len (nla) !=sizeof (u32))return false;
@@ -1459,8 +1459,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg, fi =kzalloc (struct_size (fi, fib_nh, nhs),GFP_KERNEL );if (!fi) goto failure; - fi->fib_metrics =ip_fib_metrics_init (fi->fib_net, cfg->fc_mx, - cfg->fc_mx_len, extack); + fi->fib_metrics =ip_fib_metrics_init (cfg->fc_mx, cfg->fc_mx_len, extack);if (IS_ERR (fi->fib_metrics)) { err =PTR_ERR (fi->fib_metrics);kfree (fi);
net/ipv4/metrics.c +4 -4
@@ -7,7 +7,7 @@#include <net/net_namespace.h> #include <net/tcp.h> -static int ip_metrics_convert (struct net *net,struct nlattr *fc_mx, +static int ip_metrics_convert (struct nlattr *fc_mx,int fc_mx_len,u32 *metrics,struct netlink_ext_ack *extack) {
@@ -31,7 +31,7 @@ static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx,char tmp[TCP_CA_NAME_MAX ];nla_strscpy (tmp, nla,sizeof (tmp)); - val =tcp_ca_get_key_by_name (net, tmp, &ecn_ca); + val =tcp_ca_get_key_by_name (tmp, &ecn_ca);if (val ==TCP_CA_UNSPEC ) {NL_SET_ERR_MSG (extack,"Unknown tcp congestion algorithm" );return -EINVAL ;
@@ -63,7 +63,7 @@ static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx,return 0 ; } -struct dst_metrics *ip_fib_metrics_init (struct net *net,struct nlattr *fc_mx, +struct dst_metrics *ip_fib_metrics_init (struct nlattr *fc_mx,int fc_mx_len,struct netlink_ext_ack *extack) {
@@ -77,7 +77,7 @@ struct dst_metrics *ip_fib_metrics_init(struct net *net, struct nlattr *fc_mx,if (unlikely (!fib_metrics))return ERR_PTR (-ENOMEM ); - err =ip_metrics_convert (net, fc_mx, fc_mx_len, fib_metrics->metrics, + err =ip_metrics_convert (fc_mx, fc_mx_len, fib_metrics->metrics, extack);if (!err) {refcount_set (&fib_metrics->refcnt,1 );
net/ipv4/tcp_cong.c +5 -6
@@ -46,8 +46,7 @@ void tcp_set_ca_state(struct sock *sk, const u8 ca_state) }/* Must be called with rcu lock held */ -static struct tcp_congestion_ops *tcp_ca_find_autoload (struct net *net, -const char *name) +static struct tcp_congestion_ops *tcp_ca_find_autoload (const char *name) {struct tcp_congestion_ops *ca =tcp_ca_find (name);
@@ -178,7 +177,7 @@ int tcp_update_congestion_control(struct tcp_congestion_ops *ca, struct tcp_congreturn ret; } -u32 tcp_ca_get_key_by_name (struct net *net,const char *name,bool *ecn_ca) +u32 tcp_ca_get_key_by_name (const char *name,bool *ecn_ca) {const struct tcp_congestion_ops *ca;u32 key =TCP_CA_UNSPEC ;
@@ -186,7 +185,7 @@ u32 tcp_ca_get_key_by_name(struct net *net, const char *name, bool *ecn_ca)might_sleep ();rcu_read_lock (); - ca =tcp_ca_find_autoload (net, name); + ca =tcp_ca_find_autoload (name);if (ca) { key = ca->key; *ecn_ca = ca->flags &TCP_CONG_NEEDS_ECN ;
@@ -283,7 +282,7 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)int ret;rcu_read_lock (); - ca =tcp_ca_find_autoload (net, name); + ca =tcp_ca_find_autoload (name);if (!ca) { ret = -ENOENT ; }else if (!bpf_try_module_get (ca, ca->owner)) {
@@ -421,7 +420,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,if (!load) ca =tcp_ca_find (name);else - ca =tcp_ca_find_autoload (sock_net (sk), name); + ca =tcp_ca_find_autoload (name);/* No change asking for existing value */ if (ca == icsk->icsk_ca_ops) {
net/ipv6/route.c +1 -1
@@ -3764,7 +3764,7 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,if (!rt) goto out; - rt->fib6_metrics =ip_fib_metrics_init (net, cfg->fc_mx, cfg->fc_mx_len, + rt->fib6_metrics =ip_fib_metrics_init (cfg->fc_mx, cfg->fc_mx_len, extack);if (IS_ERR (rt->fib6_metrics)) { err =PTR_ERR (rt->fib6_metrics);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/184 tcp: annotate data-races around tw->tw_ts_recent and tw->tw_ts_recent_stamp
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 69e0b33a7fce4d96649b9fa32e56b696921aa48e ]
These fields can be read and written locklessly, add annotations around these minor races.
--- net/ipv4/tcp_ipv4.c | 12 +++++++----- net/ipv4/tcp_minisocks.c | 22 ++++++++++++++-------- net/ipv6/tcp_ipv6.c | 6 +++--- 3 files changed, 24 insertions(+), 16 deletions(-)
net/ipv4/tcp_ipv4.c +7 -5
@@ -116,6 +116,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)const struct inet_timewait_sock *tw =inet_twsk (sktw);const struct tcp_timewait_sock *tcptw =tcp_twsk (sktw);struct tcp_sock *tp =tcp_sk (sk); +int ts_recent_stamp;if (reuse ==2 ) {/* Still does not detect *everything* that goes through
@@ -154,9 +155,10 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)If TW bucket has been already destroyed we fall back to VJ's scheme and use initial timestamp retrieved from peer table. */ -if (tcptw->tw_ts_recent_stamp && + ts_recent_stamp =READ_ONCE (tcptw->tw_ts_recent_stamp); +if (ts_recent_stamp && (!twp || (reuse &&time_after32 (ktime_get_seconds (), - tcptw->tw_ts_recent_stamp)))) { + ts_recent_stamp)))) {/* inet_twsk_hashdance() sets sk_refcnt after putting twsk * and releasing the bucket lock. */
@@ -180,8 +182,8 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)if (!seq) seq =1 ;WRITE_ONCE (tp->write_seq, seq); - tp->rx_opt.ts_recent = tcptw->tw_ts_recent; - tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp; + tp->rx_opt.ts_recent =READ_ONCE (tcptw->tw_ts_recent); + tp->rx_opt.ts_recent_stamp = ts_recent_stamp; }return 1 ;
@@ -1066,7 +1068,7 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb) tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt, tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,tcp_tw_tsval (tcptw), - tcptw->tw_ts_recent, +READ_ONCE (tcptw->tw_ts_recent), tw->tw_bound_dev_if, &key, tw->tw_transparent ?IP_REPLY_ARG_NOSRCCHECK :0 , tw->tw_tos,
net/ipv4/tcp_minisocks.c +14 -8
@@ -101,16 +101,18 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,struct tcp_options_received tmp_opt;struct tcp_timewait_sock *tcptw =tcp_twsk ((struct sock *)tw);bool paws_reject = false; +int ts_recent_stamp; tmp_opt.saw_tstamp =0 ; -if (th->doff > (sizeof (*th) >>2 ) && tcptw->tw_ts_recent_stamp) { + ts_recent_stamp =READ_ONCE (tcptw->tw_ts_recent_stamp); +if (th->doff > (sizeof (*th) >>2 ) && ts_recent_stamp) {tcp_parse_options (twsk_net (tw), skb, &tmp_opt,0 ,NULL );if (tmp_opt.saw_tstamp) {if (tmp_opt.rcv_tsecr) tmp_opt.rcv_tsecr -= tcptw->tw_ts_offset; - tmp_opt.ts_recent = tcptw->tw_ts_recent; - tmp_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp; + tmp_opt.ts_recent =READ_ONCE (tcptw->tw_ts_recent); + tmp_opt.ts_recent_stamp = ts_recent_stamp; paws_reject =tcp_paws_reject (&tmp_opt, th->rst); } }
@@ -152,8 +154,10 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,twsk_rcv_nxt_update (tcptw,TCP_SKB_CB (skb)->end_seq);if (tmp_opt.saw_tstamp) { - tcptw->tw_ts_recent_stamp =ktime_get_seconds (); - tcptw->tw_ts_recent = tmp_opt.rcv_tsval; +WRITE_ONCE (tcptw->tw_ts_recent_stamp, +ktime_get_seconds ()); +WRITE_ONCE (tcptw->tw_ts_recent, + tmp_opt.rcv_tsval); }inet_twsk_reschedule (tw,TCP_TIMEWAIT_LEN );
@@ -197,8 +201,10 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb, }if (tmp_opt.saw_tstamp) { - tcptw->tw_ts_recent = tmp_opt.rcv_tsval; - tcptw->tw_ts_recent_stamp =ktime_get_seconds (); +WRITE_ONCE (tcptw->tw_ts_recent, + tmp_opt.rcv_tsval); +WRITE_ONCE (tcptw->tw_ts_recent_stamp, +ktime_get_seconds ()); }inet_twsk_put (tw);
@@ -225,7 +231,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,if (th->syn && !th->rst && !th->ack && !paws_reject && (after (TCP_SKB_CB (skb)->seq, tcptw->tw_rcv_nxt) || (tmp_opt.saw_tstamp && - (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) <0 ))) { + (s32)(READ_ONCE (tcptw->tw_ts_recent) - tmp_opt.rcv_tsval) <0 ))) {u32 isn = tcptw->tw_snd_nxt +65535 +2 ;if (isn ==0 ) isn++;
net/ipv6/tcp_ipv6.c +3 -3
@@ -1196,9 +1196,9 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)tcp_v6_send_ack (sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt, tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,tcp_tw_tsval (tcptw), - tcptw->tw_ts_recent, tw->tw_bound_dev_if, &key, - tw->tw_tclass,cpu_to_be32 (tw->tw_flowlabel), tw->tw_priority, - tw->tw_txhash); +READ_ONCE (tcptw->tw_ts_recent), tw->tw_bound_dev_if, + &key, tw->tw_tclass,cpu_to_be32 (tw->tw_flowlabel), + tw->tw_priority, tw->tw_txhash);#ifdef CONFIG_TCP_AO out:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/184 drm/amdgu: fix Unintentional integer overflow for mall size
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit c09d2eff81a997c169e0cacacd6b60c5e3aa33f2 ]
Potentially overflowing expression mall_size_per_umc * adev->gmc.num_umc with type unsigned int (32 bits, unsigned) is evaluated using 32-bit arithmetic,and then used in a context that expects an expression of type u64 (64 bits, unsigned).
--- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +1 -1
@@ -1597,7 +1597,7 @@ static int amdgpu_discovery_get_mall_info(struct amdgpu_device *adev)break ;case 2 : mall_size_per_umc =le32_to_cpu (mall_info->v2.mall_size_per_umc); - adev->gmc.mall_size = mall_size_per_umc * adev->gmc.num_umc; + adev->gmc.mall_size = (uint64_t )mall_size_per_umc * adev->gmc.num_umc;break ;default : dev_err(adev->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/184 drm/xe: Dont overmap identity VRAM mapping
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 6d3581edffea0b3a64b0d3094d3f09222e0024f7 ]
Overmapping the identity VRAM mapping is triggering hardware bugs on certain platforms. Use 2M pages for the last unaligned (to 1G) VRAM chunk.
v2:
- Always use 2M pages for last chunk (Fei Yang)
- break loop when 2M pages are used
- Add assert for usable_size being 2M aligned
v3:
- Fix checkpatch
--- drivers/gpu/drm/xe/xe_migrate.c | 55 +++++++++++++++++++++++++-------- 1 file changed, 42 insertions(+), 13 deletions(-)
drivers/gpu/drm/xe/xe_migrate.c +42 -13
@@ -69,7 +69,7 @@ struct xe_migrate {#define MAX_PREEMPTDISABLE_TRANSFER SZ_8M/* Around 1ms. */ #define MAX_CCS_LIMITED_TRANSFER SZ_4M/* XE_PAGE_SIZE * (FIELD_MAX(XE2_CCS_SIZE_MASK) + 1) */ -#define NUM_KERNEL_PDE 17 +#define NUM_KERNEL_PDE 15#define NUM_PT_SLOTS 32#define LEVEL0_PAGE_TABLE_ENCODE_SIZE SZ_2M#define MAX_NUM_PTE 512
@@ -137,10 +137,11 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m,struct xe_device *xe =tile_to_xe (tile);u16 pat_index = xe->pat.idx[XE_CACHE_WB ];u8 id = tile->id; -u32 num_entries =NUM_PT_SLOTS , num_level = vm->pt_root[id]->level; +u32 num_entries =NUM_PT_SLOTS , num_level = vm->pt_root[id]->level, + num_setup = num_level +1 ;u32 map_ofs, level, i;struct xe_bo *bo, *batch = tile->mem.kernel_bb_pool->bo; -u64 entry; +u64 entry, pt30_ofs;/* Can't bump NUM_PT_SLOTS too high */ BUILD_BUG_ON (NUM_PT_SLOTS >SZ_2M /XE_PAGE_SIZE );
@@ -160,10 +161,12 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m,if (IS_ERR (bo))return PTR_ERR (bo); - entry = vm->pt_ops->pde_encode_bo (bo, bo->size -XE_PAGE_SIZE , pat_index); +/* PT31 reserved for 2M identity map */ + pt30_ofs = bo->size -2 *XE_PAGE_SIZE ; + entry = vm->pt_ops->pde_encode_bo (bo, pt30_ofs, pat_index);xe_pt_write (xe, &vm->pt_root[id]->bo->vmap,0 , entry); - map_ofs = (num_entries - num_level) *XE_PAGE_SIZE ; + map_ofs = (num_entries - num_setup) *XE_PAGE_SIZE ;/* Map the entire BO in our level 0 pt */ for (i =0 , level =0 ; i < num_entries; level++) {
@@ -234,7 +237,7 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m, }/* Write PDE's that point to our BO. */ -for (i =0 ; i < num_entries - num_level; i++) { +for (i =0 ; i < map_ofs /PAGE_SIZE ; i++) { entry = vm->pt_ops->pde_encode_bo (bo, (u64 )i *XE_PAGE_SIZE , pat_index);
@@ -252,28 +255,54 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m,/* Identity map the entire vram at 256GiB offset */ if (IS_DGFX (xe)) {u64 pos, ofs, flags; +/* XXX: Unclear if this should be usable_size? */ +u64 vram_limit = xe->mem.vram.actual_physical_size + + xe->mem.vram.dpa_base; level =2 ; ofs = map_ofs +XE_PAGE_SIZE * level +256 *8 ; flags = vm->pt_ops->pte_encode_addr (xe,0 , pat_index, level, true,0 ); +xe_assert (xe,IS_ALIGNED (xe->mem.vram.usable_size,SZ_2M )); +/* -* Use 1GB pages, it shouldn't matter the physical amount of -* vram is less, when we don't access it. +* Use 1GB pages when possible, last chunk always use 2M +* pages as mixing reserved memory (stolen, WOCPM) with a single +* mapping is not allowed on certain platforms. */ -for (pos = xe->mem.vram.dpa_base; - pos < xe->mem.vram.actual_physical_size + xe->mem.vram.dpa_base; - pos +=SZ_1G , ofs +=8 ) +for (pos = xe->mem.vram.dpa_base; pos < vram_limit; + pos +=SZ_1G , ofs +=8 ) { +if (pos +SZ_1G >= vram_limit) { +u64 pt31_ofs = bo->size -XE_PAGE_SIZE ; + + entry = vm->pt_ops->pde_encode_bo (bo, pt31_ofs, + pat_index); +xe_map_wr (xe, &bo->vmap, ofs, u64, entry); + + flags = vm->pt_ops->pte_encode_addr (xe,0 , + pat_index, + level -1 , + true,0 ); + +for (ofs = pt31_ofs; pos < vram_limit; + pos +=SZ_2M , ofs +=8 ) +xe_map_wr (xe, &bo->vmap, ofs, u64, pos | flags); +break ;/* Ensure pos == vram_limit assert correct */ + } +xe_map_wr (xe, &bo->vmap, ofs, u64, pos | flags); + } + +xe_assert (xe, pos == vram_limit); }/* * Example layout created above, with root level = 3: * [PT0...PT7]: kernel PT's for copy/clear; 64 or 4KiB PTE's * [PT8]: Kernel PT for VM_BIND, 4 KiB PTE's -* [PT9...PT28]: Userspace PT's for VM_BIND, 4 KiB PTE's -* [PT29 = PDE 0] [PT30 = PDE 1] [PT31 = PDE 2] +* [PT9...PT27]: Userspace PT's for VM_BIND, 4 KiB PTE's +* [PT28 = PDE 0] [PT29 = PDE 1] [PT30 = PDE 2] [PT31 = 2M vram identity map] * * This makes the lowest part of the VM point to the pagetables. * Hence the lowest 2M in the vm should point to itself, with a few writes
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/184 regmap: spi: Fix potential off-by-one when calculating reserved size
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit d4ea1d504d2701ba04412f98dc00d45a104c52ab ]
If we ever meet a hardware that uses weird register bits and padding, we may end up in off-by-one error since x/8 + y/8 might not be equal to (x + y)/8 in some cases.
bits pad x/8+y/8 (x+y)/8 4..7 0..3 0 0 // x + y from 4 up to 7 4..7 4..7 0 1 // x + y from 8 up to 11 4..7 8..11 1 1 // x + y from 12 up to 15 8..15 0..7 1 1 // x + y from 8 up to 15 8..15 8..15 2 2 // x + y from 16 up to 23
Fix this by using (x+y)/8.
--- drivers/base/regmap/regmap-spi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/base/regmap/regmap-spi.c +1 -2
@@ -122,8 +122,7 @@ static const struct regmap_bus *regmap_get_spi_bus(struct spi_device *spi,return ERR_PTR (-ENOMEM ); max_msg_size =spi_max_message_size (spi); - reg_reserve_size = config->reg_bits /BITS_PER_BYTE - + config->pad_bits /BITS_PER_BYTE ; + reg_reserve_size = (config->reg_bits + config->pad_bits) /BITS_PER_BYTE ;if (max_size + reg_reserve_size > max_msg_size) max_size -= reg_reserve_size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/184 smack: tcp: ipv4, fix incorrect labeling
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Schaufler <[email protected]>
[ Upstream commit 2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550 ]
Currently, Smack mirrors the label of incoming tcp/ipv4 connections:
when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So,
1) returned packets are incorrectly labeled ('foo' instead of 'bar')
2) 'bar' can write to 'foo' without being authorized to write.
Here is a scenario how to see this:
* Take two machines, let's call them C and S,
with active Smack in the default state
(no settings, no rules, no labeled hosts, only builtin labels)
* At S, add Smack rule 'foo bar w'
(labels 'foo' and 'bar' are instantiated at S at this moment)
* At S, at label 'bar', launch a program
that listens for incoming tcp/ipv4 connections
* From C, at label 'foo', connect to the listener at S. (label 'foo' is instantiated at C at this moment) Connection succeedes and works.
* Send some data in both directions.
* Collect network traffic of this connection.
All packets in both directions are labeled with the CIPSO of the label 'foo'. Hence, label 'bar' writes to 'foo' without being authorized, and even without ever being known at C.
If anybody cares: exactly the same happens with DCCP.
This behavior 1st manifested in release 2.6.29.4 (see Fixes below) and it looks unintentional. At least, no explanation was provided.
I changed returned packes label into the 'bar', to bring it into line with the Smack documentation claims.
--- security/smack/smack_lsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/smack/smack_lsm.c +1 -1
@@ -4456,7 +4456,7 @@ static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb,rcu_read_unlock ();if (hskp ==NULL ) - rc =netlbl_req_setattr (req, &skp->smk_netlabel); + rc =netlbl_req_setattr (req, &ssp->smk_out->smk_netlabel);else netlbl_req_delattr (req);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/184 platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Walsh <[email protected]>
[ Upstream commit 60c7df66450e3a7821a8d68496c20c95de6a15c5 ]
Framework Laptops have ACPI code which accesses the MEC memory. It uses an AML mutex to prevent concurrent access. But the cros_ec_lpc driver was not aware of this mutex. The ACPI code and LPC driver both attempted to talk to the EC at the same time, messing up communication with the EC.
Allow the LPC driver MEC code to find and use the AML mutex.
--- drivers/platform/chrome/cros_ec_lpc_mec.c | 76 ++++++++++++++++++++++- drivers/platform/chrome/cros_ec_lpc_mec.h | 11 ++++ 2 files changed, 85 insertions(+), 2 deletions(-)
drivers/platform/chrome/cros_ec_lpc_mec.c +74 -2
@@ -10,13 +10,65 @@#include "cros_ec_lpc_mec.h" +#define ACPI_LOCK_DELAY_MS 500 +/* * This mutex must be held while accessing the EMI unit. We can't rely on the * EC mutex because memmap data may be accessed without it being held. */ static DEFINE_MUTEX (io_mutex); +/* +* An alternative mutex to be used when the ACPI AML code may also +* access memmap data. When set, this mutex is used in preference to +* io_mutex. +*/ +static acpi_handle aml_mutex; +static u16 mec_emi_base, mec_emi_end; +/** +* cros_ec_lpc_mec_lock() - Acquire mutex for EMI +* +* @return: Negative error code, or zero for success +*/ +static int cros_ec_lpc_mec_lock (void ) +{ +bool success; + +if (!aml_mutex) { +mutex_lock (&io_mutex); +return 0 ; + } + + success =ACPI_SUCCESS (acpi_acquire_mutex (aml_mutex, +NULL ,ACPI_LOCK_DELAY_MS )); +if (!success) +return -EBUSY ; + +return 0 ; +} + +/** +* cros_ec_lpc_mec_unlock() - Release mutex for EMI +* +* @return: Negative error code, or zero for success +*/ +static int cros_ec_lpc_mec_unlock (void ) +{ +bool success; + +if (!aml_mutex) { +mutex_unlock (&io_mutex); +return 0 ; + } + + success =ACPI_SUCCESS (acpi_release_mutex (aml_mutex,NULL )); +if (!success) +return -EBUSY ; + +return 0 ; +} +/** * cros_ec_lpc_mec_emi_write_address() - Initialize EMI at a given address. *
@@ -77,6 +129,7 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type,int io_addr;u8 sum =0 ;enum cros_ec_lpc_mec_emi_access_mode access, new_access; +int ret;/* Return checksum of 0 if window is not initialized */ WARN_ON (mec_emi_base ==0 || mec_emi_end ==0 );
@@ -92,7 +145,9 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type,else access =ACCESS_TYPE_LONG_AUTO_INCREMENT ; -mutex_lock (&io_mutex); + ret =cros_ec_lpc_mec_lock (); +if (ret) +return ret;/* Initialize I/O at desired address */ cros_ec_lpc_mec_emi_write_address (offset, access);
@@ -134,7 +189,9 @@ u8 cros_ec_lpc_io_bytes_mec(enum cros_ec_lpc_mec_io_type io_type, } done: -mutex_unlock (&io_mutex); + ret =cros_ec_lpc_mec_unlock (); +if (ret) +return ret;return sum; }
@@ -146,3 +203,18 @@ void cros_ec_lpc_mec_init(unsigned int base, unsigned int end) mec_emi_end = end; }EXPORT_SYMBOL (cros_ec_lpc_mec_init); + +int cros_ec_lpc_mec_acpi_mutex (struct acpi_device *adev,const char *pathname) +{ +int status; + +if (!adev) +return -ENOENT ; + + status =acpi_get_handle (adev->handle, pathname, &aml_mutex); +if (ACPI_FAILURE (status)) +return -ENOENT ; + +return 0 ; +} +EXPORT_SYMBOL (cros_ec_lpc_mec_acpi_mutex);
drivers/platform/chrome/cros_ec_lpc_mec.h +11 -0
@@ -8,6 +8,8 @@#ifndef __CROS_EC_LPC_MEC_H#define __CROS_EC_LPC_MEC_H +#include <linux/acpi.h> +enum cros_ec_lpc_mec_emi_access_mode {/* 8-bit access */ ACCESS_TYPE_BYTE = 0x0,
@@ -45,6 +47,15 @@ enum cros_ec_lpc_mec_io_type {*/ void cros_ec_lpc_mec_init (unsigned int base,unsigned int end); +/** +* cros_ec_lpc_mec_acpi_mutex() - Find and set ACPI mutex for MEC +* +* @adev: Parent ACPI device +* @pathname: Name of AML mutex +* @return: Negative error code, or zero for success +*/ +int cros_ec_lpc_mec_acpi_mutex (struct acpi_device *adev,const char *pathname); +/** * cros_ec_lpc_mec_in_range() - Determine if addresses are in MEC EMI range. *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/184 net/mlx5e: SHAMPO, Fix incorrect page release
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <[email protected]>
[ Upstream commit 70bd03b89f20b9bbe51a7f73c4950565a17a45f7 ]
Under the following conditions:
1) No skb created yet
2) header_size == 0 (no SHAMPO header)
3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page)
a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once.
--- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +2 -1
@@ -2369,7 +2369,8 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cqif (flush)mlx5e_shampo_flush_skb (rq, cqe, match); free_hd_entry: -mlx5e_free_rx_shampo_hd_entry (rq, header_index); +if (likely (head_size)) +mlx5e_free_rx_shampo_hd_entry (rq, header_index); mpwrq_cqe_out:if (likely (wi->consumed_strides < rq->mpwqe.num_strides))return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/184 drm/meson: plane: Add error handling
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoran Liu <[email protected]>
[ Upstream commit 3c28b239620e249b68beeca17f429e317fa6b8d4 ]
This patch adds robust error handling to the meson_plane_create function in drivers/gpu/drm/meson/meson_plane.c. The function previously lacked proper handling for potential failure scenarios of the drm_universal_plane_init call.
--- drivers/gpu/drm/meson/meson_plane.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/gpu/drm/meson/meson_plane.c +11 -6
@@ -534,6 +534,7 @@ int meson_plane_create(struct meson_drm *priv)struct meson_plane *meson_plane;struct drm_plane *plane;const uint64_t *format_modifiers = format_modifiers_default; +int ret; meson_plane =devm_kzalloc (priv->drm->dev,sizeof (*meson_plane),GFP_KERNEL );
@@ -548,12 +549,16 @@ int meson_plane_create(struct meson_drm *priv)else if (meson_vpu_is_compatible (priv,VPU_COMPATIBLE_G12A )) format_modifiers = format_modifiers_afbc_g12a; -drm_universal_plane_init (priv->drm, plane,0xFF , - &meson_plane_funcs, - supported_drm_formats, -ARRAY_SIZE (supported_drm_formats), - format_modifiers, -DRM_PLANE_TYPE_PRIMARY ,"meson_primary_plane" ); + ret =drm_universal_plane_init (priv->drm, plane,0xFF , + &meson_plane_funcs, + supported_drm_formats, +ARRAY_SIZE (supported_drm_formats), + format_modifiers, +DRM_PLANE_TYPE_PRIMARY ,"meson_primary_plane" ); +if (ret) { +devm_kfree (priv->drm->dev, meson_plane); +return ret; + }drm_plane_helper_add (plane, &meson_plane_helper_funcs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/184 crypto: stm32/cryp - call finalize with bh disabled
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Méré <[email protected]>
[ Upstream commit 56ddb9aa3b324c2d9645b5a7343e46010cf3f6ce ]
The finalize operation in interrupt mode produce a produces a spinlock recursion warning. The reason is the fact that BH must be disabled during this process.
--- drivers/crypto/stm32/stm32-cryp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/crypto/stm32/stm32-cryp.c +5 -1
@@ -11,6 +11,7 @@#include <crypto/internal/des.h> #include <crypto/internal/skcipher.h> #include <crypto/scatterwalk.h> +#include <linux/bottom_half.h> #include <linux/clk.h> #include <linux/delay.h> #include <linux/err.h>
@@ -1665,8 +1666,11 @@ static irqreturn_t stm32_cryp_irq_thread(int irq, void *arg) it_mask &= ~IMSCR_OUT ;stm32_cryp_write (cryp, cryp->caps->imsc, it_mask); -if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) +if (!cryp->payload_in && !cryp->header_in && !cryp->payload_out) { +local_bh_disable ();stm32_cryp_finish_req (cryp,0 ); +local_bh_enable (); + }return IRQ_HANDLED ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/184 gfs2: Revert "Add quota_change type"
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit ec4b5200c8af9ce021399d3192b3379c089396c3 ]
Commit 432928c93779 ("gfs2: Add quota_change type") makes the incorrect assertion that function do_qc() should behave differently in the two contexts it is used in, but that isn't actually true. In all cases, do_qc() grabs a "reference" when it starts using a slot in the per-node quota changes file, and it releases that "reference" when no more residual changes remain. Revert that broken commit.
There are some remaining issues with function do_qc() which are addressed in the next commit.
This reverts commit 432928c9377959684c748a9bc6553ed2d3c2ea4f.
--- fs/gfs2/quota.c | 19 +++++++------------ fs/gfs2/util.c | 6 +++--- 2 files changed, 10 insertions(+), 15 deletions(-)
fs/gfs2/quota.c +7 -12
@@ -75,9 +75,6 @@#define GFS2_QD_HASH_SIZE BIT(GFS2_QD_HASH_SHIFT)#define GFS2_QD_HASH_MASK (GFS2_QD_HASH_SIZE - 1) -#define QC_CHANGE 0 -#define QC_SYNC 1 -/* Lock order: qd_lock -> bucket lock -> qd->lockref.lock -> lru lock */ /* -> sd_bitmap_lock */ static DEFINE_SPINLOCK (qd_lock);
@@ -710,7 +707,7 @@ static int sort_qd(const void *a, const void *b)return 0 ; } -static void do_qc (struct gfs2_quota_data *qd,s64 change,int qc_type) +static void do_qc (struct gfs2_quota_data *qd,s64 change) {struct gfs2_sbd *sdp = qd->qd_sbd;struct gfs2_inode *ip =GFS2_I (sdp->sd_qc_inode);
@@ -735,18 +732,16 @@ static void do_qc(struct gfs2_quota_data *qd, s64 change, int qc_type) qd->qd_change = x;spin_unlock (&qd_lock); -if (qc_type ==QC_CHANGE ) { -if (!test_and_set_bit (QDF_CHANGE , &qd->qd_flags)) { -qd_hold (qd); -slot_hold (qd); - } - }else { +if (!x) {gfs2_assert_warn (sdp,test_bit (QDF_CHANGE , &qd->qd_flags));clear_bit (QDF_CHANGE , &qd->qd_flags); qc->qc_flags =0 ; qc->qc_id =0 ;slot_put (qd);qd_put (qd); + }else if (!test_and_set_bit (QDF_CHANGE , &qd->qd_flags)) { +qd_hold (qd); +slot_hold (qd); }if (change <0 )/* Reset quiet flag if we freed some blocks */
@@ -992,7 +987,7 @@ static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)if (error) goto out_end_trans; -do_qc (qd, -qd->qd_change_sync,QC_SYNC ); +do_qc (qd, -qd->qd_change_sync);set_bit (QDF_REFRESH , &qd->qd_flags); }
@@ -1312,7 +1307,7 @@ void gfs2_quota_change(struct gfs2_inode *ip, s64 change,if (qid_eq (qd->qd_id,make_kqid_uid (uid)) ||qid_eq (qd->qd_id,make_kqid_gid (gid))) { -do_qc (qd, change,QC_CHANGE ); +do_qc (qd, change); } } }
fs/gfs2/util.c +3 -3
@@ -99,12 +99,12 @@ int check_journal_clean(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,*/ int gfs2_freeze_lock_shared (struct gfs2_sbd *sdp) { +int flags =LM_FLAG_NOEXP |GL_EXACT ;int error; - error =gfs2_glock_nq_init (sdp->sd_freeze_gl,LM_ST_SHARED , -LM_FLAG_NOEXP |GL_EXACT , + error =gfs2_glock_nq_init (sdp->sd_freeze_gl,LM_ST_SHARED , flags, &sdp->sd_freeze_gh); -if (error) +if (error && error !=GLR_TRYFAILED )fs_err (sdp,"can't lock the freeze glock: %d\n" , error);return error; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/184 RAS/AMD/ATL: Validate address map when information is gathered
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Allen <[email protected]>
[ Upstream commit d5811a165caf63a69cd8ae11156b8587cc57d1d1 ]
Validate address maps at the time the information is gathered as the address map will not change during translation.
--- drivers/ras/amd/atl/dehash.c | 43 -------------------- drivers/ras/amd/atl/map.c | 77 ++++++++++++++++++++++++++++++++++++ 2 files changed, 77 insertions(+), 43 deletions(-)
drivers/ras/amd/atl/dehash.c +0 -43
@@ -12,41 +12,10 @@#include "internal.h" -/* -* Verify the interleave bits are correct in the different interleaving -* settings. -* -* If @num_intlv_dies and/or @num_intlv_sockets are 1, it means the -* respective interleaving is disabled. -*/ -static inline bool map_bits_valid (struct addr_ctx *ctx,u8 bit1,u8 bit2, -u8 num_intlv_dies,u8 num_intlv_sockets) -{ -if (!(ctx->map.intlv_bit_pos == bit1 || ctx->map.intlv_bit_pos == bit2)) { -pr_debug ("Invalid interleave bit: %u" , ctx->map.intlv_bit_pos); -return false; - } - -if (ctx->map.num_intlv_dies > num_intlv_dies) { -pr_debug ("Invalid number of interleave dies: %u" , ctx->map.num_intlv_dies); -return false; - } - -if (ctx->map.num_intlv_sockets > num_intlv_sockets) { -pr_debug ("Invalid number of interleave sockets: %u" , ctx->map.num_intlv_sockets); -return false; - } - -return true; -} -static int df2_dehash_addr (struct addr_ctx *ctx) {u8 hashed_bit, intlv_bit, intlv_bit_pos; -if (!map_bits_valid (ctx,8 ,9 ,1 ,1 )) -return -EINVAL ; - intlv_bit_pos = ctx->map.intlv_bit_pos; intlv_bit = !!(BIT_ULL (intlv_bit_pos) & ctx->ret_addr);
@@ -67,9 +36,6 @@ static int df3_dehash_addr(struct addr_ctx *ctx)bool hash_ctl_64k, hash_ctl_2M, hash_ctl_1G;u8 hashed_bit, intlv_bit, intlv_bit_pos; -if (!map_bits_valid (ctx,8 ,9 ,1 ,1 )) -return -EINVAL ; - hash_ctl_64k =FIELD_GET (DF3_HASH_CTL_64K , ctx->map.ctl); hash_ctl_2M =FIELD_GET (DF3_HASH_CTL_2M , ctx->map.ctl); hash_ctl_1G =FIELD_GET (DF3_HASH_CTL_1G , ctx->map.ctl);
@@ -171,9 +137,6 @@ static int df4_dehash_addr(struct addr_ctx *ctx)bool hash_ctl_64k, hash_ctl_2M, hash_ctl_1G;u8 hashed_bit, intlv_bit; -if (!map_bits_valid (ctx,8 ,8 ,1 ,2 )) -return -EINVAL ; - hash_ctl_64k =FIELD_GET (DF4_HASH_CTL_64K , ctx->map.ctl); hash_ctl_2M =FIELD_GET (DF4_HASH_CTL_2M , ctx->map.ctl); hash_ctl_1G =FIELD_GET (DF4_HASH_CTL_1G , ctx->map.ctl);
@@ -247,9 +210,6 @@ static int df4p5_dehash_addr(struct addr_ctx *ctx)u8 hashed_bit, intlv_bit;u64 rehash_vector; -if (!map_bits_valid (ctx,8 ,8 ,1 ,2 )) -return -EINVAL ; - hash_ctl_64k =FIELD_GET (DF4_HASH_CTL_64K , ctx->map.ctl); hash_ctl_2M =FIELD_GET (DF4_HASH_CTL_2M , ctx->map.ctl); hash_ctl_1G =FIELD_GET (DF4_HASH_CTL_1G , ctx->map.ctl);
@@ -360,9 +320,6 @@ static int mi300_dehash_addr(struct addr_ctx *ctx)bool hashed_bit, intlv_bit, test_bit;u8 num_intlv_bits, base_bit, i; -if (!map_bits_valid (ctx,8 ,8 ,4 ,1 )) -return -EINVAL ; - hash_ctl_4k =FIELD_GET (DF4p5_HASH_CTL_4K, ctx->map.ctl); hash_ctl_64k =FIELD_GET (DF4_HASH_CTL_64K , ctx->map.ctl); hash_ctl_2M =FIELD_GET (DF4_HASH_CTL_2M , ctx->map.ctl);
drivers/ras/amd/atl/map.c +77 -0
88 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/184 net: tcp/dccp: prepare for tw_timer un-pinning
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Schneider <[email protected]>
[ Upstream commit b334b924c9b709bc969644fb5c406f5c9d01dceb ]
The TCP timewait timer is proving to be problematic for setups where scheduler CPU isolation is achieved at runtime via cpusets (as opposed to statically via isolcpus=domains).
What happens there is a CPU goes through tcp_time_wait(), arming the time_wait timer, then gets isolated. TCP_TIMEWAIT_LEN later, the timer fires, causing interference for the now-isolated CPU. This is conceptually similar to the issue described in commit e02b93124855 ("workqueue: Unbind kworkers before sending them to exit()")
Move inet_twsk_schedule() to within inet_twsk_hashdance(), with the ehash lock held. Expand the lock's critical section from inet_twsk_kill() to inet_twsk_deschedule_put(), serializing the scheduling vs descheduling of the timer. IOW, this prevents the following race:
tcp_time_wait() inet_twsk_hashdance()
inet_twsk_deschedule_put()
del_timer_sync()
inet_twsk_schedule()
Thanks to Paolo Abeni for suggesting to leverage the ehash lock.
This also restores a comment from commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance") as inet_twsk_hashdance() had a "Step 1" and "Step 3" comment, but the "Step 2" had gone missing.
inet_twsk_deschedule_put() now acquires the ehash spinlock to synchronize with inet_twsk_hashdance_schedule().
To ease possible regression search, actual un-pin is done in next patch.
--- include/net/inet_timewait_sock.h | 6 ++-- net/dccp/minisocks.c | 3 +- net/ipv4/inet_timewait_sock.c | 52 +++++++++++++++++++++++++++----- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_minisocks.c | 3 +- 5 files changed, 52 insertions(+), 14 deletions(-)
include/net/inet_timewait_sock.h +4 -2
@@ -93,8 +93,10 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,struct inet_timewait_death_row *dr, const int state); -void inet_twsk_hashdance (struct inet_timewait_sock *tw,struct sock *sk, -struct inet_hashinfo *hashinfo); +void inet_twsk_hashdance_schedule (struct inet_timewait_sock *tw, +struct sock *sk, +struct inet_hashinfo *hashinfo, +int timeo);void __inet_twsk_schedule (struct inet_timewait_sock *tw,int timeo,bool rearm);
net/dccp/minisocks.c +1 -2
@@ -59,11 +59,10 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)* we complete the initialization. */ local_bh_disable (); -inet_twsk_schedule (tw, timeo);/* Linkage updates. * Note that access to tw after this point is illegal. */ -inet_twsk_hashdance (tw, sk, &dccp_hashinfo); +inet_twsk_hashdance_schedule (tw, sk, &dccp_hashinfo, timeo);local_bh_enable (); }else {/* Sorry, if we're out of memory, just CLOSE this
net/ipv4/inet_timewait_sock.c +45 -7
87 lines not on this page · raw message
net/ipv4/tcp_ipv4.c +1 -1
@@ -159,7 +159,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)if (ts_recent_stamp && (!twp || (reuse &&time_after32 (ktime_get_seconds (), ts_recent_stamp)))) { -/* inet_twsk_hashdance() sets sk_refcnt after putting twsk +/* inet_twsk_hashdance_schedule() sets sk_refcnt after putting twsk * and releasing the bucket lock. */ if (unlikely (!refcount_inc_not_zero (&sktw->sk_refcnt)))
net/ipv4/tcp_minisocks.c +1 -2
@@ -350,11 +350,10 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)* we complete the initialization. */ local_bh_disable (); -inet_twsk_schedule (tw, timeo);/* Linkage updates. * Note that access to tw after this point is illegal. */ -inet_twsk_hashdance (tw, sk, net->ipv4.tcp_death_row.hashinfo); +inet_twsk_hashdance_schedule (tw, sk, net->ipv4.tcp_death_row.hashinfo, timeo);local_bh_enable (); }else {/* Sorry, if we're out of memory, just CLOSE this
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/184 drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 162e48cb1d84c2c966b649b8ac5c9d4f75f6d44f ]
Make sure the connector is fully initialized before signalling any HPD events via drm_kms_helper_hotplug_event(), otherwise this may lead to NULL pointer dereference.
--- drivers/gpu/drm/bridge/tc358767.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/bridge/tc358767.c +1 -1
@@ -2135,7 +2135,7 @@ static irqreturn_t tc_irq_handler(int irq, void *arg)dev_err (tc->dev,"syserr %x\n" , stat); } -if (tc->hpd_pin >=0 && tc->bridge.dev) { +if (tc->hpd_pin >=0 && tc->bridge.dev && tc->aux.drm_dev) {/* * H is triggered when the GPIO goes high. *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/184 drm/xe: Ensure caller uses sole domain for xe_force_wake_assert_held
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Himal Prasad Ghimiray <[email protected]>
[ Upstream commit 3541e19d0d3b30ad099c0c26ba87561aedfbd652 ]
xe_force_wake_assert_held() is designed to confirm a particular forcewake domain's wakefulness; it doesn't verify the wakefulness of multiple domains. Make sure the caller doesn't input multiple domains(XE_FORCEWAKE_ALL) as a parameter.
v2
- use domain != XE_FORCEWAKE_ALL (Michal)
v3
- Add kernel-doc
--- drivers/gpu/drm/xe/xe_force_wake.h | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/gpu/drm/xe/xe_force_wake.h +11 -0
@@ -28,10 +28,21 @@ xe_force_wake_ref(struct xe_force_wake *fw,return fw->domains[ffs (domain) -1 ].ref; } +/** +* xe_force_wake_assert_held - asserts domain is awake +* @fw : xe_force_wake structure +* @domain: xe_force_wake_domains apart from XE_FORCEWAKE_ALL +* +* xe_force_wake_assert_held() is designed to confirm a particular +* forcewake domain's wakefulness; it doesn't verify the wakefulness of +* multiple domains. Make sure the caller doesn't input multiple +* domains(XE_FORCEWAKE_ALL) as a parameter. +*/ static inline void xe_force_wake_assert_held (struct xe_force_wake *fw,enum xe_force_wake_domains domain) { +xe_gt_assert (fw->gt, domain !=XE_FORCEWAKE_ALL );xe_gt_assert (fw->gt, fw->awake_domains & domain); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/184 drm/xe: Check valid domain is passed in xe_force_wake_ref
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Himal Prasad Ghimiray <[email protected]>
[ Upstream commit 35feb8dbbca627d118ccc1f2111841788c142703 ]
Assert domain is not XE_FORCEWAKE_ALL.
v2
- use domain != XE_FORCEWAKE_ALL (Michal)
v3
- Fix commit description.
--- drivers/gpu/drm/xe/xe_force_wake.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_force_wake.h +1 -1
@@ -24,7 +24,7 @@ static inline int xe_force_wake_ref(struct xe_force_wake *fw, enum xe_force_wake_domains domain) { - xe_gt_assert(fw->gt, domain); + xe_gt_assert(fw->gt, domain != XE_FORCEWAKE_ALL);return fw->domains[ffs (domain) -1 ].ref; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/184 pinctrl: renesas: rzg2l: Validate power registers for SD and ETH
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <[email protected]>
[ Upstream commit a3a632ed87f0913779092c30bd0ea7dfd81601f3 ]
On RZ/V2H(P) SoC, the power registers for SD and ETH do not exist, resulting in invalid register offsets. Ensure that the register offsets are valid before any read/write operations are performed. If the power registers are not available, both SD and ETH will be set to '0'.
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +8 -4
@@ -2583,8 +2583,10 @@ static int rzg2l_pinctrl_suspend_noirq(struct device *dev)rzg2l_pinctrl_pm_setup_dedicated_regs (pctrl, true);for (u8 i =0 ; i <2 ; i++) { - cache->sd_ch[i] =readb (pctrl->base +SD_CH (regs->sd_ch, i)); - cache->eth_poc[i] =readb (pctrl->base +ETH_POC (regs->eth_poc, i)); +if (regs->sd_ch) + cache->sd_ch[i] =readb (pctrl->base +SD_CH (regs->sd_ch, i)); +if (regs->eth_poc) + cache->eth_poc[i] =readb (pctrl->base +ETH_POC (regs->eth_poc, i)); } cache->qspi =readb (pctrl->base +QSPI );
@@ -2615,8 +2617,10 @@ static int rzg2l_pinctrl_resume_noirq(struct device *dev)writeb (cache->qspi, pctrl->base +QSPI );writeb (cache->eth_mode, pctrl->base +ETH_MODE );for (u8 i =0 ; i <2 ; i++) { -writeb (cache->sd_ch[i], pctrl->base +SD_CH (regs->sd_ch, i)); -writeb (cache->eth_poc[i], pctrl->base +ETH_POC (regs->eth_poc, i)); +if (regs->sd_ch) +writeb (cache->sd_ch[i], pctrl->base +SD_CH (regs->sd_ch, i)); +if (regs->eth_poc) +writeb (cache->eth_poc[i], pctrl->base +ETH_POC (regs->eth_poc, i)); }rzg2l_pinctrl_pm_setup_pfc (pctrl);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/184 dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking callbacks
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Dautricourt <[email protected]>
[ Upstream commit 261d3a85d959841821ca0d69f9d7b0d4087661c4 ]
As we first take the lock with spin_lock_irqsave in msgdma_tasklet, Lockdep might complain about this. Inspired by commit 9558cf4ad07e ("dmaengine: zynqmp_dma: fix lockdep warning in tasklet")
--- drivers/dma/altera-msgdma.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/dma/altera-msgdma.c +3 -2
@@ -583,6 +583,7 @@ static void msgdma_issue_pending(struct dma_chan *chan)static void msgdma_chan_desc_cleanup (struct msgdma_device *mdev) {struct msgdma_sw_desc *desc, *next; +unsigned long irqflags;list_for_each_entry_safe (desc, next, &mdev->done_list, node) {struct dmaengine_desc_callback cb;
@@ -591,9 +592,9 @@ static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)dmaengine_desc_get_callback (&desc->async_tx, &cb);if (dmaengine_desc_callback_valid (&cb)) { -spin_unlock (&mdev->lock); +spin_unlock_irqrestore (&mdev->lock, irqflags);dmaengine_desc_callback_invoke (&cb,NULL ); -spin_lock (&mdev->lock); +spin_lock_irqsave (&mdev->lock, irqflags); }/* Run any dependencies, then free the descriptor */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/184 dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olivier Dautricourt <[email protected]>
[ Upstream commit 54e4ada1a4206f878e345ae01cf37347d803d1b1 ]
Remove list_del call in msgdma_chan_desc_cleanup, this should be the role of msgdma_free_descriptor. In consequence replace list_add_tail with list_move_tail in msgdma_free_descriptor.
This fixes the path:
msgdma_free_chan_resources -> msgdma_free_descriptors -> msgdma_free_desc_list -> msgdma_free_descriptor
which does not correctly free the descriptors as first nodes were not removed from the list.
--- drivers/dma/altera-msgdma.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/dma/altera-msgdma.c +1 -3
@@ -233,7 +233,7 @@ static void msgdma_free_descriptor(struct msgdma_device *mdev,struct msgdma_sw_desc *child, *next; mdev->desc_free_cnt++; -list_add_tail (&desc->node, &mdev->free_list); +list_move_tail (&desc->node, &mdev->free_list);list_for_each_entry_safe (child, next, &desc->tx_list, node) { mdev->desc_free_cnt++;list_move_tail (&child->node, &mdev->free_list);
@@ -588,8 +588,6 @@ static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)list_for_each_entry_safe (desc, next, &mdev->done_list, node) {struct dmaengine_desc_callback cb; -list_del (&desc->node); -dmaengine_desc_get_callback (&desc->async_tx, &cb);if (dmaengine_desc_callback_valid (&cb)) {spin_unlock_irqrestore (&mdev->lock, irqflags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/184 thermal: trip: Use READ_ONCE() for lockless access to trip properties
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit a52641bc6293a24f25956a597e7f32148b0e2bb8 ]
When accessing trip temperature and hysteresis without locking, it is better to use READ_ONCE() to prevent compiler optimizations possibly affecting the read from being applied.
Of course, for the READ_ONCE() to be effective, WRITE_ONCE() needs to be used when updating their values.
--- drivers/thermal/thermal_sysfs.c | 6 +++--- drivers/thermal/thermal_trip.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/thermal/thermal_sysfs.c +3 -3
@@ -150,7 +150,7 @@ trip_point_temp_show(struct device *dev, struct device_attribute *attr,if (sscanf (attr->attr.name,"trip_point_%d_temp" , &trip_id) !=1 )return -EINVAL ; -return sprintf (buf,"%d\n" , tz->trips[trip_id].trip.temperature); +return sprintf (buf,"%d\n" ,READ_ONCE (tz->trips[trip_id].trip.temperature)); } static ssize_t
@@ -174,7 +174,7 @@ trip_point_hyst_store(struct device *dev, struct device_attribute *attr, trip = &tz->trips[trip_id].trip;if (hyst != trip->hysteresis) { - trip->hysteresis = hyst; +WRITE_ONCE (trip->hysteresis, hyst);thermal_zone_trip_updated (tz, trip); }
@@ -194,7 +194,7 @@ trip_point_hyst_show(struct device *dev, struct device_attribute *attr,if (sscanf (attr->attr.name,"trip_point_%d_hyst" , &trip_id) !=1 )return -EINVAL ; -return sprintf (buf,"%d\n" , tz->trips[trip_id].trip.hysteresis); +return sprintf (buf,"%d\n" ,READ_ONCE (tz->trips[trip_id].trip.hysteresis)); } static ssize_t
drivers/thermal/thermal_trip.c +1 -1
@@ -152,7 +152,7 @@ void thermal_zone_set_trip_temp(struct thermal_zone_device *tz,if (trip->temperature == temp)return ; - trip->temperature = temp; +WRITE_ONCE (trip->temperature, temp);thermal_notify_tz_trip_change (tz, trip);if (temp ==THERMAL_TEMP_INVALID ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/184 hwmon: (k10temp) Check return value of amd_smn_read()
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazen Ghannam <[email protected]>
[ Upstream commit c2d79cc5455c891de6c93e1e0c73d806e299c54f ]
Check the return value of amd_smn_read() before saving a value. This ensures invalid values aren't saved or used.
There are three cases here with slightly different behavior:
1) read_tempreg_nb_zen():
This is a function pointer which does not include a return code. In this case, set the register value to 0 on failure. This enforces Read-as-Zero behavior.
2) k10temp_read_temp():
This function does have return codes, so return the error code from the failed register read. Continued operation is not necessary, since there is no valid data from the register. Furthermore, if the register value was set to 0, then the following operation would underflow.
3) k10temp_get_ccd_support():
This function reads the same register from multiple CCD instances in a loop. And a bitmask is formed if a specific bit is set in each register instance. The loop should continue on a failed register read, skipping the bit check.
--- drivers/hwmon/k10temp.c | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-)
drivers/hwmon/k10temp.c +27 -9
@@ -153,8 +153,9 @@ static void read_tempreg_nb_f15(struct pci_dev *pdev, u32 *regval)static void read_tempreg_nb_zen (struct pci_dev *pdev,u32 *regval) { -amd_smn_read (amd_pci_dev_to_node_id (pdev), -ZEN_REPORTED_TEMP_CTRL_BASE , regval); +if (amd_smn_read (amd_pci_dev_to_node_id (pdev), +ZEN_REPORTED_TEMP_CTRL_BASE , regval)) + *regval =0 ; }static long get_raw_temp (struct k10temp_data *data)
@@ -205,6 +206,7 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, long *val) {struct k10temp_data *data =dev_get_drvdata (dev); +int ret = -EOPNOTSUPP ;u32 regval;switch (attr) {
@@ -221,13 +223,17 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, *val =0 ;break ; case 2 ... 13: /* Tccd{1-12} */ -amd_smn_read (amd_pci_dev_to_node_id (data->pdev), -ZEN_CCD_TEMP (data->ccd_offset, channel -2 ), - ®val); + ret =amd_smn_read (amd_pci_dev_to_node_id (data->pdev), +ZEN_CCD_TEMP (data->ccd_offset, channel -2 ), + ®val); + +if (ret) +return ret; + *val = (regval &ZEN_CCD_TEMP_MASK ) *125 -49000 ;break ;default : -return -EOPNOTSUPP ; +return ret; }break ;case hwmon_temp_max:
@@ -243,7 +249,7 @@ static int k10temp_read_temp(struct device *dev, u32 attr, int channel, - ((regval >> 24) & 0xf)) * 500 + 52000;break ;default : -return -EOPNOTSUPP ; +return ret; }return 0 ; }
@@ -381,8 +387,20 @@ static void k10temp_get_ccd_support(struct pci_dev *pdev,int i;for (i =0 ; i < limit; i++) { -amd_smn_read (amd_pci_dev_to_node_id (pdev), -ZEN_CCD_TEMP (data->ccd_offset, i), ®val); +/* +* Ignore inaccessible CCDs. +* +* Some systems will return a register value of 0, and the TEMP_VALID +* bit check below will naturally fail. +* +* Other systems will return a PCI_ERROR_RESPONSE (0xFFFFFFFF) for +* the register value. And this will incorrectly pass the TEMP_VALID +* bit check. +*/ +if (amd_smn_read (amd_pci_dev_to_node_id (pdev), +ZEN_CCD_TEMP (data->ccd_offset, i), ®val)) +continue ; +if (regval &ZEN_CCD_TEMP_VALID ) data->show_temp |=BIT (TCCD_BIT (i)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/184 wifi: cfg80211: make hash table duplicates more survivable
In reply to Greg Kroah-Hartman6.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 7f12e26a194d0043441f870708093d9c2c3bad7d ]
Jiazi Li reported that they occasionally see hash table duplicates as evidenced by the WARN_ON() in rb_insert_bss() in this code. It isn't clear how that happens, nor have I been able to reproduce it, but if it does happen, the kernel crashes later, when it tries to unhash the entry that's now not hashed.
Try to make this situation more survivable by removing the BSS from the list(s) as well, that way it's fully leaked here (as had been the intent in the hash insert error path), and no longer reachable through the list(s) so it shouldn't be unhashed again later.
--- net/wireless/scan.c | 46 +++++++++++++++++++++++++++++++++------------ 1 file changed, 34 insertions(+), 12 deletions(-)
net/wireless/scan.c +34 -12
@@ -1604,7 +1604,7 @@ struct cfg80211_bss *__cfg80211_get_bss(struct wiphy *wiphy, }EXPORT_SYMBOL (__cfg80211_get_bss); -static void rb_insert_bss (struct cfg80211_registered_device *rdev, +static bool rb_insert_bss (struct cfg80211_registered_device *rdev,struct cfg80211_internal_bss *bss) {struct rb_node **p = &rdev->bss_tree.rb_node;
@@ -1620,7 +1620,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *rdev,if (WARN_ON (!cmp)) {/* will sort of leak this BSS */ -return ; +return false; }if (cmp <0 )
@@ -1631,6 +1631,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *rdev,rb_link_node (&bss->rbn, parent, p);rb_insert_color (&bss->rbn, &rdev->bss_tree); +return true; } static struct cfg80211_internal_bss *
@@ -1657,6 +1658,34 @@ rb_find_bss(struct cfg80211_registered_device *rdev,return NULL ; } +static void cfg80211_insert_bss (struct cfg80211_registered_device *rdev, +struct cfg80211_internal_bss *bss) +{ +lockdep_assert_held (&rdev->bss_lock); + +if (!rb_insert_bss (rdev, bss)) +return ; +list_add_tail (&bss->list, &rdev->bss_list); + rdev->bss_entries++; +} + +static void cfg80211_rehash_bss (struct cfg80211_registered_device *rdev, +struct cfg80211_internal_bss *bss) +{ +lockdep_assert_held (&rdev->bss_lock); + +rb_erase (&bss->rbn, &rdev->bss_tree); +if (!rb_insert_bss (rdev, bss)) { +list_del (&bss->list); +if (!list_empty (&bss->hidden_list)) +list_del_init (&bss->hidden_list); +if (!list_empty (&bss->pub.nontrans_list)) +list_del_init (&bss->pub.nontrans_list); + rdev->bss_entries--; + } + rdev->bss_generation++; +} +static bool cfg80211_combine_bsses (struct cfg80211_registered_device *rdev,struct cfg80211_internal_bss *new) {
@@ -1969,9 +1998,7 @@ __cfg80211_bss_update(struct cfg80211_registered_device *rdev,bss_ref_get (rdev,bss_from_pub (tmp->pub.transmitted_bss)); } -list_add_tail (&new->list, &rdev->bss_list); - rdev->bss_entries++; -rb_insert_bss (rdev, new); +cfg80211_insert_bss (rdev, new); found = new; }
@@ -3354,19 +3381,14 @@ void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,if (!WARN_ON (!__cfg80211_unlink_bss (rdev, new))) rdev->bss_generation++; } - -rb_erase (&cbss->rbn, &rdev->bss_tree); -rb_insert_bss (rdev, cbss); - rdev->bss_generation++; +cfg80211_rehash_bss (rdev, cbss);list_for_each_entry_safe (nontrans_bss, tmp, &cbss->pub.nontrans_list, nontrans_list) { bss =bss_from_pub (nontrans_bss); bss->pub.channel = chan; -rb_erase (&bss->rbn, &rdev->bss_tree); -rb_insert_bss (rdev, bss); - rdev->bss_generation++; +cfg80211_rehash_bss (rdev, bss); } done:
Signature · 1 line
2.43.0