6.16.5-rc1 review
Greg Kroah-Hartman
maintainerPATCH 1/142 perf: Avoid undefined behavior from stopping/starting inactive events
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <[email protected]>
[ Upstream commit b64fdd422a85025b5e91ead794db9d3ef970e369 ]
Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can leave event->hw.idx at -1. When PMU drivers later attempt to use this negative index as a shift exponent in bitwise operations, it leads to UBSAN shift-out-of-bounds reports.
The issue is a logical flaw in how event groups handle throttling when some members are intentionally disabled. Based on the analysis and the reproducer provided by Mark Rutland (this issue on both arm64 and x86-64).
The scenario unfolds as follows:
1. A group leader event is configured with a very aggressive sampling period (e.g., sample_period = 1). This causes frequent interrupts and triggers the throttling mechanism.
2. A child event in the same group is created in a disabled state (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF. Since it hasn't been scheduled onto the PMU, its event->hw.idx remains initialized at -1.
3. When throttling occurs, perf_event_throttle_group() and later perf_event_unthrottle_group() iterate through all siblings, including the disabled child event.
4. perf_event_throttle()/unthrottle() are called on this inactive child
event, which then call event->pmu->start()/stop().
5. The PMU driver receives the event with hw.idx == -1 and attempts to use it as a shift exponent. e.g., in macros like PMCNTENSET(idx), leading to the UBSAN report.
The throttling mechanism attempts to start/stop events that are not actively scheduled on the hardware.
Move the state check into perf_event_throttle()/perf_event_unthrottle() so that inactive events are skipped entirely. This ensures only active events with a valid hw.idx are processed, preventing undefined behavior and silencing UBSAN warnings. The corrected check ensures true before proceeding with PMU operations.
The problem can be reproduced with the syzkaller reproducer:
--- kernel/events/core.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/events/core.c +6 -0
@@ -2665,6 +2665,9 @@ static void perf_log_itrace_start(struct perf_event *event);static void perf_event_unthrottle (struct perf_event *event,bool start) { +if (event->state !=PERF_EVENT_STATE_ACTIVE ) +return ; + event->hw.interrupts =0 ;if (start) event->pmu->start (event,0 );
@@ -2674,6 +2677,9 @@ static void perf_event_unthrottle(struct perf_event *event, bool start)static void perf_event_throttle (struct perf_event *event) { +if (event->state !=PERF_EVENT_STATE_ACTIVE ) +return ; + event->hw.interrupts =MAX_INTERRUPTS ; event->pmu->stop (event,0 );if (event == event->group_leader)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 10/142 mips: lantiq: xway: sysctrl: rename the etop node
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 8c431ea8f3f795c4b9cfa57a85bc4166b9cce0ac ]
Bindig requires a node name matching ‘^ethernet@[0-9a-f]+$’. This patch changes the clock name from “etop” to “ethernet”.
This fixes the following warning:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): $nodename:0: 'etop@e180000' does not match '^ethernet@[0-9a-f]+$'
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#
--- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +- arch/mips/lantiq/xway/sysctrl.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/mips/boot/dts/lantiq/danube_easy50712.dts +1 -1
@@ -82,7 +82,7 @@ conf_out { }; }; - etop@e180000 { + ethernet@e180000 { compatible = "lantiq,etop-xway"; reg = <0xe180000 0x40000>; interrupt-parent = <&icu0>;
arch/mips/lantiq/xway/sysctrl.c +5 -5
@@ -497,7 +497,7 @@ void __init ltq_soc_init(void) ifccr =CGU_IFCCR_VR9 ; pcicr =CGU_PCICR_VR9 ; }else { -clkdev_add_pmu ("1e180000.etop" ,NULL ,1 ,0 ,PMU_PPE ); +clkdev_add_pmu ("1e180000.ethernet" ,NULL ,1 ,0 ,PMU_PPE ); }if (!of_machine_is_compatible ("lantiq,ase" ))
@@ -531,9 +531,9 @@ void __init ltq_soc_init(void) CLOCK_133M, CLOCK_133M);clkdev_add_pmu ("1e101000.usb" ,"otg" ,1 ,0 ,PMU_USB0 );clkdev_add_pmu ("1f203018.usb2-phy" ,"phy" ,1 ,0 ,PMU_USB0_P ); -clkdev_add_pmu ("1e180000.etop" ,"ppe" ,1 ,0 ,PMU_PPE ); -clkdev_add_cgu ("1e180000.etop" ,"ephycgu" ,CGU_EPHY ); -clkdev_add_pmu ("1e180000.etop" ,"ephy" ,1 ,0 ,PMU_EPHY ); +clkdev_add_pmu ("1e180000.ethernet" ,"ppe" ,1 ,0 ,PMU_PPE ); +clkdev_add_cgu ("1e180000.ethernet" ,"ephycgu" ,CGU_EPHY ); +clkdev_add_pmu ("1e180000.ethernet" ,"ephy" ,1 ,0 ,PMU_EPHY );clkdev_add_pmu ("1e103000.sdio" ,NULL ,1 ,0 ,PMU_ASE_SDIO );clkdev_add_pmu ("1e116000.mei" ,"dfe" ,1 ,0 ,PMU_DFE ); }else if (of_machine_is_compatible ("lantiq,grx390" )) {
@@ -592,7 +592,7 @@ void __init ltq_soc_init(void)clkdev_add_pmu ("1e101000.usb" ,"otg" ,1 ,0 ,PMU_USB0 |PMU_AHBM );clkdev_add_pmu ("1f203034.usb2-phy" ,"phy" ,1 ,0 ,PMU_USB1_P );clkdev_add_pmu ("1e106000.usb" ,"otg" ,1 ,0 ,PMU_USB1 |PMU_AHBM ); -clkdev_add_pmu ("1e180000.etop" ,"switch" ,1 ,0 ,PMU_SWITCH ); +clkdev_add_pmu ("1e180000.ethernet" ,"switch" ,1 ,0 ,PMU_SWITCH );clkdev_add_pmu ("1e103000.sdio" ,NULL ,1 ,0 ,PMU_SDIO );clkdev_add_pmu ("1e103100.deu" ,NULL ,1 ,0 ,PMU_DEU );clkdev_add_pmu ("1e116000.mei" ,"dfe" ,1 ,0 ,PMU_DFE );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 11/142 of: dynamic: Fix use after free in of_changeset_add_prop_helper()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 80af3745ca465c6c47e833c1902004a7fa944f37 ]
If the of_changeset_add_property() function call fails, then this code frees "new_pp" and then dereference it on the next line. Return the error code directly instead.
--- drivers/of/dynamic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/of/dynamic.c +4 -2
@@ -935,13 +935,15 @@ static int of_changeset_add_prop_helper(struct of_changeset *ocs,return -ENOMEM ; ret =of_changeset_add_property (ocs, np, new_pp); -if (ret) +if (ret) {__of_prop_free (new_pp); +return ret; + } new_pp->next = np->deadprops; np->deadprops = new_pp; -return ret; +return 0 ; }/**
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 12/142 fgraph: Copy args in intermediate storage with entry
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
[ Upstream commit e3d01979e4bff5c87eb4054a22e7568bb679b1fe ]
The output of the function graph tracer has two ways to display its entries. One way for leaf functions with no events recorded within them, and the other is for functions with events recorded inside it. As function graph has an entry and exit event, to simplify the output of leaf functions it combines the two, where as non leaf functions are separate:
2) | invoke_rcu_core() {
2) | raise_softirq() {
2) 0.391 us | __raise_softirq_irqoff();
2) 1.191 us | }
2) 2.086 us | }The __raise_softirq_irqoff() function above is really two events that were merged into one. Otherwise it would have looked like:
2) | invoke_rcu_core() {
2) | raise_softirq() {
2) | __raise_softirq_irqoff() {
2) 0.391 us | }
2) 1.191 us | }
2) 2.086 us | }In order to do this merge, the reading of the trace output file needs to look at the next event before printing. But since the pointer to the event is on the ring buffer, it needs to save the entry event before it looks at the next event as the next event goes out of focus as soon as a new event is read from the ring buffer. After it reads the next event, it will print the entry event with either the '{' (non leaf) or ';' and timestamps (leaf).
The iterator used to read the trace file has storage for this event. The problem happens when the function graph tracer has arguments attached to the entry event as the entry now has a variable length "args" field. This field only gets set when funcargs option is used. But the args are not recorded in this temp data and garbage could be printed. The entry field is copied via:
data->ent = *curr;
Where "curr" is the entry field. But this method only saves the non variable length fields from the structure.
Add a helper structure to the iterator data that adds the max args size to the data storage in the iterator. Then simply copy the entire entry into this storage (with size protection).
--- kernel/trace/trace_functions_graph.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
kernel/trace/trace_functions_graph.c +16 -6
@@ -27,14 +27,21 @@ struct fgraph_cpu_data {unsigned long enter_funcs[FTRACE_RETFUNC_DEPTH ]; }; +struct fgraph_ent_args { +struct ftrace_graph_ent_entry ent; +/* Force the sizeof of args[] to have FTRACE_REGS_MAX_ARGS entries */ +unsigned long args[FTRACE_REGS_MAX_ARGS ]; +}; +struct fgraph_data {struct fgraph_cpu_data __percpu *cpu_data;/* Place to preserve last processed entry. */ union { -struct ftrace_graph_ent_entry ent; +struct fgraph_ent_args ent; +/* TODO allow retaddr to have args */ struct fgraph_retaddr_ent_entry rent; - } ent; + };struct ftrace_graph_ret_entry ret;int failed;int cpu;
@@ -627,10 +634,13 @@ get_return_for_leaf(struct trace_iterator *iter,* Save current and next entries for later reference * if the output fails. */ -if (unlikely (curr->ent.type ==TRACE_GRAPH_RETADDR_ENT )) - data->ent.rent = *(struct fgraph_retaddr_ent_entry *)curr; -else - data->ent.ent = *curr; +if (unlikely (curr->ent.type ==TRACE_GRAPH_RETADDR_ENT )) { + data->rent = *(struct fgraph_retaddr_ent_entry *)curr; + }else { +int size =min ((int )sizeof (data->ent), (int )iter->ent_size); + +memcpy (&data->ent, curr, size); + }/* * If the next event is not a return type, then * we only care about what type it is. Otherwise we can
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 13/142 ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
[ Upstream commit 4013aef2ced9b756a410f50d12df9ebe6a883e4a ]
When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition.
The issue occurs because:
CPU0 (ftrace_dump) CPU1 (reader)
echo z > /proc/sysrq-trigger
!trace_empty(&iter)trace_iterator_reset(&iter) <- len = size = 0
cat /sys/kernel/tracing/trace_pipetrace_find_next_entry_inc(&iter)
__find_next_entry
ring_buffer_empty_cpu <- all empty
return NULL
trace_printk_seq(&iter.seq)
WARN_ON_ONCE(s->seq.len >= s->seq.size)
In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate iter.seq. At this point, due to the prior trace_iterator_reset, both iter.seq.len and iter.seq.size were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered.
Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.
--- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/trace.c +2 -2
@@ -10700,10 +10700,10 @@ static void ftrace_dump_one(struct trace_array *tr, enum ftrace_dump_mode dump_m ret =print_trace_line (&iter);if (ret !=TRACE_TYPE_NO_CONSUME )trace_consume (&iter); + +trace_printk_seq (&iter.seq); }touch_nmi_watchdog (); - -trace_printk_seq (&iter.seq); }if (!cnt)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 14/142 perf symbol-minimal: Fix ehdr reading in filename__read_build_id
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit ba0b7081f7a521d7c28b527a4f18666a148471e7 ]
The e_ident is part of the ehdr and so reading it a second time would mean the read ehdr was displaced by 16-bytes. Switch from stdio to open/read/lseek syscalls for similarity with the symbol-elf version of the function and so that later changes can alter then open flags.
--- tools/perf/util/symbol-minimal.c | 55 ++++++++++++++++---------------- 1 file changed, 27 insertions(+), 28 deletions(-)
tools/perf/util/symbol-minimal.c +27 -28
@@ -4,7 +4,6 @@#include <errno.h> #include <unistd.h> -#include <stdio.h> #include <fcntl.h> #include <string.h> #include <stdlib.h>
@@ -88,11 +87,8 @@ int filename__read_debuglink(const char *filename __maybe_unused,*/ int filename__read_build_id(const char *filename, struct build_id *bid) { - FILE *fp; - int ret = -1; + int fd, ret = -1; bool need_swap = false, elf32; - u8 e_ident[EI_NIDENT]; - int i; union { struct { Elf32_Ehdr ehdr32;
@@ -103,28 +99,27 @@ int filename__read_build_id(const char *filename, struct build_id *bid)Elf64_Phdr *phdr64; }; } hdrs; -void *phdr; -size_t phdr_size; -void *buf =NULL ; -size_t buf_size =0 ; +void *phdr, *buf =NULL ; +ssize_t phdr_size, ehdr_size, buf_size =0 ; - fp =fopen (filename,"r" ); -if (fp ==NULL ) + fd =open (filename,O_RDONLY ); +if (fd <0 )return -1 ; -if (fread (e_ident,sizeof (e_ident),1 , fp) !=1 ) +if (read (fd, hdrs.ehdr32.e_ident,EI_NIDENT ) !=EI_NIDENT ) goto out; -if (memcmp (e_ident,ELFMAG ,SELFMAG ) || - e_ident[EI_VERSION ] !=EV_CURRENT ) +if (memcmp (hdrs.ehdr32.e_ident,ELFMAG ,SELFMAG ) || + hdrs.ehdr32.e_ident[EI_VERSION ] !=EV_CURRENT ) goto out; - need_swap =check_need_swap (e_ident[EI_DATA ]); - elf32 = e_ident[EI_CLASS ] ==ELFCLASS32 ; + need_swap =check_need_swap (hdrs.ehdr32.e_ident[EI_DATA ]); + elf32 = hdrs.ehdr32.e_ident[EI_CLASS ] ==ELFCLASS32 ; + ehdr_size = (elf32 ?sizeof (hdrs.ehdr32) :sizeof (hdrs.ehdr64)) -EI_NIDENT ; -if (fread (elf32 ? (void *)&hdrs.ehdr32 : (void *)&hdrs.ehdr64, - elf32 ?sizeof (hdrs.ehdr32) :sizeof (hdrs.ehdr64), -1 , fp) !=1 ) +if (read (fd, + (elf32 ? (void *)&hdrs.ehdr32 : (void *)&hdrs.ehdr64) +EI_NIDENT , + ehdr_size) != ehdr_size) goto out;if (need_swap) {
@@ -138,14 +133,18 @@ int filename__read_build_id(const char *filename, struct build_id *bid) hdrs.ehdr64.e_phnum =bswap_16 (hdrs.ehdr64.e_phnum); } } - phdr_size = elf32 ? hdrs.ehdr32.e_phentsize * hdrs.ehdr32.e_phnum - : hdrs.ehdr64.e_phentsize * hdrs.ehdr64.e_phnum; +if ((elf32 && hdrs.ehdr32.e_phentsize !=sizeof (Elf32_Phdr)) || + (!elf32 && hdrs.ehdr64.e_phentsize !=sizeof (Elf64_Phdr))) + goto out; + + phdr_size = elf32 ?sizeof (Elf32_Phdr) * hdrs.ehdr32.e_phnum + :sizeof (Elf64_Phdr) * hdrs.ehdr64.e_phnum; phdr =malloc (phdr_size);if (phdr ==NULL ) goto out; -fseek (fp, elf32 ? hdrs.ehdr32.e_phoff : hdrs.ehdr64.e_phoff,SEEK_SET ); -if (fread (phdr, phdr_size,1 , fp) !=1 ) +lseek (fd, elf32 ? hdrs.ehdr32.e_phoff : hdrs.ehdr64.e_phoff,SEEK_SET ); +if (read (fd, phdr, phdr_size) != phdr_size) goto out_free;if (elf32)
@@ -153,8 +152,8 @@ int filename__read_build_id(const char *filename, struct build_id *bid)else hdrs.phdr64 = phdr; -for (i =0 ; i < elf32 ? hdrs.ehdr32.e_phnum : hdrs.ehdr64.e_phnum; i++) { -size_t p_filesz; +for (int i =0 ; i < (elf32 ? hdrs.ehdr32.e_phnum : hdrs.ehdr64.e_phnum); i++) { +ssize_t p_filesz;if (need_swap) {if (elf32) {
@@ -180,8 +179,8 @@ int filename__read_build_id(const char *filename, struct build_id *bid) goto out_free; buf = tmp; } -fseek (fp, elf32 ? hdrs.phdr32[i].p_offset : hdrs.phdr64[i].p_offset,SEEK_SET ); -if (fread (buf, p_filesz,1 , fp) !=1 ) +lseek (fd, elf32 ? hdrs.phdr32[i].p_offset : hdrs.phdr64[i].p_offset,SEEK_SET ); +if (read (fd, buf, p_filesz) != p_filesz) goto out_free; ret =read_build_id (buf, p_filesz, bid, need_swap);
@@ -194,7 +193,7 @@ int filename__read_build_id(const char *filename, struct build_id *bid)free (buf);free (phdr); out: -fclose (fp); +close (fd);return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 15/142 Revert "virtio: reject shm region if length is zero"
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Torrente <[email protected]>
[ Upstream commit ced17ee32a9988b8a260628e7c31a100d7dc082e ]
The commit 206cc44588f7 ("virtio: reject shm region if length is zero") breaks the Virtio-gpu host_visible feature.
As you can see in the snippet below, host_visible_region is zero because of the kzalloc. It's using the vm_get_shm_region (drivers/virtio/virtio_mmio.c:536) to read the addr and len from qemu/crosvm.
```
drivers/gpu/drm/virtio/virtgpu_kms.c
132 vgdev = drmm_kzalloc(dev, sizeof(struct virtio_gpu_device), GFP_KERNEL);
[...]
177 if (virtio_get_shm_region(vgdev->vdev, &vgdev->host_visible_region,
178 VIRTIO_GPU_SHM_ID_HOST_VISIBLE)) {
```Now it always fails.
To fix, revert the offending commit.
Message-Id: <[email protected]>
--- include/linux/virtio_config.h | 2 -- 1 file changed, 2 deletions(-)
include/linux/virtio_config.h +0 -2
@@ -329,8 +329,6 @@ static inlinebool virtio_get_shm_region (struct virtio_device *vdev,struct virtio_shm_region *region,u8 id) { -if (!region->len) -return false;if (!vdev->config->get_shm_region)return false;return vdev->config->get_shm_region (vdev, region, id);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 16/142 vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 24fc631539cc78225f5c61f99c7666fcff48024d ]
The VHOST_[GS]ET_FEATURES_ARRAY ioctl already took 0x83 and it would result in a build error when the vhost uapi header is used for perf tool build like below.
In file included from trace/beauty/ioctl.c:93:
tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c: In function ‘ioctl__scnprintf_vhost_virtio_cmd’:
tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c:36:18: error: initialized field overwritten [-Werror=override-init]
36 | [0x83] = "SET_FORK_FROM_OWNER",
| ^~~~~~~~~~~~~~~~~~~~~ tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c:36:18: note: (near initialization for ‘vhost_virtio_ioctl_cmds[131]’)
Message-Id: <[email protected]>
--- include/uapi/linux/vhost.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/uapi/linux/vhost.h +2 -2
@@ -254,7 +254,7 @@* When fork_owner is set to VHOST_FORK_OWNER_KTHREAD: * - Vhost will create vhost workers as kernel threads. */ -#define VHOST_SET_FORK_FROM_OWNER _IOW(VHOST_VIRTIO, 0x83, __u8) +#define VHOST_SET_FORK_FROM_OWNER _IOW(VHOST_VIRTIO, 0x84, __u8)/** * VHOST_GET_FORK_OWNER - Get the current fork_owner flag for the vhost device.
@@ -262,6 +262,6 @@* * @return: An 8-bit value indicating the current thread mode. */ -#define VHOST_GET_FORK_FROM_OWNER _IOR(VHOST_VIRTIO, 0x84, __u8) +#define VHOST_GET_FORK_FROM_OWNER _IOR(VHOST_VIRTIO, 0x85, __u8)#endif
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 17/142 scsi: core: sysfs: Correct sysfs attributes access rights
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit a2f54ff15c3bdc0132e20aae041607e2320dbd73 ]
The SCSI sysfs attributes "supported_mode" and "active_mode" do not define a store method and thus cannot be modified. Correct the DEVICE_ATTR() call for these two attributes to not include S_IWUSR to allow write access as they are read-only.
--- drivers/scsi/scsi_sysfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/scsi_sysfs.c +2 -2
@@ -265,7 +265,7 @@ show_shost_supported_mode(struct device *dev, struct device_attribute *attr,return show_shost_mode (supported_mode, buf); } -static DEVICE_ATTR(supported_mode, S_IRUGO | S_IWUSR, show_shost_supported_mode, NULL); +static DEVICE_ATTR(supported_mode, S_IRUGO, show_shost_supported_mode, NULL); static ssize_t show_shost_active_mode(struct device *dev,
@@ -279,7 +279,7 @@ show_shost_active_mode(struct device *dev,return show_shost_mode (shost->active_mode, buf); } -static DEVICE_ATTR(active_mode, S_IRUGO | S_IWUSR, show_shost_active_mode, NULL); +static DEVICE_ATTR(active_mode, S_IRUGO, show_shost_active_mode, NULL);static int check_reset_type (const char *str) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 18/142 smb: client: fix race with concurrent opens in unlink(2)
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit 0af1561b2d60bab2a2b00720a5c7b292ecc549ec ]
According to some logs reported by customers, CIFS client might end up reporting unlinked files as existing in stat(2) due to concurrent opens racing with unlink(2).
Besides sending the removal request to the server, the unlink process could involve closing any deferred close as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens.
Fix this by unhashing the dentry in cifs_unlink() to prevent any subsequent opens. Any open attempts, while we're still unlinking, will block on parent's i_rwsem.
--- fs/smb/client/inode.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
fs/smb/client/inode.c +14 -2
@@ -1943,15 +1943,24 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)struct cifs_sb_info *cifs_sb =CIFS_SB (sb);struct tcon_link *tlink;struct cifs_tcon *tcon; +__u32 dosattr =0 , origattr =0 ;struct TCP_Server_Info *server;struct iattr *attrs =NULL ; -__u32 dosattr =0 , origattr =0 ; +bool rehash = false;cifs_dbg (FYI ,"cifs_unlink, dir=0x%p, dentry=0x%p\n" , dir, dentry);if (unlikely (cifs_forced_shutdown (cifs_sb)))return -EIO ; +/* Unhash dentry in advance to prevent any concurrent opens */ +spin_lock (&dentry->d_lock); +if (!d_unhashed (dentry)) { +__d_drop (dentry); + rehash = true; + } +spin_unlock (&dentry->d_lock); + tlink =cifs_sb_tlink (cifs_sb);if (IS_ERR (tlink))return PTR_ERR (tlink);
@@ -2003,7 +2012,8 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)cifs_drop_nlink (inode); } }else if (rc == -ENOENT ) { -d_drop (dentry); +if (simple_positive (dentry)) +d_delete (dentry); }else if (rc == -EBUSY ) {if (server->ops->rename_pending_delete) { rc = server->ops->rename_pending_delete(full_path,
@@ -2056,6 +2066,8 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)kfree (attrs);free_xid (xid);cifs_put_tlink (tlink); +if (rehash) +d_rehash (dentry);return rc; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 19/142 smb: client: fix race with concurrent opens in rename(2)
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <[email protected]>
[ Upstream commit d84291fc7453df7881a970716f8256273aca5747 ]
Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file.
Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.
--- fs/smb/client/inode.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
fs/smb/client/inode.c +18 -0
@@ -2474,6 +2474,7 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir,struct cifs_sb_info *cifs_sb;struct tcon_link *tlink;struct cifs_tcon *tcon; +bool rehash = false;unsigned int xid;int rc, tmprc;int retry_count =0 ;
@@ -2489,6 +2490,17 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir,if (unlikely (cifs_forced_shutdown (cifs_sb)))return -EIO ; +/* +* Prevent any concurrent opens on the target by unhashing the dentry. +* VFS already unhashes the target when renaming directories. +*/ +if (d_is_positive (target_dentry) && !d_is_dir (target_dentry)) { +if (!d_unhashed (target_dentry)) { +d_drop (target_dentry); + rehash = true; + } + } + tlink =cifs_sb_tlink (cifs_sb);if (IS_ERR (tlink))return PTR_ERR (tlink);
@@ -2530,6 +2542,8 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, } } +if (!rc) + rehash = false;/* * No-replace is the natural behavior for CIFS, so skip unlink hacks. */
@@ -2588,12 +2602,16 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, goto cifs_rename_exit; rc =cifs_do_rename (xid, source_dentry, from_name, target_dentry, to_name); +if (!rc) + rehash = false; }/* force revalidate to go get info when needed */ CIFS_I (source_dir)->time =CIFS_I (target_dir)->time =0 ; cifs_rename_exit: +if (rehash) +d_rehash (target_dentry);kfree (info_buf_source);free_dentry_path (page2);free_dentry_path (page1);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 2/142 tools/latency-collector: Check pkg-config install
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 26ebba25e210116053609f4c7ee701bffa7ebd7d ]
The tool pkg-config used to check libtraceevent and libtracefs, if not installed, it will report the libs not found, even though they have already been installed.
Before:
libtraceevent is missing. Please install libtraceevent-dev/libtraceevent-devel libtracefs is missing. Please install libtracefs-dev/libtracefs-devel
After:
Makefile.config:10: *** Error: pkg-config needed by libtraceevent/libtracefs is missing on this system, please install it.
--- tools/tracing/latency/Makefile.config | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/tracing/latency/Makefile.config +8 -0
@@ -1,7 +1,15 @@ # SPDX-License-Identifier: GPL-2.0-only +include $(srctree)/tools/scripts/utilities.mak + STOP_ERROR := +ifndef ($(NO_LIBTRACEEVENT),1) + ifeq ($(call get-executable,$(PKG_CONFIG)),) + $(error Error: $(PKG_CONFIG) needed by libtraceevent/libtracefs is missing on this system, please install it) + endif +endif + define lib_setup $(eval LIB_INCLUDES += $(shell sh -c "$(PKG_CONFIG) --cflags lib$(1)")) $(eval LDFLAGS += $(shell sh -c "$(PKG_CONFIG) --libs-only-L lib$(1)"))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 20/142 ASoC: codecs: tx-macro: correct tx_macro_component_drv name
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <[email protected]>
[ Upstream commit 43e0da37d5cfb23eec6aeee9422f84d86621ce2b ]
We already have a component driver named "RX-MACRO", which is lpass-rx-macro.c. The tx macro component driver's name should be "TX-MACRO" accordingly. Fix it.
--- sound/soc/codecs/lpass-tx-macro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/lpass-tx-macro.c +1 -1
@@ -2230,7 +2230,7 @@ static int tx_macro_register_mclk_output(struct tx_macro *tx) }static const struct snd_soc_component_driver tx_macro_component_drv = { - .name ="RX-MACRO" , + .name ="TX-MACRO" , .probe = tx_macro_component_probe, .controls = tx_macro_snd_controls, .num_controls =ARRAY_SIZE (tx_macro_snd_controls),
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 21/142 ASoC: rt721: fix FU33 Boost Volume control not working
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuming Fan <[email protected]>
[ Upstream commit 633e391d45bda3fc848d26bee6bbe57ef2935713 ]
This patch fixed FU33 Boost Volume control not working.
--- sound/soc/codecs/rt721-sdca.c | 2 ++ sound/soc/codecs/rt721-sdca.h | 4 ++++ 2 files changed, 6 insertions(+)
sound/soc/codecs/rt721-sdca.c +2 -0
@@ -278,6 +278,8 @@ static void rt721_sdca_jack_preset(struct rt721_sdca_priv *rt721) RT721_ENT_FLOAT_CTL1, 0x4040);rt_sdca_index_write (rt721->mbq_regmap,RT721_HDA_SDCA_FLOAT ,RT721_ENT_FLOAT_CTL4 ,0x1201 ); +rt_sdca_index_write (rt721->mbq_regmap,RT721_BOOST_CTRL , +RT721_BST_4CH_TOP_GATING_CTRL1 ,0x002a );regmap_write (rt721->regmap,0x2f58 ,0x07 ); }
sound/soc/codecs/rt721-sdca.h +4 -0
@@ -56,6 +56,7 @@ struct rt721_sdca_dmic_kctrl_priv {#define RT721_CBJ_CTRL 0x0a#define RT721_CAP_PORT_CTRL 0x0c#define RT721_CLASD_AMP_CTRL 0x0d +#define RT721_BOOST_CTRL 0x0f#define RT721_VENDOR_REG 0x20#define RT721_RC_CALIB_CTRL 0x40#define RT721_VENDOR_EQ_L 0x53
@@ -93,6 +94,9 @@ struct rt721_sdca_dmic_kctrl_priv {/* Index (NID:0dh) */ #define RT721_CLASD_AMP_2CH_CAL 0x14 +/* Index (NID:0fh) */ +#define RT721_BST_4CH_TOP_GATING_CTRL1 0x05 +/* Index (NID:20h) */ #define RT721_JD_PRODUCT_NUM 0x00#define RT721_ANALOG_BIAS_CTL3 0x04
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 22/142 ASoC: rt1320: fix random cycle mute issue
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuming Fan <[email protected]>
[ Upstream commit f48d7a1b0bf11d16d8c9f77a5b9c80a82272f625 ]
This patch fixed the random cycle mute issue that occurs during long-time playback.
--- sound/soc/codecs/rt1320-sdw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/codecs/rt1320-sdw.c +2 -1
@@ -109,6 +109,7 @@ static const struct reg_sequence rt1320_blind_write[] = { { 0x0000d540, 0x01 }, { 0xd172, 0x2a }, { 0xc5d6, 0x01 }, + { 0xd478, 0xff }, }; static const struct reg_sequence rt1320_vc_blind_write[] = {
@@ -159,7 +160,7 @@ static const struct reg_sequence rt1320_vc_blind_write[] = { { 0xd471, 0x3a }, { 0xd474, 0x11 }, { 0xd475, 0x32 }, - { 0xd478, 0x64 }, + { 0xd478, 0xff }, { 0xd479, 0x20 }, { 0xd47a, 0x10 }, { 0xd47c, 0xff },
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 23/142 erofs: Fallback to normal access if DAX is not supported on extra device
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit c6993c4cb91803fceb82d6b5e0ec5e0aec2d0ad6 ]
If using multiple devices, we should check if the extra device support DAX instead of checking the primary device when deciding if to use DAX to access a file.
If an extra device does not support DAX we should fallback to normal access otherwise the data on that device will be inaccessible.
--- fs/erofs/super.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-)
fs/erofs/super.c +14 -10
@@ -174,6 +174,11 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,if (!erofs_is_fileio_mode (sbi)) { dif->dax_dev =fs_dax_get_by_bdev (file_bdev (file), &dif->dax_part_off,NULL ,NULL ); +if (!dif->dax_dev &&test_opt (&sbi->opt,DAX_ALWAYS )) { +erofs_info (sb,"DAX unsupported by %s. Turning off DAX." , + dif->path); +clear_opt (&sbi->opt,DAX_ALWAYS ); + } }else if (!S_ISREG (file_inode (file)->i_mode)) {fput (file);return -EINVAL ;
@@ -210,8 +215,13 @@ static int erofs_scan_devices(struct super_block *sb, ondisk_extradevs, sbi->devs->extra_devices);return -EINVAL ; } -if (!ondisk_extradevs) +if (!ondisk_extradevs) { +if (test_opt (&sbi->opt,DAX_ALWAYS ) && !sbi->dif0.dax_dev) { +erofs_info (sb,"DAX unsupported by block device. Turning off DAX." ); +clear_opt (&sbi->opt,DAX_ALWAYS ); + }return 0 ; + }if (!sbi->devs->extra_devices && !erofs_is_fscache_mode (sb)) sbi->devs->flatdev = true;
@@ -330,7 +340,6 @@ static int erofs_read_superblock(struct super_block *sb)if (ret <0 ) goto out; -/* handle multiple devices */ ret =erofs_scan_devices (sb, dsb);if (erofs_sb_has_48bit (sbi))
@@ -661,14 +670,9 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)return invalfc (fc,"cannot use fsoffset in fscache mode" ); } -if (test_opt (&sbi->opt,DAX_ALWAYS )) { -if (!sbi->dif0.dax_dev) { -errorfc (fc,"DAX unsupported by block device. Turning off DAX." ); -clear_opt (&sbi->opt,DAX_ALWAYS ); - }else if (sbi->blkszbits !=PAGE_SHIFT ) { -errorfc (fc,"unsupported blocksize for DAX" ); -clear_opt (&sbi->opt,DAX_ALWAYS ); - } +if (test_opt (&sbi->opt,DAX_ALWAYS ) && sbi->blkszbits !=PAGE_SHIFT ) { +erofs_info (sb,"unsupported blocksize for DAX" ); +clear_opt (&sbi->opt,DAX_ALWAYS ); } sb->s_time_gran =1 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 24/142 erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junli Liu <[email protected]>
[ Upstream commit c99fab6e80b76422741d34aafc2f930a482afbdd ]
Since EROFS handles decompression in non-atomic contexts due to uncontrollable decompression latencies and vmap() usage, it tries to detect atomic contexts and only kicks off a kworker on demand in order to reduce unnecessary scheduling overhead.
However, the current approach is insufficient and can lead to sleeping function calls in invalid contexts, causing kernel warnings and potential system instability. See the stacktrace [1] and previous discussion [2].
The current implementation only checks rcu_read_lock_any_held(), which behaves inconsistently across different kernel configurations:
- When CONFIG_DEBUG_LOCK_ALLOC is enabled: correctly detects RCU critical sections by checking rcu_lock_map
- When CONFIG_DEBUG_LOCK_ALLOC is disabled: compiles to "!preemptible()", which only checks preempt_count and misses RCU critical sections
This patch introduces z_erofs_in_atomic() to provide comprehensive atomic context detection:
1. Check RCU preemption depth when CONFIG_PREEMPTION is enabled, as RCU critical sections may not affect preempt_count but still require atomic handling
2. Always use async processing when CONFIG_PREEMPT_COUNT is disabled, as preemption state cannot be reliably determined
3. Fall back to standard preemptible() check for remaining cases
The function replaces the previous complex condition check and ensures that z_erofs always uses (kthread_)work in atomic contexts to minimize scheduling overhead and prevent sleeping in invalid contexts.
[1] Problem stacktrace
[ 61.266692] BUG: sleeping function called from invalid context at kernel/locking/rtmutex_api.c:510 [ 61.266702] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 107, name: irq/54-ufshcd [ 61.266704] preempt_count: 0, expected: 0 [ 61.266705] RCU nest depth: 2, expected: 0 [ 61.266710] CPU: 0 UID: 0 PID: 107 Comm: irq/54-ufshcd Tainted: G W O 6.12.17 #1 [ 61.266714] Tainted: [W]=WARN, [O]=OOT_MODULE [ 61.266715] Hardware name: schumacher (DT) [ 61.266717] Call trace: [ 61.266718] dump_backtrace+0x9c/0x100 [ 61.266727] show_stack+0x20/0x38 [ 61.266728] dump_stack_lvl+0x78/0x90 [ 61.266734] dump_stack+0x18/0x28 [ 61.266736] __might_resched+0x11c/0x180 [ 61.266743] __might_sleep+0x64/0xc8 [ 61.266745] mutex_lock+0x2c/0xc0 [ 61.266748] z_erofs_decompress_queue+0xe8/0x978 [ 61.266753] z_erofs_decompress_kickoff+0xa8/0x190 [ 61.266756] z_erofs_endio+0x168/0x288 [ 61.266758] bio_endio+0x160/0x218 [ 61.266762] blk_update_request+0x244/0x458 [ 61.266766] scsi_end_request+0x38/0x278 [ 61.266770] scsi_io_completion+0x4c/0x600 [ 61.266772] scsi_finish_command+0xc8/0xe8 [ 61.266775] scsi_complete+0x88/0x148 [ 61.266777] blk_mq_complete_request+0x3c/0x58 [ 61.266780] scsi_done_internal+0xcc/0x158 [ 61.266782] scsi_done+0x1c/0x30 [ 61.266783] ufshcd_compl_one_cqe+0x12c/0x438 [ 61.266786] __ufshcd_transfer_req_compl+0x2c/0x78 [ 61.266788] ufshcd_poll+0xf4/0x210 [ 61.266789] ufshcd_transfer_req_compl+0x50/0x88 [ 61.266791] ufshcd_intr+0x21c/0x7c8 [ 61.266792] irq_forced_thread_fn+0x44/0xd8 [ 61.266796] irq_thread+0x1a4/0x358 [ 61.266799] kthread+0x12c/0x138 [ 61.266802] ret_from_fork+0x10/0x20
[2] https://lore.kernel.org/r/58b661d0-0ebb-4b45-a10d-c5927fb791cd@paulmck-laptop
--- fs/erofs/zdata.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/erofs/zdata.c +11 -2
@@ -1430,6 +1430,16 @@ static void z_erofs_decompressqueue_kthread_work(struct kthread_work *work) }#endif +/* Use (kthread_)work in atomic contexts to minimize scheduling overhead */ +static inline bool z_erofs_in_atomic (void ) +{ +if (IS_ENABLED (CONFIG_PREEMPTION ) &&rcu_preempt_depth ()) +return true; +if (!IS_ENABLED (CONFIG_PREEMPT_COUNT )) +return true; +return !preemptible (); +} +static void z_erofs_decompress_kickoff (struct z_erofs_decompressqueue *io,int bios) {
@@ -1444,8 +1454,7 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io,if (atomic_add_return (bios, &io->pending_bios))return ; -/* Use (kthread_)work and sync decompression for atomic contexts only */ -if (!in_task () ||irqs_disabled () ||rcu_read_lock_any_held ()) { +if (z_erofs_in_atomic ()) {#ifdef CONFIG_EROFS_FS_PCPU_KTHREAD struct kthread_worker *worker;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 25/142 io_uring/io-wq: add check free worker before create new worker
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fengnan Chang <[email protected]>
[ Upstream commit 9d83e1f05c98bab5de350bef89177e2be8b34db0 ]
After commit 0b2b066f8a85 ("io_uring/io-wq: only create a new worker if it can make progress"), in our produce environment, we still observe that part of io_worker threads keeps creating and destroying. After analysis, it was confirmed that this was due to a more complex scenario involving a large number of fsync operations, which can be abstracted as frequent write + fsync operations on multiple files in a single uring instance. Since write is a hash operation while fsync is not, and fsync is likely to be suspended during execution, the action of checking the hash value inio_wqe_dec_running cannot handle such scenarios. Similarly, if hash-based work and non-hash-based work are sent at the same time, similar issues are likely to occur.
Returning to the starting point of the issue, when a new work arrives, io_wq_enqueue may wake up free worker A, while io_wq_dec_running may create worker B. Ultimately, only one of A and B can obtain and process the task, leaving the other in an idle state. In the end, the issue is caused by inconsistent logic in the checks performed by io_wq_enqueue and io_wq_dec_running. Therefore, the problem can be resolved by checking for available workers in io_wq_dec_running.
--- io_uring/io-wq.c | 8 ++++++++ 1 file changed, 8 insertions(+)
io_uring/io-wq.c +8 -0
@@ -357,6 +357,13 @@ static void create_worker_cb(struct call worker = container_of(cb, struct io_worker, create_work); wq = worker->wq; acct = worker->acct; + +rcu_read_lock (); + do_create = !io_acct_activate_free_worker (acct); +rcu_read_unlock (); +if (!do_create) + goto no_need_create; +raw_spin_lock (&acct->workers_lock);if (acct->nr_workers < acct->max_workers) {
@@ -367,6 +374,7 @@ static void create_worker_cb(struct callif (do_create) {create_io_worker (wq, acct); }else { +no_need_create:atomic_dec (&acct->nr_running);io_worker_ref_put (wq); }
Greg Kroah-Hartman
maintainerPATCH 3/142 rtla: Check pkg-config install
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Chen <[email protected]>
[ Upstream commit 7b128f1d53dcaa324d4aa05d821a6bf4a7b203e7 ]
The tool pkg-config used to check libtraceevent and libtracefs, if not installed, it will report the libs not found, even though they have already been installed.
Before:
libtraceevent is missing. Please install libtraceevent-dev/libtraceevent-devel libtracefs is missing. Please install libtracefs-dev/libtracefs-devel
After:
Makefile.config:10: *** Error: pkg-config needed by libtraceevent/libtracefs is missing on this system, please install it.
--- tools/tracing/rtla/Makefile.config | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/tracing/rtla/Makefile.config +8 -0
@@ -1,10 +1,18 @@ # SPDX-License-Identifier: GPL-2.0-only +include $(srctree)/tools/scripts/utilities.mak + STOP_ERROR := LIBTRACEEVENT_MIN_VERSION = 1.5 LIBTRACEFS_MIN_VERSION = 1.6 +ifndef ($(NO_LIBTRACEEVENT),1) + ifeq ($(call get-executable,$(PKG_CONFIG)),) + $(error Error: $(PKG_CONFIG) needed by libtraceevent/libtracefs is missing on this system, please install it) + endif +endif + define lib_setup $(eval LIB_INCLUDES += $(shell sh -c "$(PKG_CONFIG) --cflags lib$(1)")) $(eval LDFLAGS += $(shell sh -c "$(PKG_CONFIG) --libs-only-L lib$(1)"))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 4/142 trace/fgraph: Fix the warning caused by missing unregister notifier
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Weihua <[email protected]>
[ Upstream commit edede7a6dcd7435395cf757d053974aaab6ab1c2 ]
This warning was triggered during testing on v6.16:
notifier callback ftrace_suspend_notifier_call already registered
WARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: <TASK> blocking_notifier_chain_register+0x34/0x60 register_ftrace_graph+0x330/0x410 ftrace_profile_write+0x1e9/0x340 vfs_write+0xf8/0x420 ? filp_flush+0x8a/0xa0 ? filp_close+0x1f/0x30 ? do_dup2+0xaf/0x160 ksys_write+0x65/0xe0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f
When writing to the function_profile_enabled interface, the notifier was not unregistered after start_graph_tracing failed, causing a warning the next time function_profile_enabled was written.
Fixed by adding unregister_pm_notifier in the exception path.
--- kernel/trace/fgraph.c | 1 + 1 file changed, 1 insertion(+)
kernel/trace/fgraph.c +1 -0
@@ -1393,6 +1393,7 @@ int register_ftrace_graph(struct fgraph_ops *gops) ftrace_graph_active--; gops->saved_func =NULL ;fgraph_lru_release_index (i); +unregister_pm_notifier (&ftrace_suspend_notifier); }return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 5/142 of: dynamic: Fix memleak when of_pci_add_properties() failed
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <[email protected]>
[ Upstream commit c81f6ce16785cc07ae81f53deb07b662ed0bb3a5 ]
When of_pci_add_properties() failed, of_changeset_destroy() is called to free the changeset. And of_changeset_destroy() puts device tree node in each entry but does not free property in the entry. This leads to memory leak in the failure case.
In of_changeset_add_prop_helper(), add the property to the device tree node deadprops list. Thus, the property will also be freed along with device tree node.
--- drivers/of/dynamic.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/of/dynamic.c +3 -0
@@ -938,6 +938,9 @@ static int of_changeset_add_prop_helper(struct of_changeset *ocs,if (ret)__of_prop_free (new_pp); + new_pp->next = np->deadprops; + np->deadprops = new_pp; +return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 6/142 of: reserved_mem: Add missing IORESOURCE_MEM flag on resources
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <[email protected]>
[ Upstream commit aea70964b5a7ca491a3701f2dde6c9d05d51878d ]
Commit f4fcfdda2fd8 ('of: reserved_mem: Add functions to parse "memory-region"') failed to set IORESOURCE_MEM flag on the resources. The result is functions such as devm_ioremap_resource_wc() will fail. Add the missing flag.
--- drivers/of/of_reserved_mem.c | 1 + 1 file changed, 1 insertion(+)
drivers/of/of_reserved_mem.c +1 -0
@@ -771,6 +771,7 @@ int of_reserved_mem_region_to_resource(const struct device_node *np,return -EINVAL ;resource_set_range (res, rmem->base, rmem->size); + res->flags =IORESOURCE_MEM ; res->name = rmem->name;return 0 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 7/142 pinctrl: STMFX: add missing HAS_IOMEM dependency
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit a12946bef0407cf2db0899c83d42c47c00af3fbc ]
When building on ARCH=um (which does not set HAS_IOMEM), kconfig reports an unmet dependency caused by PINCTRL_STMFX. It selects MFD_STMFX, which depends on HAS_IOMEM. To stop this warning, PINCTRL_STMFX should also depend on HAS_IOMEM.
kconfig warning:
WARNING: unmet direct dependencies detected for MFD_STMFX
Depends on [n]: HAS_IOMEM [=n] && I2C [=y] && OF [=y] Selected by [y]:
- PINCTRL_STMFX [=y] && PINCTRL [=y] && I2C [=y] && OF_GPIO [=y]
--- drivers/pinctrl/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/Kconfig +1 -0
@@ -527,6 +527,7 @@ config PINCTRL_STMFX tristate "STMicroelectronics STMFX GPIO expander pinctrl driver" depends on I2C depends on OF_GPIO + depends on HAS_IOMEM select GENERIC_PINCONF select GPIOLIB_IRQCHIP select MFD_STMFX
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 8/142 pinctrl: airoha: Fix return value in pinconf callbacks
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <[email protected]>
[ Upstream commit 563fcd6475931c5c8c652a4dd548256314cc87ed ]
Pinctrl stack requires ENOTSUPP error code if the parameter is not supported by the pinctrl driver. Fix the returned error code in pinconf callbacks if the operation is not supported.
--- drivers/pinctrl/mediatek/pinctrl-airoha.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pinctrl/mediatek/pinctrl-airoha.c +4 -4
@@ -2696,7 +2696,7 @@ static int airoha_pinconf_get(struct pinctrl_dev *pctrl_dev, arg =1 ;break ;default : -return -EOPNOTSUPP ; +return -ENOTSUPP ; } *config =pinconf_to_config_packed (param, arg);
@@ -2788,7 +2788,7 @@ static int airoha_pinconf_set(struct pinctrl_dev *pctrl_dev,break ; }default : -return -EOPNOTSUPP ; +return -ENOTSUPP ; } }
@@ -2805,10 +2805,10 @@ static int airoha_pinconf_group_get(struct pinctrl_dev *pctrl_dev,if (airoha_pinconf_get (pctrl_dev, airoha_pinctrl_groups[group].pins[i], config)) -return -EOPNOTSUPP ; +return -ENOTSUPP ;if (i && cur_config != *config) -return -EOPNOTSUPP ; +return -ENOTSUPP ; cur_config = *config; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 9/142 mips: dts: lantiq: danube: add missing burst length property
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 7b28232921782aa38048249132899c337405eaa8 ]
The upstream dts lacks the lantiq,{rx/tx}-burst-length property. Other
issues were also fixed:arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'interrupt-names' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'lantiq,tx-burst-length' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'lantiq,rx-burst-length' is a required property
from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml#
--- arch/mips/boot/dts/lantiq/danube_easy50712.dts | 3 +++ 1 file changed, 3 insertions(+)
arch/mips/boot/dts/lantiq/danube_easy50712.dts +3 -0
@@ -87,8 +87,11 @@ etop@e180000 { reg = <0xe180000 0x40000>; interrupt-parent = <&icu0>; interrupts = <73 78>; + interrupt-names = "tx", "rx"; phy-mode = "rmii"; mac-address = [ 00 11 22 33 44 55 ]; + lantiq,rx-burst-length = <4>; + lantiq,tx-burst-length = <4>; }; stp0: stp@e100bb0 {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainercover 6.16.5-rc1 review
This is the start of the stable review cycle for the 6.16.5 release. There are 142 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 04 Sep 2025 13:19:14 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.16.5-rc1
Mason Chang <[email protected]>
thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
Mason Chang <[email protected]>
thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data
Mason Chang <[email protected]>
thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const
Imre Deak <[email protected]>
Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
Bartosz Golaszewski <[email protected]>
firmware: qcom: scm: request the waitqueue irq *after* initializing SCM
Bartosz Golaszewski <[email protected]>
firmware: qcom: scm: initialize tzmem before marking SCM as available
Bartosz Golaszewski <[email protected]>
firmware: qcom: scm: take struct device as argument in SHM bridge enable
Bartosz Golaszewski <[email protected]>
firmware: qcom: scm: remove unused arguments from SHM bridge routines
Eric Dumazet <[email protected]>
net: rose: fix a typo in rose_clear_routes()
Alex Deucher <[email protected]>
drm/amdgpu/gfx12: set MQD as appriopriate for queue types
Alex Deucher <[email protected]>
drm/amdgpu/gfx11: set MQD as appriopriate for queue types
Jesse.Zhang <[email protected]>
drm/amdgpu: update firmware version checks for user queue support
Alex Deucher <[email protected]>
drm/amdgpu/userq: fix error handling of invalid doorbell
Yang Wang <[email protected]>
drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
Ma Ke <[email protected]>
drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
Nathan Chancellor <[email protected]>
drm/msm/dpu: Initialize crtc_state to NULL in dpu_plane_virtual_atomic_check()
Timur Tabi <[email protected]>
drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
James Jones <[email protected]>
drm/nouveau/disp: Always accept linear modifier
Thomas Hellström <[email protected]>
drm/xe/vm: Clear the scratch_pt pointer on error
Eric Sandeen <[email protected]>
xfs: do not propagate ENODATA disk errors into xattr code
Steve French <[email protected]>
smb3 client: fix return code mapping of remap_file_range
Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
Shuhao Fu <[email protected]>
fs/smb: Fix inconsistent refcnt update
Shanker Donthineni <[email protected]>
dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
Bart Van Assche <[email protected]>
blk-zoned: Fix a lockdep complaint about recursive locking
Kees Cook <[email protected]>
arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature
Alex Deucher <[email protected]>
Revert "drm/amdgpu: fix incorrect vm flags to map bo"
Minjong Kim <[email protected]>
HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
Ping Cheng <[email protected]>
HID: wacom: Add a new Art Pen 2
Matt Coffin <[email protected]>
HID: logitech: Add ids for G PRO 2 LIGHTSPEED
Antheas Kapenekakis <[email protected]>
HID: quirks: add support for Legion Go dual dinput modes
Martin Hilgendorf <[email protected]>
HID: elecom: add support for ELECOM M-DT2DRBK
Qasim Ijaz <[email protected]>
HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
Qasim Ijaz <[email protected]>
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
K Prateek Nayak <[email protected]>
x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Handle the case of no BIOS microcode
Suchit Karunakaran <[email protected]>
x86/cpu/intel: Fix the constant_tsc model check for Pentium 4
Radim Krčmář <[email protected]>
RISC-V: KVM: fix stack overrun when loading vlenb
Thijs Raymakers <[email protected]>
KVM: x86: use array_index_nospec with indices that come from guest
Louis-Alexis Eyraud <[email protected]>
drm/mediatek: mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls
Jens Axboe <[email protected]>
io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
Neil Mandir <[email protected]>
net: macb: Disable clocks once
Li Nan <[email protected]>
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
Alexander Duyck <[email protected]>
fbnic: Move phylink resume out of service_task and into open/close
Eric Dumazet <[email protected]>
l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
Eric Dumazet <[email protected]>
sctp: initialize more fields in sctp_v6_from_sk()
Takamitsu Iwai <[email protected]>
net: rose: include node references in rose_neigh refcount
Takamitsu Iwai <[email protected]>
net: rose: convert 'use' field to refcount_t
Takamitsu Iwai <[email protected]>
net: rose: split remove and free operations in rose_remove_neigh()
Qingyue Zhang <[email protected]>
io_uring/kbuf: fix signedness in this_len calculation
Dipayaan Roy <[email protected]>
net: hv_netvsc: fix loss of early receive events from host during channel open.
Rohan G Thomas <[email protected]>
net: stmmac: Set CIC bit only for TX queues with COE
Rohan G Thomas <[email protected]>
net: stmmac: xgmac: Correct supported speed modes
Rohan G Thomas <[email protected]>
net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
Alexei Lazar <[email protected]>
net/mlx5e: Set local Xoff after FW update
Alexei Lazar <[email protected]>
net/mlx5e: Update and set Xon/Xoff upon port speed set
Alexei Lazar <[email protected]>
net/mlx5e: Update and set Xon/Xoff upon MTU set
Moshe Shemesh <[email protected]>
net/mlx5: Prevent flow steering mode changes in switchdev mode
Moshe Shemesh <[email protected]>
net/mlx5: Nack sync reset when SFs are present
Moshe Shemesh <[email protected]>
net/mlx5: Fix lockdep assertion on sync reset unload event
Moshe Shemesh <[email protected]>
net/mlx5: Reload auxiliary drivers on fw_activate
Lama Kayal <[email protected]>
net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path
Lama Kayal <[email protected]>
net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow
Lama Kayal <[email protected]>
net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow
Lama Kayal <[email protected]>
net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path
Michael Chan <[email protected]>
bnxt_en: Fix stats context reservation logic
Michael Chan <[email protected]>
bnxt_en: Adjust TX rings if reservation is less than requested
Sreekanth Reddy <[email protected]>
bnxt_en: Fix memory corruption when FW resources change during ifdown
Sean Anderson <[email protected]>
net: macb: Fix offset error in gem_update_stats
Horatiu Vultur <[email protected]>
phy: mscc: Fix when PTP clock is register and unregister
Nilay Shroff <[email protected]>
block: validate QoS before calling __rq_qos_done_bio()
Matthew Brost <[email protected]>
drm/xe: Don't trigger rebind on initial dma-buf validation
Thomas Hellström <[email protected]>
drm/xe/vm: Don't pin the vm_resv during validation
Zbigniew Kempczyński <[email protected]>
drm/xe/xe_sync: avoid race during ufence signaling
Jan Kiszka <[email protected]>
efi: stmm: Fix incorrect buffer allocation method
Yeounsu Moon <[email protected]>
net: dlink: fix multicast stats being counted incorrectly
Vladimir Riabchun <[email protected]>
mISDN: hfcpci: Fix warning when deleting uninitialized timer
Hariprasad Kelam <[email protected]>
Octeontx2-af: Fix NIX X2P calibration failures
Subbaraya Sundeep <[email protected]>
octeontx2: Set appropriate PF, VF masks and shifts based on silicon
Chenyuan Yang <[email protected]>
drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset
Dmitry Baryshkov <[email protected]>
dt-bindings: display/msm: qcom,mdp5: drop lut clock
Jedrzej Jagielski <[email protected]>
ixgbe: fix ixgbe_orom_civd_info struct layout
Michal Kubiak <[email protected]>
ice: fix incorrect counter for buffer allocation failures
Jacob Keller <[email protected]>
ice: use fixed adapter index for E825C embedded devices
Jacob Keller <[email protected]>
ice: don't leave device non-functional if Tx scheduler config fails
Emil Tantilov <[email protected]>
ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset
Timur Tabi <[email protected]>
drm/nouveau: remove unused memory target test
Timur Tabi <[email protected]>
drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
Kuniyuki Iwashima <[email protected]>
atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
Hariprasad Kelam <[email protected]>
Octeontx2-vf: Fix max packet length errors
Mina Almasry <[email protected]>
page_pool: fix incorrect mp_ops error handling
Pavel Shpakovskiy <[email protected]>
Bluetooth: hci_sync: fix set_local_name race condition
Yang Li <[email protected]>
Bluetooth: hci_event: Disconnect device when BIG sync is lost
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
Ludovico de Nittis <[email protected]>
Bluetooth: hci_event: Mark connection as closed during suspend disconnect
Ludovico de Nittis <[email protected]>
Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_conn: Make unacked packet handling more robust
luoguangfei <[email protected]>
net: macb: fix unregister_netdev call order in macb_remove()
Joshua Hay <[email protected]>
idpf: stop Tx if there are insufficient buffer resources
Joshua Hay <[email protected]>
idpf: replace flow scheduling buffer ring with buffer pool
Joshua Hay <[email protected]>
idpf: simplify and fix splitq Tx packet rollback error path
Joshua Hay <[email protected]>
idpf: add support for Tx refillqs in flow scheduling mode
José Expósito <[email protected]>
HID: input: report battery status changes immediately
José Expósito <[email protected]>
HID: input: rename hidinput_set_battery_charge_status()
Madhavan Srinivasan <[email protected]>
powerpc/kvm: Fix ifdef to remove build warning
Jason-JH Lin <[email protected]>
drm/mediatek: Add error handling for old state CRTC in atomic_disable
Ayushi Makhija <[email protected]>
drm/msm: update the high bitfield of certain DSI registers
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: correct dpu_plane_virtual_atomic_check()
Dmitry Baryshkov <[email protected]>
drm/msm/kms: move snapshot init earlier in KMS init
Even Xu <[email protected]>
HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow
Aaron Ma <[email protected]>
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Aaron Ma <[email protected]>
HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
Oreoluwa Babatunde <[email protected]>
of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
Rob Clark <[email protected]>
drm/msm: Defer fd_install in SUBMIT ioctl
Oscar Maes <[email protected]>
net: ipv4: fix regression in local-broadcast routes
Nikolay Kuratov <[email protected]>
vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
Dongcheng Yan <[email protected]>
platform/x86: int3472: add hpd pin support
Fengnan Chang <[email protected]>
io_uring/io-wq: add check free worker before create new worker
Junli Liu <[email protected]>
erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
Yuezhang Mo <[email protected]>
erofs: Fallback to normal access if DAX is not supported on extra device
Shuming Fan <[email protected]>
ASoC: rt1320: fix random cycle mute issue
Shuming Fan <[email protected]>
ASoC: rt721: fix FU33 Boost Volume control not working
Alexey Klimov <[email protected]>
ASoC: codecs: tx-macro: correct tx_macro_component_drv name
Paulo Alcantara <[email protected]>
smb: client: fix race with concurrent opens in rename(2)
Paulo Alcantara <[email protected]>
smb: client: fix race with concurrent opens in unlink(2)
Damien Le Moal <[email protected]>
scsi: core: sysfs: Correct sysfs attributes access rights
Namhyung Kim <[email protected]>
vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
Igor Torrente <[email protected]>
Revert "virtio: reject shm region if length is zero"
Ian Rogers <[email protected]>
perf symbol-minimal: Fix ehdr reading in filename__read_build_id
Tengda Wu <[email protected]>
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
Steven Rostedt <[email protected]>
fgraph: Copy args in intermediate storage with entry
Dan Carpenter <[email protected]>
of: dynamic: Fix use after free in of_changeset_add_prop_helper()
Aleksander Jan Bajkowski <[email protected]>
mips: lantiq: xway: sysctrl: rename the etop node
Aleksander Jan Bajkowski <[email protected]>
mips: dts: lantiq: danube: add missing burst length property
Lorenzo Bianconi <[email protected]>
pinctrl: airoha: Fix return value in pinconf callbacks
Randy Dunlap <[email protected]>
pinctrl: STMFX: add missing HAS_IOMEM dependency
Rob Herring (Arm) <[email protected]>
of: reserved_mem: Add missing IORESOURCE_MEM flag on resources
Lizhi Hou <[email protected]>
of: dynamic: Fix memleak when of_pci_add_properties() failed
Ye Weihua <[email protected]>
trace/fgraph: Fix the warning caused by missing unregister notifier
Tao Chen <[email protected]>
rtla: Check pkg-config install
Tao Chen <[email protected]>
tools/latency-collector: Check pkg-config install
Yunseong Kim <[email protected]>
perf: Avoid undefined behavior from stopping/starting inactive events
-------------
Diffstat:
.../devicetree/bindings/display/msm/qcom,mdp5.yaml | 1 - Makefile | 4 +- arch/arm64/include/asm/mmu.h | 7 + arch/arm64/kernel/cpufeature.c | 5 +- arch/arm64/mm/mmu.c | 7 - arch/mips/boot/dts/lantiq/danube_easy50712.dts | 5 +- arch/mips/lantiq/xway/sysctrl.c | 10 +- arch/powerpc/kernel/kvm.c | 8 +- arch/riscv/kvm/vcpu_vector.c | 2 + arch/x86/kernel/cpu/intel.c | 2 +- arch/x86/kernel/cpu/microcode/amd.c | 22 +- arch/x86/kernel/cpu/topology_amd.c | 27 +- arch/x86/kvm/lapic.c | 2 + arch/x86/kvm/x86.c | 7 +- block/blk-rq-qos.h | 13 +- block/blk-zoned.c | 11 +- drivers/atm/atmtcp.c | 17 +- drivers/crypto/marvell/octeontx2/otx2_cpt_common.h | 5 +- drivers/crypto/marvell/octeontx2/otx2_cptpf_mbox.c | 13 +- .../crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 4 +- drivers/crypto/marvell/octeontx2/otx2_cptvf_mbox.c | 6 +- drivers/firmware/efi/stmm/tee_stmm_efi.c | 21 +- drivers/firmware/qcom/qcom_scm.c | 95 +++-- drivers/firmware/qcom/qcom_scm.h | 1 + drivers/firmware/qcom/qcom_tzmem.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 1 + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 14 +- drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 8 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 18 +- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 21 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 +- drivers/gpu/drm/mediatek/mtk_plane.c | 3 +- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 +- drivers/gpu/drm/msm/msm_gem_submit.c | 14 +- drivers/gpu/drm/msm/msm_kms.c | 10 +- drivers/gpu/drm/msm/registers/display/dsi.xml | 28 +- drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 + drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 15 +- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 5 +- drivers/gpu/drm/xe/xe_bo.c | 8 +- drivers/gpu/drm/xe/xe_sync.c | 2 +- drivers/gpu/drm/xe/xe_vm.c | 8 +- drivers/gpu/drm/xe/xe_vm.h | 15 +- drivers/hid/hid-asus.c | 8 +- drivers/hid/hid-elecom.c | 2 + drivers/hid/hid-ids.h | 4 + drivers/hid/hid-input-test.c | 10 +- drivers/hid/hid-input.c | 51 ++- drivers/hid/hid-logitech-dj.c | 4 + drivers/hid/hid-logitech-hidpp.c | 2 + drivers/hid/hid-multitouch.c | 8 + drivers/hid/hid-ntrig.c | 3 + drivers/hid/hid-quirks.c | 3 + .../intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + .../intel-thc-hid/intel-quicki2c/quicki2c-dev.h | 2 + .../hid/intel-thc-hid/intel-thc/intel-thc-dev.c | 4 +- drivers/hid/wacom_wac.c | 1 + drivers/isdn/hardware/mISDN/hfcpci.c | 12 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 36 +- drivers/net/ethernet/cadence/macb_main.c | 11 +- drivers/net/ethernet/dlink/dl2k.c | 2 +- drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_adapter.c | 49 ++- drivers/net/ethernet/intel/ice/ice_adapter.h | 4 +- drivers/net/ethernet/intel/ice/ice_ddp.c | 44 ++- drivers/net/ethernet/intel/ice/ice_idc.c | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 16 +- drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- .../net/ethernet/intel/idpf/idpf_singleq_txrx.c | 61 ++- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 411 ++++++++++++--------- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 38 +- drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_type_e610.h | 2 +- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 + .../net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 6 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 30 +- drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 66 +++- .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 68 ++-- .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 4 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 22 +- .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 54 +-- .../net/ethernet/marvell/octeontx2/af/rvu_npc.c | 8 +- .../ethernet/marvell/octeontx2/af/rvu_npc_hash.c | 16 +- .../ethernet/marvell/octeontx2/af/rvu_npc_hash.h | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu_rep.c | 13 +- .../net/ethernet/marvell/octeontx2/af/rvu_sdp.c | 10 +- .../net/ethernet/marvell/octeontx2/af/rvu_switch.c | 8 +- .../ethernet/marvell/octeontx2/nic/cn10k_ipsec.c | 2 +- .../ethernet/marvell/octeontx2/nic/cn10k_ipsec.h | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 4 +- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 12 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 24 +- .../net/ethernet/marvell/octeontx2/nic/otx2_reg.h | 30 -- .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 3 +- .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 10 + drivers/net/ethernet/marvell/octeontx2/nic/rep.c | 20 +- drivers/net/ethernet/marvell/octeontx2/nic/rep.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 +- .../ethernet/mellanox/mlx5/core/en/port_buffer.h | 12 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 19 +- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 15 +- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 132 ++++--- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h | 1 + .../net/ethernet/mellanox/mlx5/core/sf/devlink.c | 10 + drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 6 + .../mellanox/mlx5/core/steering/hws/action.c | 2 +- .../mellanox/mlx5/core/steering/hws/pat_arg.c | 6 +- .../mellanox/mlx5/core/steering/hws/pool.c | 1 + drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 + drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 - .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 13 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 9 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +- drivers/net/hyperv/netvsc.c | 17 +- drivers/net/hyperv/rndis_filter.c | 23 +- drivers/net/phy/mscc/mscc.h | 4 + drivers/net/phy/mscc/mscc_main.c | 4 +- drivers/net/phy/mscc/mscc_ptp.c | 34 +- drivers/net/usb/qmi_wwan.c | 3 + drivers/of/dynamic.c | 9 +- drivers/of/of_reserved_mem.c | 17 +- drivers/pinctrl/Kconfig | 1 + drivers/pinctrl/mediatek/pinctrl-airoha.c | 8 +- drivers/platform/x86/intel/int3472/discrete.c | 6 + drivers/scsi/scsi_sysfs.c | 4 +- drivers/thermal/mediatek/lvts_thermal.c | 74 +++- drivers/vhost/net.c | 9 +- fs/efivarfs/super.c | 4 + fs/erofs/super.c | 24 +- fs/erofs/zdata.c | 13 +- fs/smb/client/cifsfs.c | 14 + fs/smb/client/inode.c | 34 +- fs/smb/client/smb2inode.c | 7 +- fs/xfs/libxfs/xfs_attr_remote.c | 7 + fs/xfs/libxfs/xfs_da_btree.c | 6 + include/linux/atmdev.h | 1 + include/linux/dma-map-ops.h | 3 + include/linux/firmware/qcom/qcom_scm.h | 5 +- include/linux/platform_data/x86/int3472.h | 1 + include/linux/soc/marvell/silicons.h | 25 ++ include/linux/virtio_config.h | 2 - include/net/bluetooth/hci_sync.h | 2 +- include/net/rose.h | 18 +- include/uapi/linux/vhost.h | 4 +- io_uring/io-wq.c | 8 + io_uring/kbuf.c | 20 +- kernel/dma/contiguous.c | 2 - kernel/dma/pool.c | 4 +- kernel/events/core.c | 6 + kernel/trace/fgraph.c | 1 + kernel/trace/trace.c | 4 +- kernel/trace/trace_functions_graph.c | 22 +- net/atm/common.c | 15 +- net/bluetooth/hci_conn.c | 58 ++- net/bluetooth/hci_event.c | 25 +- net/bluetooth/hci_sync.c | 6 +- net/bluetooth/mgmt.c | 9 +- net/core/page_pool.c | 6 +- net/ipv4/route.c | 10 +- net/l2tp/l2tp_ppp.c | 25 +- net/rose/af_rose.c | 13 +- net/rose/rose_in.c | 12 +- net/rose/rose_route.c | 62 ++-- net/rose/rose_timer.c | 2 +- net/sctp/ipv6.c | 2 + sound/soc/codecs/lpass-tx-macro.c | 2 +- sound/soc/codecs/rt1320-sdw.c | 3 +- sound/soc/codecs/rt721-sdca.c | 2 + sound/soc/codecs/rt721-sdca.h | 4 + tools/perf/util/symbol-minimal.c | 55 ++- tools/tracing/latency/Makefile.config | 8 + tools/tracing/rtla/Makefile.config | 8 + 177 files changed, 1765 insertions(+), 987 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 27/142 vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Kuratov <[email protected]>
commit dd54bcf86c91a4455b1f95cbc8e9ac91205f3193 upstream.
When operating on struct vhost_net_ubuf_ref, the following execution sequence is theoretically possible:
CPU0 is finalizing DMA operation CPU1 is doing VHOST_NET_SET_BACKEND
// ubufs->refcount == 2
vhost_net_ubuf_put() vhost_net_ubuf_put_wait_and_free(oldubufs)
vhost_net_ubuf_put_and_wait()
vhost_net_ubuf_put()
int r = atomic_sub_return(1, &ubufs->refcount);
// r = 1
int r = atomic_sub_return(1, &ubufs->refcount);
// r = 0
wait_event(ubufs->wait, !atomic_read(&ubufs->refcount));
// no wait occurs here because condition is already true
kfree(ubufs);if (unlikely(!r))
wake_up(&ubufs->wait); // use-after-free
This leads to use-after-free on ubufs access. This happens because CPU1 skips waiting for wake_up() when refcount is already zero.
To prevent that use a read-side RCU critical section in vhost_net_ubuf_put(), as suggested by Hillf Danton. For this lock to take effect, free ubufs with kfree_rcu().
Message-Id: <[email protected]>
--- drivers/vhost/net.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/vhost/net.c +7 -2
@@ -96,6 +96,7 @@ struct vhost_net_ubuf_ref {atomic_t refcount;wait_queue_head_t wait;struct vhost_virtqueue *vq; +struct rcu_head rcu; };#define VHOST_NET_BATCH 64
@@ -247,9 +248,13 @@ vhost_net_ubuf_alloc(struct vhost_virtqustatic int vhost_net_ubuf_put (struct vhost_net_ubuf_ref *ubufs) { -int r =atomic_sub_return (1 , &ubufs->refcount); +int r; + +rcu_read_lock (); + r =atomic_sub_return (1 , &ubufs->refcount);if (unlikely (!r))wake_up (&ubufs->wait); +rcu_read_unlock ();return r; }
@@ -262,7 +267,7 @@ static void vhost_net_ubuf_put_and_wait(static void vhost_net_ubuf_put_wait_and_free (struct vhost_net_ubuf_ref *ubufs) {vhost_net_ubuf_put_and_wait (ubufs); -kfree (ubufs); +kfree_rcu (ubufs, rcu); }static void vhost_net_clear_ubuf_info (struct vhost_net *n)
Greg Kroah-Hartman
maintainerPATCH 36/142 drm/msm: update the high bitfield of certain DSI registers
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ayushi Makhija <[email protected]>
[ Upstream commit 494045c561e68945b1183ff416b8db8e37a122d6 ]
Currently, the high bitfield of certain DSI registers do not align with the configuration of the SWI registers description. This can lead to wrong programming these DSI registers, for example for 4k resloution where H_TOTAL is taking 13 bits but software is programming only 12 bits because of the incorrect bitmask for H_TOTAL bitfeild, this is causing DSI FIFO errors. To resolve this issue, increase the high bitfield of the DSI registers from 12 bits to 16 bits in dsi.xml to match the SWI register configuration.
Patchwork: https://patchwork.freedesktop.org/patch/666229/
--- drivers/gpu/drm/msm/registers/display/dsi.xml | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/gpu/drm/msm/registers/display/dsi.xml +14 -14
@@ -159,28 +159,28 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd"> <bitfield name="RGB_SWAP" low="12" high="14" type="dsi_rgb_swap"/> </reg32> <reg32 offset="0x00020" name="ACTIVE_H"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00024" name="ACTIVE_V"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00028" name="TOTAL"> - <bitfield name="H_TOTAL" low="0" high="11" type="uint"/> - <bitfield name="V_TOTAL" low="16" high="27" type="uint"/> + <bitfield name="H_TOTAL" low="0" high="15" type="uint"/> + <bitfield name="V_TOTAL" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x0002c" name="ACTIVE_HSYNC"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00030" name="ACTIVE_VSYNC_HPOS"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00034" name="ACTIVE_VSYNC_VPOS"> - <bitfield name="START" low="0" high="11" type="uint"/> - <bitfield name="END" low="16" high="27" type="uint"/> + <bitfield name="START" low="0" high="15" type="uint"/> + <bitfield name="END" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00038" name="CMD_DMA_CTRL">
@@ -209,8 +209,8 @@ xsi:schemaLocation="https://gitlab.freedesktop.org/freedreno/ rules-fd.xsd"> <bitfield name="WORD_COUNT" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x00058" name="CMD_MDP_STREAM0_TOTAL"> - <bitfield name="H_TOTAL" low="0" high="11" type="uint"/> - <bitfield name="V_TOTAL" low="16" high="27" type="uint"/> + <bitfield name="H_TOTAL" low="0" high="15" type="uint"/> + <bitfield name="V_TOTAL" low="16" high="31" type="uint"/> </reg32> <reg32 offset="0x0005c" name="CMD_MDP_STREAM1_CTRL"> <bitfield name="DATA_TYPE" low="0" high="5" type="uint"/>
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 37/142 drm/mediatek: Add error handling for old state CRTC in atomic_disable
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason-JH Lin <[email protected]>
[ Upstream commit 0c6b24d70da21201ed009a2aca740d2dfddc7ab5 ]
Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL old_state->crtc.
E,g.
Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtk_crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_helper_commit_tail_rpm+0x4c/0x158 commit_tail+0xa0/0x168 drm_atomic_helper_commit+0x110/0x120 drm_atomic_commit+0x8c/0xe0 drm_atomic_helper_update_plane+0xd4/0x128 __setplane_atomic+0xcc/0x110 drm_mode_cursor_common+0x250/0x440 drm_mode_cursor_ioctl+0x44/0x70 drm_ioctl+0x264/0x5d8 __arm64_sys_ioctl+0xd8/0x510 invoke_syscall+0x6c/0xe0 do_el0_svc+0x68/0xe8 el0_svc+0x34/0x60 el0t_64_sync_handler+0x1c/0xf8 el0t_64_sync+0x180/0x188
Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state.
--- drivers/gpu/drm/mediatek/mtk_plane.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/mediatek/mtk_plane.c +2 -1
@@ -292,7 +292,8 @@ static void mtk_plane_atomic_disable(struct drm_plane *plane,wmb ();/* Make sure the above parameter is set before update */ mtk_plane_state->pending.dirty = true; -mtk_crtc_plane_disable (old_state->crtc, plane); +if (old_state && old_state->crtc) +mtk_crtc_plane_disable (old_state->crtc, plane); } static void mtk_plane_atomic_update(struct drm_plane *plane,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 38/142 powerpc/kvm: Fix ifdef to remove build warning
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhavan Srinivasan <[email protected]>
[ Upstream commit 88688a2c8ac6c8036d983ad8b34ce191c46a10aa ]
When compiling for pseries or powernv defconfig with "make C=1", these warning were reported bu sparse tool in powerpc/kernel/kvm.c
arch/powerpc/kernel/kvm.c:635:9: warning: switch with no cases arch/powerpc/kernel/kvm.c:646:9: warning: switch with no cases
Currently #ifdef were added after the switch case which are specific for BOOKE and PPC_BOOK3S_32. These are not enabled in pseries/powernv defconfig. Fix it by moving the #ifdef before switch(){}
--- arch/powerpc/kernel/kvm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/kernel/kvm.c +4 -4
@@ -632,19 +632,19 @@ static void __init kvm_check_ins(u32 *inst, u32 features)#endif } -switch (inst_no_rt & ~KVM_MASK_RB ) {#ifdef CONFIG_PPC_BOOK3S_32 +switch (inst_no_rt & ~KVM_MASK_RB ) {case KVM_INST_MTSRIN :if (features &KVM_MAGIC_FEAT_SR ) {u32 inst_rb = _inst &KVM_MASK_RB ;kvm_patch_ins_mtsrin (inst, inst_rt, inst_rb); }break ; -#endif } +#endif -switch (_inst) {#ifdef CONFIG_BOOKE +switch (_inst) {case KVM_INST_WRTEEI_0 :kvm_patch_ins_wrteei_0 (inst);break ;
@@ -652,8 +652,8 @@ static void __init kvm_check_ins(u32 *inst, u32 features)case KVM_INST_WRTEEI_1 :kvm_patch_ins_wrtee (inst,0 ,1 ); break; -#endif } +#endif }extern u32 kvm_template_start[];
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 39/142 HID: input: rename hidinput_set_battery_charge_status()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit a82231b2a8712d0218fc286a9b0da328d419a3f4 ]
In preparation for a patch fixing a bug affecting hidinput_set_battery_charge_status(), rename the function to hidinput_update_battery_charge_status() and move it up so it can be used by hidinput_update_battery().
Refactor, no functional changes.
Stable-dep-of: e94536e1d181 ("HID: input: report battery status changes immediately")
--- drivers/hid/hid-input-test.c | 10 +++++----- drivers/hid/hid-input.c | 38 ++++++++++++++++++------------------ 2 files changed, 24 insertions(+), 24 deletions(-)
drivers/hid/hid-input-test.c +5 -5
@@ -7,7 +7,7 @@#include <kunit/test.h> -static void hid_test_input_set_battery_charge_status (struct kunit *test) +static void hid_test_input_update_battery_charge_status (struct kunit *test) {struct hid_device *dev;bool handled;
@@ -15,15 +15,15 @@ static void hid_test_input_set_battery_charge_status(struct kunit *test) dev =kunit_kzalloc (test,sizeof (*dev),GFP_KERNEL );KUNIT_ASSERT_NOT_ERR_OR_NULL (test, dev); - handled =hidinput_set_battery_charge_status (dev,HID_DG_HEIGHT ,0 ); + handled =hidinput_update_battery_charge_status (dev,HID_DG_HEIGHT ,0 );KUNIT_EXPECT_FALSE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_UNKNOWN ); - handled =hidinput_set_battery_charge_status (dev,HID_BAT_CHARGING ,0 ); + handled =hidinput_update_battery_charge_status (dev,HID_BAT_CHARGING ,0 );KUNIT_EXPECT_TRUE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_DISCHARGING ); - handled =hidinput_set_battery_charge_status (dev,HID_BAT_CHARGING ,1 ); + handled =hidinput_update_battery_charge_status (dev,HID_BAT_CHARGING ,1 );KUNIT_EXPECT_TRUE (test, handled);KUNIT_EXPECT_EQ (test, dev->battery_charge_status,POWER_SUPPLY_STATUS_CHARGING ); }
@@ -63,7 +63,7 @@ static void hid_test_input_get_battery_property(struct kunit *test) }static struct kunit_case hid_input_tests[] = { -KUNIT_CASE (hid_test_input_set_battery_charge_status), +KUNIT_CASE (hid_test_input_update_battery_charge_status),KUNIT_CASE (hid_test_input_get_battery_property), { } };
drivers/hid/hid-input.c +19 -19
@@ -595,6 +595,20 @@ static void hidinput_cleanup_battery(struct hid_device *dev) dev->battery =NULL ; } +static bool hidinput_update_battery_charge_status (struct hid_device *dev, +unsigned int usage,int value) +{ +switch (usage) { +case HID_BAT_CHARGING : + dev->battery_charge_status = value ? +POWER_SUPPLY_STATUS_CHARGING : +POWER_SUPPLY_STATUS_DISCHARGING ; +return true; + } + +return false; +} +static void hidinput_update_battery (struct hid_device *dev,int value) {int capacity;
@@ -617,20 +631,6 @@ static void hidinput_update_battery(struct hid_device *dev, int value) power_supply_changed(dev->battery); } } - -static bool hidinput_set_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) -{ -switch (usage) { -case HID_BAT_CHARGING : - dev->battery_charge_status = value ? -POWER_SUPPLY_STATUS_CHARGING : -POWER_SUPPLY_STATUS_DISCHARGING ; -return true; - } - -return false; -}#else /* !CONFIG_HID_BATTERY_STRENGTH */ static int hidinput_setup_battery (struct hid_device *dev,unsigned report_type,struct hid_field *field,bool is_percentage)
@@ -642,14 +642,14 @@ static void hidinput_cleanup_battery(struct hid_device *dev) { } -static void hidinput_update_battery (struct hid_device *dev,int value) +static bool hidinput_update_battery_charge_status (struct hid_device *dev, +unsigned int usage,int value) { +return false; } -static bool hidinput_set_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) +static void hidinput_update_battery (struct hid_device *dev,int value) { -return false; }#endif /* CONFIG_HID_BATTERY_STRENGTH */
@@ -1515,7 +1515,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, structreturn ;if (usage->type ==EV_PWR ) { -bool handled =hidinput_set_battery_charge_status (hid, usage->hid, value); +bool handled =hidinput_update_battery_charge_status (hid, usage->hid, value);if (!handled)hidinput_update_battery (hid, value);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 40/142 HID: input: report battery status changes immediately
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Expósito <[email protected]>
[ Upstream commit e94536e1d1818b0989aa19b443b7089f50133c35 ]
Previously, the battery status (charging/discharging) was not reported immediately to user-space.
For most input devices, this wasn't problematic because changing their battery status requires connecting them to a different bus. For example, a gamepad would report a discharging status while connected via Bluetooth and a charging status while connected via USB.
However, certain devices are not connected or disconnected when their battery status changes. For example, a phone battery changes its status without connecting or disconnecting it.
In these cases, the battery status was not reported immediately to user space.
Report battery status changes immediately to user space to support these kinds of devices.
--- drivers/hid/hid-input.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
drivers/hid/hid-input.c +10 -13
@@ -609,13 +609,19 @@ static bool hidinput_update_battery_charge_status(struct hid_device *dev,return false; } -static void hidinput_update_battery (struct hid_device *dev,int value) +static void hidinput_update_battery (struct hid_device *dev,unsigned int usage, +int value) {int capacity;if (!dev->battery)return ; +if (hidinput_update_battery_charge_status (dev, usage, value)) { +power_supply_changed (dev->battery); +return ; + } +if (value ==0 || value < dev->battery_min || value > dev->battery_max)return ;
@@ -642,13 +648,8 @@ static void hidinput_cleanup_battery(struct hid_device *dev) { } -static bool hidinput_update_battery_charge_status (struct hid_device *dev, -unsigned int usage,int value) -{ -return false; -} - -static void hidinput_update_battery (struct hid_device *dev,int value) +static void hidinput_update_battery (struct hid_device *dev,unsigned int usage, +int value) { }#endif /* CONFIG_HID_BATTERY_STRENGTH */
@@ -1515,11 +1516,7 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, structreturn ;if (usage->type ==EV_PWR ) { -bool handled =hidinput_update_battery_charge_status (hid, usage->hid, value); - -if (!handled) -hidinput_update_battery (hid, value); - +hidinput_update_battery (hid, usage->hid, value);return ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 41/142 idpf: add support for Tx refillqs in flow scheduling mode
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hay <[email protected]>
[ Upstream commit cb83b559bea39f207ee214ee2972657e8576ed18 ]
In certain production environments, it is possible for completion tags to collide, meaning N packets with the same completion tag are in flight at the same time. In this environment, any given Tx queue is effectively used to send both slower traffic and higher throughput traffic simultaneously. This is the result of a customer's specific configuration in the device pipeline, the details of which Intel cannot provide. This configuration results in a small number of out-of-order completions, i.e., a small number of packets in flight. The existing guardrails in the driver only protect against a large number of packets in flight. The slower flow completions are delayed which causes the out-of-order completions. The fast flow will continue sending traffic and generating tags. Because tags are generated on the fly, the fast flow eventually uses the same tag for a packet that is still in flight from the slower flow. The driver has no idea which packet it should clean when it processes the completion with that tag, but it will look for the packet on the buffer ring before the hash table. If the slower flow packet completion is processed first, it will end up cleaning the fast flow packet on the ring prematurely. This leaves the descriptor ring in a bad state resulting in a crash or Tx timeout.
In summary, generating a tag when a packet is sent can lead to the same tag being associated with multiple packets. This can lead to resource leaks, crashes, and/or Tx timeouts.
Before we can replace the tag generation, we need a new mechanism for the send path to know what tag to use next. The driver will allocate and initialize a refillq for each TxQ with all of the possible free tag values. During send, the driver grabs the next free tag from the refillq from next_to_clean. While cleaning the packet, the clean routine posts the tag back to the refillq's next_to_use to indicate that it is now free to use.
This mechanism works exactly the same way as the existing Rx refill queues, which post the cleaned buffer IDs back to the buffer queue to be reposted to HW. Since we're using the refillqs for both Rx and Tx now, genericize some of the existing refillq support.
Note: the refillqs will not be used yet. This is only demonstrating how they will be used to pass free tags back to the send path.
Stable-dep-of: b61dfa9bc443 ("idpf: simplify and fix splitq Tx packet rollback error path")
--- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 93 +++++++++++++++++++-- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 8 +- 2 files changed, 91 insertions(+), 10 deletions(-)
drivers/net/ethernet/intel/idpf/idpf_txrx.c +86 -7
@@ -139,6 +139,9 @@ static void idpf_tx_desc_rel(struct idpf_tx_queue *txq)if (!txq->desc_ring)return ; +if (txq->refillq) +kfree (txq->refillq->ring); +dmam_free_coherent (txq->dev, txq->size, txq->desc_ring, txq->dma); txq->desc_ring =NULL ; txq->next_to_use =0 ;
@@ -244,6 +247,7 @@ static int idpf_tx_desc_alloc(const struct idpf_vport *vport, struct idpf_tx_queue *tx_q) {struct device *dev = tx_q->dev; +struct idpf_sw_queue *refillq;int err; err =idpf_tx_buf_alloc_all (tx_q);
@@ -267,6 +271,29 @@ static int idpf_tx_desc_alloc(const struct idpf_vport *vport, tx_q->next_to_clean =0 ;idpf_queue_set (GEN_CHK , tx_q); +if (!idpf_queue_has (FLOW_SCH_EN , tx_q)) +return 0 ; + + refillq = tx_q->refillq; + refillq->desc_count = tx_q->desc_count; + refillq->ring =kcalloc (refillq->desc_count,sizeof (u32), +GFP_KERNEL ); +if (!refillq->ring) { + err = -ENOMEM ; + goto err_alloc; + } + +for (unsigned int i =0 ; i < refillq->desc_count; i++) + refillq->ring[i] = +FIELD_PREP (IDPF_RFL_BI_BUFID_M , i) | +FIELD_PREP (IDPF_RFL_BI_GEN_M , +idpf_queue_has (GEN_CHK , refillq)); + +/* Go ahead and flip the GEN bit since this counts as filling +* up the ring, i.e. we already ring wrapped. +*/ +idpf_queue_change (GEN_CHK , refillq); +return 0 ; err_alloc:
@@ -603,18 +630,18 @@ static int idpf_rx_hdr_buf_alloc_all(struct idpf_buf_queue *bufq) }/** -* idpf_rx_post_buf_refill - Post buffer id to refill queue +* idpf_post_buf_refill - Post buffer id to refill queue * @refillq: refill queue to post to * @buf_id: buffer id to post */ -static void idpf_rx_post_buf_refill (struct idpf_sw_queue *refillq,u16 buf_id) +static void idpf_post_buf_refill (struct idpf_sw_queue *refillq,u16 buf_id) {u32 nta = refillq->next_to_use;/* store the buffer ID and the SW maintained GEN bit to the refillq */ refillq->ring[nta] = -FIELD_PREP (IDPF_RX_BI_BUFID_M , buf_id) | -FIELD_PREP (IDPF_RX_BI_GEN_M , +FIELD_PREP (IDPF_RFL_BI_BUFID_M , buf_id) | +FIELD_PREP (IDPF_RFL_BI_GEN_M ,idpf_queue_has (GEN_CHK , refillq));if (unlikely (++nta == refillq->desc_count)) {
@@ -995,6 +1022,11 @@ static void idpf_txq_group_rel(struct idpf_vport *vport)struct idpf_txq_group *txq_grp = &vport->txq_grps[i];for (j =0 ; j < txq_grp->num_txq; j++) { +if (flow_sch_en) { +kfree (txq_grp->txqs[j]->refillq); + txq_grp->txqs[j]->refillq =NULL ; + } +kfree (txq_grp->txqs[j]); txq_grp->txqs[j] =NULL ; }
@@ -1414,6 +1446,13 @@ static int idpf_txq_group_alloc(struct idpf_vport *vport, u16 num_txq) }idpf_queue_set (FLOW_SCH_EN , q); + + q->refillq =kzalloc (sizeof (*q->refillq),GFP_KERNEL ); +if (!q->refillq) + goto err_alloc; + +idpf_queue_set (GEN_CHK , q->refillq); +idpf_queue_set (RFL_GEN_CHK , q->refillq); }if (!split)
@@ -2005,6 +2044,8 @@ static void idpf_tx_handle_rs_completion(struct idpf_tx_queue *txq, compl_tag =le16_to_cpu (desc->q_head_compl_tag.compl_tag); +idpf_post_buf_refill (txq->refillq, compl_tag); +/* If we didn't clean anything on the ring, this packet must be * in the hash table. Go clean it there. */
@@ -2364,6 +2405,37 @@ static unsigned int idpf_tx_splitq_bump_ntu(struct idpf_tx_queue *txq, u16 ntu)return ntu; } +/** +* idpf_tx_get_free_buf_id - get a free buffer ID from the refill queue +* @refillq: refill queue to get buffer ID from +* @buf_id: return buffer ID +* +* Return: true if a buffer ID was found, false if not +*/ +static bool idpf_tx_get_free_buf_id (struct idpf_sw_queue *refillq, +u16 *buf_id) +{ +u32 ntc = refillq->next_to_clean; +u32 refill_desc; + + refill_desc = refillq->ring[ntc]; + +if (unlikely (idpf_queue_has (RFL_GEN_CHK , refillq) != + !!(refill_desc &IDPF_RFL_BI_GEN_M ))) +return false; + + *buf_id =FIELD_GET (IDPF_RFL_BI_BUFID_M , refill_desc); + +if (unlikely (++ntc == refillq->desc_count)) { +idpf_queue_change (RFL_GEN_CHK , refillq); + ntc =0 ; + } + + refillq->next_to_clean = ntc; + +return true; +} +/** * idpf_tx_splitq_map - Build the Tx flex descriptor * @tx_q: queue to send buffer on
@@ -2912,6 +2984,13 @@ static netdev_tx_t idpf_tx_splitq_frame(struct sk_buff *skb, }if (idpf_queue_has (FLOW_SCH_EN , tx_q)) { +if (unlikely (!idpf_tx_get_free_buf_id (tx_q->refillq, + &tx_params.compl_tag))) { +u64_stats_update_begin (&tx_q->stats_sync); +u64_stats_inc (&tx_q->q_stats.q_busy); +u64_stats_update_end (&tx_q->stats_sync); + } + tx_params.dtype =IDPF_TX_DESC_DTYPE_FLEX_FLOW_SCHE ; tx_params.eop_cmd =IDPF_TXD_FLEX_FLOW_CMD_EOP ;/* Set the RE bit to catch any packets that may have not been
@@ -3464,7 +3543,7 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget) skip_data: rx_buf->page =NULL ; -idpf_rx_post_buf_refill (refillq, buf_id); +idpf_post_buf_refill (refillq, buf_id);IDPF_RX_BUMP_NTC (rxq, ntc);/* skip if it is non EOP desc */
@@ -3572,10 +3651,10 @@ static void idpf_rx_clean_refillq(struct idpf_buf_queue *bufq,bool failure;if (idpf_queue_has (RFL_GEN_CHK , refillq) != - !!(refill_desc &IDPF_RX_BI_GEN_M )) + !!(refill_desc &IDPF_RFL_BI_GEN_M ))break ; - buf_id =FIELD_GET (IDPF_RX_BI_BUFID_M , refill_desc); + buf_id =FIELD_GET (IDPF_RFL_BI_BUFID_M , refill_desc); failure =idpf_rx_update_bufq_desc (bufq, buf_id, buf_desc);if (failure)break ;
drivers/net/ethernet/intel/idpf/idpf_txrx.h +5 -3
@@ -107,8 +107,8 @@ do { \*/ #define IDPF_TX_SPLITQ_RE_MIN_GAP 64 -#define IDPF_RX_BI_GEN_M BIT(16) -#define IDPF_RX_BI_BUFID_M GENMASK(15, 0) +#define IDPF_RFL_BI_GEN_M BIT(16) +#define IDPF_RFL_BI_BUFID_M GENMASK(15, 0)#define IDPF_RXD_EOF_SPLITQ VIRTCHNL2_RX_FLEX_DESC_ADV_STATUS0_EOF_M#define IDPF_RXD_EOF_SINGLEQ VIRTCHNL2_RX_BASE_DESC_STATUS_EOF_M
@@ -621,6 +621,7 @@ libeth_cacheline_set_assert(struct idpf_rx_queue, 64,* @cleaned_pkts: Number of packets cleaned for the above said case * @tx_max_bufs: Max buffers that can be transmitted with scatter-gather * @stash: Tx buffer stash for Flow-based scheduling mode +* @refillq: Pointer to refill queue * @compl_tag_bufid_m: Completion tag buffer id mask * @compl_tag_cur_gen: Used to keep track of current completion tag generation * @compl_tag_gen_max: To determine when compl_tag_cur_gen should be reset
@@ -670,6 +671,7 @@ struct idpf_tx_queue {u16 tx_max_bufs;struct idpf_txq_stash *stash; +struct idpf_sw_queue *refillq;u16 compl_tag_bufid_m;u16 compl_tag_cur_gen;
@@ -691,7 +693,7 @@ struct idpf_tx_queue {__cacheline_group_end_aligned (cold); }; libeth_cacheline_set_assert(struct idpf_tx_queue, 64, -112 +sizeof (struct u64_stats_sync ), +120 +sizeof (struct u64_stats_sync ), 24);/**
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 42/142 idpf: simplify and fix splitq Tx packet rollback error path
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hay <[email protected]>
[ Upstream commit b61dfa9bc4430ad82b96d3a7c1c485350f91b467 ]
Move (and rename) the existing rollback logic to singleq.c since that will be the only consumer. Create a simplified splitq specific rollback function to loop through and unmap tx_bufs based on the completion tag. This is critical before replacing the Tx buffer ring with the buffer pool since the previous rollback indexing will not work to unmap the chained buffers from the pool.
Cache the next_to_use index before any portion of the packet is put on the descriptor ring. In case of an error, the rollback will bump tail to the correct next_to_use value. Because the splitq path now supports different types of context descriptors (and potentially multiple in the future), this will take care of rolling back any and all context descriptors encoded on the ring for the erroneous packet. The previous rollback logic was broken for PTP packets since it would not account for the PTP context descriptor.
--- .../ethernet/intel/idpf/idpf_singleq_txrx.c | 57 +++++++++++- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 91 ++++++++----------- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 5 +- 3 files changed, 95 insertions(+), 58 deletions(-)
drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c +55 -2
@@ -179,6 +179,58 @@ static int idpf_tx_singleq_csum(struct sk_buff *skb,return 1 ; } +/** +* idpf_tx_singleq_dma_map_error - handle TX DMA map errors +* @txq: queue to send buffer on +* @skb: send buffer +* @first: original first buffer info buffer for packet +* @idx: starting point on ring to unwind +*/ +static void idpf_tx_singleq_dma_map_error (struct idpf_tx_queue *txq, +struct sk_buff *skb, +struct idpf_tx_buf *first,u16 idx) +{ +struct libeth_sq_napi_stats ss = { }; +struct libeth_cq_pp cp = { + .dev = txq->dev, + .ss = &ss, + }; + +u64_stats_update_begin (&txq->stats_sync); +u64_stats_inc (&txq->q_stats.dma_map_errs); +u64_stats_update_end (&txq->stats_sync); + +/* clear dma mappings for failed tx_buf map */ +for (;;) { +struct idpf_tx_buf *tx_buf; + + tx_buf = &txq->tx_buf[idx]; +libeth_tx_complete (tx_buf, &cp); +if (tx_buf == first) +break ; +if (idx ==0 ) + idx = txq->desc_count; + idx--; + } + +if (skb_is_gso (skb)) { +union idpf_tx_flex_desc *tx_desc; + +/* If we failed a DMA mapping for a TSO packet, we will have +* used one additional descriptor for a context +* descriptor. Reset that here. +*/ + tx_desc = &txq->flex_tx[idx]; +memset (tx_desc,0 ,sizeof (*tx_desc)); +if (idx ==0 ) + idx = txq->desc_count; + idx--; + } + +/* Update tail in case netdev_xmit_more was previously true */ +idpf_tx_buf_hw_update (txq, idx, false); +} +/** * idpf_tx_singleq_map - Build the Tx base descriptor * @tx_q: queue to send buffer on
@@ -219,8 +271,9 @@ static void idpf_tx_singleq_map(struct idpf_tx_queue *tx_q,for (frag = &skb_shinfo (skb)->frags[0 ];; frag++) {unsigned int max_data =IDPF_TX_MAX_DESC_DATA_ALIGNED ; -if (dma_mapping_error (tx_q->dev, dma)) -return idpf_tx_dma_map_error (tx_q, skb, first, i); +if (unlikely (dma_mapping_error (tx_q->dev, dma))) +return idpf_tx_singleq_dma_map_error (tx_q, skb, + first, i);/* record length, and DMA address */ dma_unmap_len_set (tx_buf, len, size);
drivers/net/ethernet/intel/idpf/idpf_txrx.c +37 -54
115 lines not on this page · raw message
drivers/net/ethernet/intel/idpf/idpf_txrx.h +3 -2
@@ -195,6 +195,7 @@ struct idpf_tx_offload_params {* @compl_tag: Associated tag for completion * @td_tag: Descriptor tunneling tag * @offload: Offload parameters +* @prev_ntu: stored TxQ next_to_use in case of rollback */ struct idpf_tx_splitq_params {enum idpf_tx_desc_dtype_value dtype;
@@ -205,6 +206,8 @@ struct idpf_tx_splitq_params { };struct idpf_tx_offload_params offload; + +u16 prev_ntu; };enum idpf_tx_ctx_desc_eipt_offload {
@@ -1039,8 +1042,6 @@ void idpf_tx_buf_hw_update(struct idpf_tx_queue *tx_q, u32 val, bool xmit_more);unsigned int idpf_size_to_txd_count (unsigned int size);netdev_tx_t idpf_tx_drop_skb (struct idpf_tx_queue *tx_q,struct sk_buff *skb); -void idpf_tx_dma_map_error (struct idpf_tx_queue *txq,struct sk_buff *skb, -struct idpf_tx_buf *first,u16 ring_idx);unsigned int idpf_tx_desc_count_required (struct idpf_tx_queue *txq,struct sk_buff *skb);void idpf_tx_timeout (struct net_device *netdev,unsigned int txqueue);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 43/142 idpf: replace flow scheduling buffer ring with buffer pool
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hay <[email protected]>
[ Upstream commit 5f417d551324d2894168b362f2429d120ab06243 ]
Replace the TxQ buffer ring with one large pool/array of buffers (only for flow scheduling). This eliminates the tag generation and makes it impossible for a tag to be associated with more than one packet.
The completion tag passed to HW through the descriptor is the index into the array. That same completion tag is posted back to the driver in the completion descriptor, and used to index into the array to quickly retrieve the buffer during cleaning. In this way, the tags are treated as a fix sized resource. If all tags are in use, no more packets can be sent on that particular queue (until some are freed up). The tag pool size is 64K since the completion tag width is 16 bits.
For each packet, the driver pulls a free tag from the refillq to get the next free buffer index. When cleaning is complete, the tag is posted back to the refillq. A multi-frag packet spans multiple buffers in the driver, therefore it uses multiple buffer indexes/tags from the pool. Each frag pulls from the refillq to get the next free buffer index. These are tracked in a next_buf field that replaces the completion tag field in the buffer struct. This chains the buffers together so that the packet can be cleaned from the starting completion tag taken from the completion descriptor, then from the next_buf field for each subsequent buffer.
In case of a dma_mapping_error occurs or the refillq runs out of free buf_ids, the packet will execute the rollback error path. This unmaps any buffers previously mapped for the packet. Since several free buf_ids could have already been pulled from the refillq, we need to restore its original state as well. Otherwise, the buf_ids/tags will be leaked and not used again until the queue is reallocated.
Descriptor completions only advance the descriptor ring index to "clean" the descriptors. The packet completions only clean the buffers associated with the given packet completion tag and do not update the descriptor ring index.
When operating in queue based scheduling mode, the array still acts as a ring and will only have TxQ descriptor count entries. The tx_bufs are still associated 1:1 with the descriptor ring entries and we can use the conventional indexing mechanisms.
--- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 204 +++++++++----------- drivers/net/ethernet/intel/idpf/idpf_txrx.h | 10 +- 2 files changed, 103 insertions(+), 111 deletions(-)
drivers/net/ethernet/intel/idpf/idpf_txrx.c +94 -110
@@ -13,6 +13,7 @@ struct idpf_tx_stash {struct libeth_sqe buf; }; +#define idpf_tx_buf_next (buf) (*(u32 *)&(buf)->priv)#define idpf_tx_buf_compl_tag (buf) (*(u32 *)&(buf)->priv)LIBETH_SQE_CHECK_PRIV (u32);
@@ -91,7 +92,7 @@ static void idpf_tx_buf_rel_all(struct idpf_tx_queue *txq)return ;/* Free all the Tx buffer sk_buffs */ -for (i =0 ; i < txq->desc_count; i++) +for (i =0 ; i < txq->buf_pool_size; i++)libeth_tx_complete (&txq->tx_buf[i], &cp);kfree (txq->tx_buf);
@@ -199,14 +200,17 @@ static void idpf_tx_desc_rel_all(struct idpf_vport *vport)static int idpf_tx_buf_alloc_all (struct idpf_tx_queue *tx_q) {struct idpf_buf_lifo *buf_stack; -int buf_size;int i;/* Allocate book keeping buffers only. Buffers to be supplied to HW * are allocated by kernel network stack and received as part of skb */ - buf_size =sizeof (struct idpf_tx_buf ) * tx_q->desc_count; - tx_q->tx_buf =kzalloc (buf_size,GFP_KERNEL ); +if (idpf_queue_has (FLOW_SCH_EN , tx_q)) + tx_q->buf_pool_size =U16_MAX ; +else + tx_q->buf_pool_size = tx_q->desc_count; + tx_q->tx_buf =kcalloc (tx_q->buf_pool_size,sizeof (*tx_q->tx_buf), +GFP_KERNEL );if (!tx_q->tx_buf)return -ENOMEM ;
@@ -275,7 +279,7 @@ static int idpf_tx_desc_alloc(const struct idpf_vport *vport,return 0 ; refillq = tx_q->refillq; - refillq->desc_count = tx_q->desc_count; + refillq->desc_count = tx_q->buf_pool_size; refillq->ring =kcalloc (refillq->desc_count,sizeof (u32),GFP_KERNEL );if (!refillq->ring) {
@@ -1867,6 +1871,12 @@ static bool idpf_tx_splitq_clean(struct idpf_tx_queue *tx_q, u16 end,struct idpf_tx_buf *tx_buf;bool clean_complete = true; +if (descs_only) { +/* Bump ring index to mark as cleaned. */ + tx_q->next_to_clean = end; +return true; + } + tx_desc = &tx_q->flex_tx[ntc]; next_pending_desc = &tx_q->flex_tx[end]; tx_buf = &tx_q->tx_buf[ntc];
@@ -1933,87 +1943,43 @@ do { \ }while (0 )/** -* idpf_tx_clean_buf_ring - clean flow scheduling TX queue buffers +* idpf_tx_clean_bufs - clean flow scheduling TX queue buffers * @txq: queue to clean -* @compl_tag: completion tag of packet to clean (from completion descriptor) +* @buf_id: packet's starting buffer ID, from completion descriptor * @cleaned: pointer to stats struct to track cleaned packets/bytes * @budget: Used to determine if we are in netpoll * -* Cleans all buffers associated with the input completion tag either from the -* TX buffer ring or from the hash table if the buffers were previously -* stashed. Returns the byte/segment count for the cleaned packet associated -* this completion tag. +* Clean all buffers associated with the packet starting at buf_id. Returns the +* byte/segment count for the cleaned packet. */ -static bool idpf_tx_clean_buf_ring(struct idpf_tx_queue *txq, u16 compl_tag, -struct libeth_sq_napi_stats *cleaned, -int budget) +static bool idpf_tx_clean_bufs(struct idpf_tx_queue *txq, u32 buf_id, +struct libeth_sq_napi_stats *cleaned, +int budget) { -u16 idx = compl_tag & txq->compl_tag_bufid_m;struct idpf_tx_buf *tx_buf =NULL ;struct libeth_cq_pp cp = { .dev = txq->dev, .ss = cleaned, .napi = budget, }; -u16 ntc, orig_idx = idx; - - tx_buf = &txq->tx_buf[idx]; - -if (unlikely (tx_buf->type <=LIBETH_SQE_CTX || -idpf_tx_buf_compl_tag (tx_buf) != compl_tag)) -return false; + tx_buf = &txq->tx_buf[buf_id];if (tx_buf->type ==LIBETH_SQE_SKB ) {if (skb_shinfo (tx_buf->skb)->tx_flags &SKBTX_IN_PROGRESS )idpf_tx_read_tstamp (txq, tx_buf->skb);libeth_tx_complete (tx_buf, &cp); +idpf_post_buf_refill (txq->refillq, buf_id); } -idpf_tx_clean_buf_ring_bump_ntc (txq, idx, tx_buf); +while (idpf_tx_buf_next (tx_buf) !=IDPF_TXBUF_NULL ) { + buf_id =idpf_tx_buf_next (tx_buf); -while (idpf_tx_buf_compl_tag (tx_buf) == compl_tag) { + tx_buf = &txq->tx_buf[buf_id];libeth_tx_complete (tx_buf, &cp); -idpf_tx_clean_buf_ring_bump_ntc (txq, idx, tx_buf); +idpf_post_buf_refill (txq->refillq, buf_id); } -/* -* It's possible the packet we just cleaned was an out of order -* completion, which means we can stash the buffers starting from -* the original next_to_clean and reuse the descriptors. We need -* to compare the descriptor ring next_to_clean packet's "first" buffer -* to the "first" buffer of the packet we just cleaned to determine if -* this is the case. Howevever, next_to_clean can point to either a -* reserved buffer that corresponds to a context descriptor used for the -* next_to_clean packet (TSO packet) or the "first" buffer (single -* packet). The orig_idx from the packet we just cleaned will always -* point to the "first" buffer. If next_to_clean points to a reserved -* buffer, let's bump ntc once and start the comparison from there. -*/ - ntc = txq->next_to_clean; - tx_buf = &txq->tx_buf[ntc]; - -if (tx_buf->type ==LIBETH_SQE_CTX ) -idpf_tx_clean_buf_ring_bump_ntc (txq, ntc, tx_buf); - -/* -* If ntc still points to a different "first" buffer, clean the -* descriptor ring and stash all of the buffers for later cleaning. If -* we cannot stash all of the buffers, next_to_clean will point to the -* "first" buffer of the packet that could not be stashed and cleaning -* will start there next time. -*/ -if (unlikely (tx_buf != &txq->tx_buf[orig_idx] && - !idpf_tx_splitq_clean (txq, orig_idx, budget, cleaned, - true))) -return true; - -/* -* Otherwise, update next_to_clean to reflect the cleaning that was -* done above. -*/ - txq->next_to_clean = idx; -return true; }
@@ -2044,12 +2010,10 @@ static void idpf_tx_handle_rs_completion(struct idpf_tx_queue *txq, compl_tag =le16_to_cpu (desc->q_head_compl_tag.compl_tag); -idpf_post_buf_refill (txq->refillq, compl_tag); -/* If we didn't clean anything on the ring, this packet must be * in the hash table. Go clean it there. */ -if (!idpf_tx_clean_buf_ring (txq, compl_tag, cleaned, budget)) +if (!idpf_tx_clean_bufs (txq, compl_tag, cleaned, budget))idpf_tx_clean_stashed_bufs (txq, compl_tag, cleaned, budget); }
@@ -2362,7 +2326,7 @@ static unsigned int idpf_tx_splitq_bump_ntu(struct idpf_tx_queue *txq, u16 ntu)* Return: true if a buffer ID was found, false if not */ static bool idpf_tx_get_free_buf_id (struct idpf_sw_queue *refillq, -u16 *buf_id) +u32 *buf_id) {u32 ntc = refillq->next_to_clean;u32 refill_desc;
@@ -2395,25 +2359,34 @@ static void idpf_tx_splitq_pkt_err_unmap(struct idpf_tx_queue *txq,struct idpf_tx_splitq_params *params, struct idpf_tx_buf *first) { + struct idpf_sw_queue *refillq = txq->refillq;struct libeth_sq_napi_stats ss = { };struct idpf_tx_buf *tx_buf = first;struct libeth_cq_pp cp = { .dev = txq->dev, .ss = &ss, }; -u32 idx =0 ;u64_stats_update_begin (&txq->stats_sync);u64_stats_inc (&txq->q_stats.dma_map_errs);u64_stats_update_end (&txq->stats_sync); -do { +libeth_tx_complete (tx_buf, &cp); +while (idpf_tx_buf_next (tx_buf) !=IDPF_TXBUF_NULL ) { + tx_buf = &txq->tx_buf[idpf_tx_buf_next (tx_buf)];libeth_tx_complete (tx_buf, &cp); -idpf_tx_clean_buf_ring_bump_ntc (txq, idx, tx_buf); - }while (idpf_tx_buf_compl_tag (tx_buf) == params->compl_tag); + }/* Update tail in case netdev_xmit_more was previously true. */ idpf_tx_buf_hw_update (txq, params->prev_ntu, false); + +if (!refillq) +return ; + +/* Restore refillq state to avoid leaking tags. */ +if (params->prev_refill_gen !=idpf_queue_has (RFL_GEN_CHK , refillq)) +idpf_queue_change (RFL_GEN_CHK , refillq); + refillq->next_to_clean = params->prev_refill_ntc; }/**
@@ -2437,6 +2410,7 @@ static void idpf_tx_splitq_map(struct idpf_tx_queue *tx_q,struct netdev_queue *nq;struct sk_buff *skb;skb_frag_t *frag; +u32 next_buf_id;u16 td_cmd =0 ;dma_addr_t dma;
@@ -2454,18 +2428,16 @@ static void idpf_tx_splitq_map(struct idpf_tx_queue *tx_q, tx_buf = first; first->nr_frags =0 ; - params->compl_tag = - (tx_q->compl_tag_cur_gen << tx_q->compl_tag_gen_s) | i; -for (frag = &skb_shinfo (skb)->frags[0 ];; frag++) {unsigned int max_data =IDPF_TX_MAX_DESC_DATA_ALIGNED ; -if (unlikely (dma_mapping_error (tx_q->dev, dma))) +if (unlikely (dma_mapping_error (tx_q->dev, dma))) { +idpf_tx_buf_next (tx_buf) =IDPF_TXBUF_NULL ;return idpf_tx_splitq_pkt_err_unmap (tx_q, params, first); + } first->nr_frags++; -idpf_tx_buf_compl_tag (tx_buf) = params->compl_tag; tx_buf->type =LIBETH_SQE_FRAG ;/* record length, and DMA address */
@@ -2521,29 +2493,14 @@ static void idpf_tx_splitq_map(struct idpf_tx_queue *tx_q, max_data);if (unlikely (++i == tx_q->desc_count)) { - tx_buf = tx_q->tx_buf; tx_desc = &tx_q->flex_tx[0 ]; i =0 ; tx_q->compl_tag_cur_gen =IDPF_TX_ADJ_COMPL_TAG_GEN (tx_q); }else { - tx_buf++; tx_desc++; } -/* Since this packet has a buffer that is going to span -* multiple descriptors, it's going to leave holes in -* to the TX buffer ring. To ensure these holes do not -* cause issues in the cleaning routines, we will clear -* them of any stale data and assign them the same -* completion tag as the current packet. Then when the -* packet is being cleaned, the cleaning routines will -* simply pass over these holes and finish cleaning the -* rest of the packet. -*/ - tx_buf->type =LIBETH_SQE_EMPTY ; -idpf_tx_buf_compl_tag (tx_buf) = params->compl_tag; -/* Adjust the DMA offset and the remaining size of the * fragment. On the first iteration of this loop, * max_data will be >= 12K and <= 16K-1. On any
@@ -2568,15 +2525,26 @@ static void idpf_tx_splitq_map(struct idpf_tx_queue *tx_q,idpf_tx_splitq_build_desc (tx_desc, params, td_cmd, size);if (unlikely (++i == tx_q->desc_count)) { - tx_buf = tx_q->tx_buf; tx_desc = &tx_q->flex_tx[0 ]; i =0 ; tx_q->compl_tag_cur_gen =IDPF_TX_ADJ_COMPL_TAG_GEN (tx_q); }else { - tx_buf++; tx_desc++; } +if (idpf_queue_has (FLOW_SCH_EN , tx_q)) { +if (unlikely (!idpf_tx_get_free_buf_id (tx_q->refillq, + &next_buf_id))) { +idpf_tx_buf_next (tx_buf) =IDPF_TXBUF_NULL ; +return idpf_tx_splitq_pkt_err_unmap (tx_q, params, + first); + } + }else { + next_buf_id = i; + } +idpf_tx_buf_next (tx_buf) = next_buf_id; + tx_buf = &tx_q->tx_buf[next_buf_id]; + size =skb_frag_size (frag); data_len -= size;
@@ -2591,6 +2559,7 @@ static void idpf_tx_splitq_map(struct idpf_tx_queue *tx_q,/* write last descriptor with RS and EOP bits */ first->rs_idx = i; +idpf_tx_buf_next (tx_buf) =IDPF_TXBUF_NULL ; td_cmd |= params->eop_cmd;idpf_tx_splitq_build_desc (tx_desc, params, td_cmd, size); i =idpf_tx_splitq_bump_ntu (tx_q, i);
@@ -2799,8 +2768,6 @@ idpf_tx_splitq_get_ctx_desc(struct idpf_tx_queue *txq)union idpf_flex_tx_ctx_desc *desc;int i = txq->next_to_use; - txq->tx_buf[i].type =LIBETH_SQE_CTX ; -/* grab the next descriptor */ desc = &txq->flex_ctx[i]; txq->next_to_use =idpf_tx_splitq_bump_ntu (txq, i);
@@ -2910,6 +2877,7 @@ static netdev_tx_t idpf_tx_splitq_frame(struct sk_buff *skb,struct idpf_tx_buf *first;unsigned int count;int tso, idx; +u32 buf_id; count =idpf_tx_desc_count_required (tx_q, skb);if (unlikely (!count))
@@ -2953,26 +2921,28 @@ static netdev_tx_t idpf_tx_splitq_frame(struct sk_buff *skb,idpf_tx_set_tstamp_desc (ctx_desc, idx); } -/* record the location of the first descriptor for this packet */ - first = &tx_q->tx_buf[tx_q->next_to_use]; - first->skb = skb; +if (idpf_queue_has (FLOW_SCH_EN , tx_q)) { +struct idpf_sw_queue *refillq = tx_q->refillq; -if (tso) { - first->packets = tx_params.offload.tso_segs; - first->bytes = skb->len + - ((first->packets -1 ) * tx_params.offload.tso_hdr_len); - }else { - first->packets =1 ; - first->bytes = max_t(unsigned int, skb->len, ETH_ZLEN); - } +/* Save refillq state in case of a packet rollback. Otherwise, +* the tags will be leaked since they will be popped from the +* refillq but never reposted during cleaning. +*/ + tx_params.prev_refill_gen = +idpf_queue_has (RFL_GEN_CHK , refillq); + tx_params.prev_refill_ntc = refillq->next_to_clean; -if (idpf_queue_has (FLOW_SCH_EN , tx_q)) {if (unlikely (!idpf_tx_get_free_buf_id (tx_q->refillq, - &tx_params.compl_tag))) { -u64_stats_update_begin (&tx_q->stats_sync); -u64_stats_inc (&tx_q->q_stats.q_busy); -u64_stats_update_end (&tx_q->stats_sync); + &buf_id))) { +if (tx_params.prev_refill_gen != +idpf_queue_has (RFL_GEN_CHK , refillq)) +idpf_queue_change (RFL_GEN_CHK , refillq); + refillq->next_to_clean = tx_params.prev_refill_ntc; + + tx_q->next_to_use = tx_params.prev_ntu; +return idpf_tx_drop_skb (tx_q, skb); } + tx_params.compl_tag = buf_id; tx_params.dtype =IDPF_TX_DESC_DTYPE_FLEX_FLOW_SCHE ; tx_params.eop_cmd =IDPF_TXD_FLEX_FLOW_CMD_EOP ;
@@ -2990,6 +2960,8 @@ static netdev_tx_t idpf_tx_splitq_frame(struct sk_buff *skb, tx_params.offload.td_cmd |=IDPF_TXD_FLEX_FLOW_CMD_CS_EN ; }else { + buf_id = tx_q->next_to_use; + tx_params.dtype =IDPF_TX_DESC_DTYPE_FLEX_L2TAG1_L2TAG2 ; tx_params.eop_cmd =IDPF_TXD_LAST_DESC_CMD ;
@@ -2997,6 +2969,18 @@ static netdev_tx_t idpf_tx_splitq_frame(struct sk_buff *skb, tx_params.offload.td_cmd |=IDPF_TX_FLEX_DESC_CMD_CS_EN ; } + first = &tx_q->tx_buf[buf_id]; + first->skb = skb; + +if (tso) { + first->packets = tx_params.offload.tso_segs; + first->bytes = skb->len + + ((first->packets -1 ) * tx_params.offload.tso_hdr_len); + }else { + first->packets =1 ; + first->bytes = max_t(unsigned int, skb->len, ETH_ZLEN); + } +idpf_tx_splitq_map (tx_q, &tx_params, first);return NETDEV_TX_OK ;
drivers/net/ethernet/intel/idpf/idpf_txrx.h +9 -1
@@ -136,6 +136,8 @@ do { \ ((++(txq)->compl_tag_cur_gen) >= (txq)->compl_tag_gen_max ? \ 0 : (txq)->compl_tag_cur_gen) +#define IDPF_TXBUF_NULL U32_MAX +#define IDPF_TXD_LAST_DESC_CMD (IDPF_TX_DESC_CMD_EOP | IDPF_TX_DESC_CMD_RS)#define IDPF_TX_FLAGS_TSO BIT(0)
@@ -196,6 +198,8 @@ struct idpf_tx_offload_params {* @td_tag: Descriptor tunneling tag * @offload: Offload parameters * @prev_ntu: stored TxQ next_to_use in case of rollback +* @prev_refill_ntc: stored refillq next_to_clean in case of packet rollback +* @prev_refill_gen: stored refillq generation bit in case of packet rollback */ struct idpf_tx_splitq_params {enum idpf_tx_desc_dtype_value dtype;
@@ -208,6 +212,8 @@ struct idpf_tx_splitq_params {struct idpf_tx_offload_params offload;u16 prev_ntu; +u16 prev_refill_ntc; +bool prev_refill_gen; };enum idpf_tx_ctx_desc_eipt_offload {
@@ -636,6 +642,7 @@ libeth_cacheline_set_assert(struct idpf_rx_queue, 64,* @size: Length of descriptor ring in bytes * @dma: Physical address of ring * @q_vector: Backreference to associated vector +* @buf_pool_size: Total number of idpf_tx_buf */ struct idpf_tx_queue {__cacheline_group_begin_aligned (read_mostly);
@@ -693,11 +700,12 @@ struct idpf_tx_queue {dma_addr_t dma;struct idpf_q_vector *q_vector; +u32 buf_pool_size;__cacheline_group_end_aligned (cold); }; libeth_cacheline_set_assert(struct idpf_tx_queue, 64,120 +sizeof (struct u64_stats_sync ), - 24); + 32);/** * struct idpf_buf_queue - software structure representing a buffer queue
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 44/142 idpf: stop Tx if there are insufficient buffer resources
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Hay <[email protected]>
[ Upstream commit 0c3f135e840d4a2ba4253e15d530ec61bc30718e ]
The Tx refillq logic will cause packets to be silently dropped if there are not enough buffer resources available to send a packet in flow scheduling mode. Instead, determine how many buffers are needed along with number of descriptors. Make sure there are enough of both resources to send the packet, and stop the queue if not.
--- .../ethernet/intel/idpf/idpf_singleq_txrx.c | 4 +- drivers/net/ethernet/intel/idpf/idpf_txrx.c | 47 +++++++++++++------ drivers/net/ethernet/intel/idpf/idpf_txrx.h | 15 +++++- 3 files changed, 47 insertions(+), 19 deletions(-)
drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c +2 -2
@@ -415,11 +415,11 @@ netdev_tx_t idpf_tx_singleq_frame(struct sk_buff *skb, {struct idpf_tx_offload_params offload = { };struct idpf_tx_buf *first; +u32 count, buf_count =1 ;int csum, tso, needed; -unsigned int count;__be16 protocol; - count =idpf_tx_desc_count_required (tx_q, skb); + count =idpf_tx_res_count_required (tx_q, skb, &buf_count);if (unlikely (!count))return idpf_tx_drop_skb (tx_q, skb);
drivers/net/ethernet/intel/idpf/idpf_txrx.c +32 -15
99 lines not on this page · raw message
drivers/net/ethernet/intel/idpf/idpf_txrx.h +13 -2
@@ -1023,6 +1023,17 @@ static inline void idpf_vport_intr_set_wb_on_itr(struct idpf_q_vector *q_vector) reg->dyn_ctl); } +/** +* idpf_tx_splitq_get_free_bufs - get number of free buf_ids in refillq +* @refillq: pointer to refillq containing buf_ids +*/ +static inline u32 idpf_tx_splitq_get_free_bufs (struct idpf_sw_queue *refillq) +{ +return (refillq->next_to_use > refillq->next_to_clean ? +0 : refillq->desc_count) + + refillq->next_to_use - refillq->next_to_clean -1 ; +} +int idpf_vport_singleq_napi_poll (struct napi_struct *napi,int budget);void idpf_vport_init_num_qs (struct idpf_vport *vport,struct virtchnl2_create_vport *vport_msg);
@@ -1050,8 +1061,8 @@ void idpf_tx_buf_hw_update(struct idpf_tx_queue *tx_q, u32 val, bool xmit_more);unsigned int idpf_size_to_txd_count (unsigned int size);netdev_tx_t idpf_tx_drop_skb (struct idpf_tx_queue *tx_q,struct sk_buff *skb); -unsigned int idpf_tx_desc_count_required (struct idpf_tx_queue *txq, -struct sk_buff *skb); +unsigned int idpf_tx_res_count_required (struct idpf_tx_queue *txq, +struct sk_buff *skb,u32 *buf_count);void idpf_tx_timeout (struct net_device *netdev,unsigned int txqueue);netdev_tx_t idpf_tx_singleq_frame (struct sk_buff *skb,struct idpf_tx_queue *tx_q);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 45/142 net: macb: fix unregister_netdev call order in macb_remove()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: luoguangfei <[email protected]>
[ Upstream commit 01b9128c5db1b470575d07b05b67ffa3cb02ebf1 ]
When removing a macb device, the driver calls phy_exit() before unregister_netdev(). This leads to a WARN from kernfs:
------------[ cut here ]------------
kernfs: can not remove 'attached_dev', no directory
WARNING: CPU: 1 PID: 27146 at fs/kernfs/dir.c:1683
Call trace:
kernfs_remove_by_name_ns+0xd8/0xf0
sysfs_remove_link+0x24/0x58
phy_detach+0x5c/0x168
phy_disconnect+0x4c/0x70
phylink_disconnect_phy+0x6c/0xc0 [phylink]
macb_close+0x6c/0x170 [macb]
...
macb_remove+0x60/0x168 [macb]
platform_remove+0x5c/0x80
...The warning happens because the PHY is being exited while the netdev is still registered. The correct order is to unregister the netdev before shutting down the PHY and cleaning up the MDIO bus.
Fix this by moving unregister_netdev() ahead of phy_exit() in macb_remove().
--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -5391,11 +5391,11 @@ static void macb_remove(struct platform_device *pdev)if (dev) { bp =netdev_priv (dev); +unregister_netdev (dev);phy_exit (bp->sgmii_phy);mdiobus_unregister (bp->mii_bus);mdiobus_free (bp->mii_bus); -unregister_netdev (dev);cancel_work_sync (&bp->hresp_err_bh_work);pm_runtime_disable (&pdev->dev);pm_runtime_dont_use_autosuspend (&pdev->dev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 28/142 net: ipv4: fix regression in local-broadcast routes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oscar Maes <[email protected]>
[ Upstream commit 5189446ba995556eaa3755a6e875bc06675b88bd ]
Commit 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes") introduced a regression where local-broadcast packets would have their gateway set in __mkroute_output, which was caused by fi = NULL being removed.
Fix this by resetting the fib_info for local-broadcast packets. This preserves the intended changes for directed-broadcast packets.
--- net/ipv4/route.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/ipv4/route.c +7 -3
@@ -2573,12 +2573,16 @@ static struct rtable *__mkroute_output(const struct fib_result *res, !netif_is_l3_master(dev_out))return ERR_PTR (-EINVAL ); -if (ipv4_is_lbcast (fl4->daddr)) +if (ipv4_is_lbcast (fl4->daddr)) { type =RTN_BROADCAST ; -else if (ipv4_is_multicast (fl4->daddr)) + +/* reset fi to prevent gateway resolution */ + fi =NULL ; + }else if (ipv4_is_multicast (fl4->daddr)) { type =RTN_MULTICAST ; -else if (ipv4_is_zeronet (fl4->daddr)) + }else if (ipv4_is_zeronet (fl4->daddr)) {return ERR_PTR (-EINVAL ); + }if (dev_out->flags &IFF_LOOPBACK ) flags |=RTCF_LOCAL ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 46/142 Bluetooth: hci_conn: Make unacked packet handling more robust
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 5d7eba62e5eb68347de59b31b347b24f304cf21c ]
This attempts to make unacked packet handling more robust by detecting if there are no connections left then restore all buffers of the respective pool.
--- net/bluetooth/hci_conn.c | 58 ++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 17 deletions(-)
net/bluetooth/hci_conn.c +41 -17
@@ -149,8 +149,6 @@ static void hci_conn_cleanup(struct hci_conn *conn)hci_chan_list_flush (conn); -hci_conn_hash_del (hdev, conn); -if (HCI_CONN_HANDLE_UNSET (conn->handle))ida_free (&hdev->unset_handle_ida, conn->handle);
@@ -1142,28 +1140,54 @@ void hci_conn_del(struct hci_conn *conn)disable_delayed_work_sync (&conn->auto_accept_work);disable_delayed_work_sync (&conn->idle_work); -if (conn->type ==ACL_LINK ) { -/* Unacked frames */ - hdev->acl_cnt += conn->sent; - }else if (conn->type ==LE_LINK ) { -cancel_delayed_work (&conn->le_conn_timeout); +/* Remove the connection from the list so unacked logic can detect when +* a certain pool is not being utilized. +*/ +hci_conn_hash_del (hdev, conn); -if (hdev->le_pkts) - hdev->le_cnt += conn->sent; +/* Handle unacked frames: +* +* - In case there are no connection, or if restoring the buffers +* considered in transist would overflow, restore all buffers to the +* pool. +* - Otherwise restore just the buffers considered in transit for the +* hci_conn +*/ +switch (conn->type) { +case ACL_LINK : +if (!hci_conn_num (hdev,ACL_LINK ) || + hdev->acl_cnt + conn->sent > hdev->acl_pkts) + hdev->acl_cnt = hdev->acl_pkts;else hdev->acl_cnt += conn->sent; - }else { -/* Unacked ISO frames */ -if (conn->type ==CIS_LINK || - conn->type ==BIS_LINK || - conn->type ==PA_LINK ) { -if (hdev->iso_pkts) - hdev->iso_cnt += conn->sent; -else if (hdev->le_pkts) +break ; +case LE_LINK : +cancel_delayed_work (&conn->le_conn_timeout); + +if (hdev->le_pkts) { +if (!hci_conn_num (hdev,LE_LINK ) || + hdev->le_cnt + conn->sent > hdev->le_pkts) + hdev->le_cnt = hdev->le_pkts; +else hdev->le_cnt += conn->sent; + }else { +if ((!hci_conn_num (hdev,LE_LINK ) && + !hci_conn_num (hdev,ACL_LINK )) || + hdev->acl_cnt + conn->sent > hdev->acl_pkts) + hdev->acl_cnt = hdev->acl_pkts;else hdev->acl_cnt += conn->sent; } +break ; +case CIS_LINK : +case BIS_LINK : +case PA_LINK : +if (!hci_iso_count (hdev) || + hdev->iso_cnt + conn->sent > hdev->iso_pkts) + hdev->iso_cnt = hdev->iso_pkts; +else + hdev->iso_cnt += conn->sent; +break ; }skb_queue_purge (&conn->data_q);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 47/142 Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovico de Nittis <[email protected]>
[ Upstream commit 2f050a5392b7a0928bf836d9891df4851463512c ]
When the host sends an HCI_OP_DISCONNECT command, the controller may respond with the status HCI_ERROR_UNKNOWN_CONN_ID (0x02). E.g. this can happen on resume from suspend, if the link was terminated by the remote device before the event mask was correctly set.
This is a btmon snippet that shows the issue:
```
> ACL Data RX: Handle 3 flags 0x02 dlen 12
L2CAP: Disconnection Request (0x06) ident 5 len 4
Destination CID: 65
Source CID: 72
< ACL Data TX: Handle 3 flags 0x00 dlen 12
L2CAP: Disconnection Response (0x07) ident 5 len 4
Destination CID: 65
Source CID: 72
> ACL Data RX: Handle 3 flags 0x02 dlen 12
L2CAP: Disconnection Request (0x06) ident 6 len 4
Destination CID: 64
Source CID: 71
< ACL Data TX: Handle 3 flags 0x00 dlen 12
L2CAP: Disconnection Response (0x07) ident 6 len 4
Destination CID: 64
Source CID: 71
< HCI Command: Set Event Mask (0x03|0x0001) plen 8
Mask: 0x3dbff807fffbffff
Inquiry Complete
Inquiry Result
Connection Complete
Connection Request
Disconnection Complete
Authentication Complete
[...]
< HCI Command: Disconnect (0x01|0x0006) plen 3
Handle: 3 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) ncmd 1
Status: Unknown Connection Identifier (0x02)
```Currently, the hci_cs_disconnect function treats any non-zero status as a command failure. This can be misleading because the connection is indeed being terminated and the controller is confirming that is has no knowledge of that connection handle. Meaning that the initial request of disconnecting a device should be treated as done.
With this change we allow the function to proceed, following the success path, which correctly calls mgmt_device_disconnected and ensures a consistent state.
--- net/bluetooth/hci_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/hci_event.c +1 -1
@@ -2703,7 +2703,7 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)if (!conn) goto unlock; -if (status) { +if (status && status !=HCI_ERROR_UNKNOWN_CONN_ID ) {mgmt_disconnect_failed (hdev, &conn->dst, conn->type, conn->dst_type, status);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 48/142 Bluetooth: hci_event: Mark connection as closed during suspend disconnect
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovico de Nittis <[email protected]>
[ Upstream commit b7fafbc499b5ee164018eb0eefe9027f5a6aaad2 ]
When suspending, the disconnect command for an active Bluetooth connection could be issued, but the corresponding HCI_EV_DISCONN_COMPLETE event might not be received before the system completes the suspend process. This can lead to an inconsistent state.
On resume, the controller may auto-accept reconnections from the same device (due to suspend event filters), but these new connections are rejected by the kernel which still has connection objects from before suspend. Resulting in errors like:
``` kernel: Bluetooth: hci0: ACL packet for unknown connection handle 1 kernel: Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection ```
This is a btmon snippet that shows the issue:
```
< HCI Command: Disconnect (0x01|0x0006) plen 3
Handle: 1 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) ncmd 2
Status: Success (0x00)
[...]
// Host suspends with the event filter set for the device
// On resume, the device tries to reconnect with a new handle
> HCI Event: Connect Complete (0x03) plen 11
Status: Success (0x00)
Handle: 2
Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd)
// Kernel ignores this event because there is an existing connection
with
// handle 1
```By explicitly setting the connection state to BT_CLOSED we can ensure a consistent state, even if we don't receive the disconnect complete event in time.
--- net/bluetooth/hci_event.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bluetooth/hci_event.c +6 -0
@@ -2718,6 +2718,12 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) goto done; } +/* During suspend, mark connection as closed immediately +* since we might not receive HCI_EV_DISCONN_COMPLETE +*/ +if (hdev->suspended) + conn->state =BT_CLOSED ; + mgmt_conn =test_and_clear_bit (HCI_CONN_MGMT_CONNECTED , &conn->flags);if (conn->type ==ACL_LINK ) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 49/142 Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 15bf2c6391bafb14a3020d06ec0761bce0803463 ]
This attempts to detect if HCI_EV_NUM_COMP_PKTS contain an unbalanced (more than currently considered outstanding) number of packets otherwise it could cause the hcon->sent to underflow and loop around breaking the tracking of the outstanding packets pending acknowledgment.
--- net/bluetooth/hci_event.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
net/bluetooth/hci_event.c +11 -1
@@ -4404,7 +4404,17 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,if (!conn)continue ; - conn->sent -= count; +/* Check if there is really enough packets outstanding before +* attempting to decrease the sent counter otherwise it could +* underflow.. +*/ +if (conn->sent >= count) { + conn->sent -= count; + }else { +bt_dev_warn (hdev,"hcon %p sent %u < count %u" , + conn, conn->sent, count); + conn->sent =0 ; + }for (i =0 ; i < count; ++i)hci_conn_tx_dequeue (conn);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 50/142 Bluetooth: hci_event: Disconnect device when BIG sync is lost
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Li <[email protected]>
[ Upstream commit 55b9551fcdf6a2fe7f3422918d5697b56794da72 ]
When a BIG sync is lost, the device should be set to "disconnected". This ensures symmetry with the ISO path setup, where the device is marked as "connected" once the path is established. Without this change, the device state remains inconsistent and may lead to a memory leak.
--- net/bluetooth/hci_event.c | 5 +++++ net/bluetooth/mgmt.c | 4 +++- 2 files changed, 8 insertions(+), 1 deletion(-)
net/bluetooth/hci_event.c +5 -0
@@ -7019,6 +7019,7 @@ static void hci_le_big_sync_lost_evt(struct hci_dev *hdev, void *data, {struct hci_evt_le_big_sync_lost *ev = data;struct hci_conn *bis, *conn; +bool mgmt_conn;bt_dev_dbg (hdev,"big handle 0x%2.2x" , ev->handle);
@@ -7037,6 +7038,10 @@ static void hci_le_big_sync_lost_evt(struct hci_dev *hdev, void *data,while ((bis =hci_conn_hash_lookup_big_state (hdev, ev->handle,BT_CONNECTED ,HCI_ROLE_SLAVE ))) { + mgmt_conn =test_and_clear_bit (HCI_CONN_MGMT_CONNECTED , &bis->flags); +mgmt_device_disconnected (hdev, &bis->dst, bis->type, bis->dst_type, + ev->reason, mgmt_conn); +clear_bit (HCI_CONN_BIG_SYNC , &bis->flags);hci_disconn_cfm (bis, ev->reason);hci_conn_del (bis);
net/bluetooth/mgmt.c +3 -1
@@ -9705,7 +9705,9 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,if (!mgmt_connected)return ; -if (link_type !=ACL_LINK && link_type !=LE_LINK ) +if (link_type !=ACL_LINK && + link_type !=LE_LINK && + link_type !=BIS_LINK )return ;bacpy (&ev.addr.bdaddr, bdaddr);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 51/142 Bluetooth: hci_sync: fix set_local_name race condition
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shpakovskiy <[email protected]>
[ Upstream commit 6bbd0d3f0c23fc53c17409dd7476f38ae0ff0cd9 ]
Function set_name_sync() uses hdev->dev_name field to send HCI_OP_WRITE_LOCAL_NAME command, but copying from data to hdev->dev_name is called after mgmt cmd was queued, so it is possible that function set_name_sync() will read old name value.
This change adds name as a parameter for function hci_update_name_sync() to avoid race condition.
--- include/net/bluetooth/hci_sync.h | 2 +- net/bluetooth/hci_sync.c | 6 +++--- net/bluetooth/mgmt.c | 5 ++++- 3 files changed, 8 insertions(+), 5 deletions(-)
include/net/bluetooth/hci_sync.h +1 -1
@@ -93,7 +93,7 @@ int hci_update_class_sync(struct hci_dev *hdev);int hci_update_eir_sync (struct hci_dev *hdev);int hci_update_class_sync (struct hci_dev *hdev); -int hci_update_name_sync (struct hci_dev *hdev); +int hci_update_name_sync (struct hci_dev *hdev,const u8 *name);int hci_write_ssp_mode_sync (struct hci_dev *hdev,u8 mode); int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
net/bluetooth/hci_sync.c +3 -3
@@ -3481,13 +3481,13 @@ int hci_update_scan_sync(struct hci_dev *hdev)return hci_write_scan_enable_sync (hdev, scan); } -int hci_update_name_sync (struct hci_dev *hdev) +int hci_update_name_sync (struct hci_dev *hdev,const u8 *name) {struct hci_cp_write_local_name cp;memset (&cp,0 ,sizeof (cp)); -memcpy (cp.name, hdev->dev_name,sizeof (cp.name)); +memcpy (cp.name, name,sizeof (cp.name)); return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp,
@@ -3540,7 +3540,7 @@ int hci_powered_update_sync(struct hci_dev *hdev)hci_write_fast_connectable_sync (hdev, false);hci_update_scan_sync (hdev);hci_update_class_sync (hdev); -hci_update_name_sync (hdev); +hci_update_name_sync (hdev, hdev->dev_name);hci_update_eir_sync (hdev); }
net/bluetooth/mgmt.c +4 -1
@@ -3892,8 +3892,11 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err)static int set_name_sync (struct hci_dev *hdev,void *data) { +struct mgmt_pending_cmd *cmd = data; +struct mgmt_cp_set_local_name *cp = cmd->param; +if (lmp_bredr_capable (hdev)) { -hci_update_name_sync (hdev); +hci_update_name_sync (hdev, cp->name);hci_update_eir_sync (hdev); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 52/142 page_pool: fix incorrect mp_ops error handling
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mina Almasry <[email protected]>
[ Upstream commit abadf0ff63be488dc502ecfc9f622929a21b7117 ]
Minor fix to the memory provider error handling, we should be jumping to free_ptr_ring in this error case rather than returning directly.
Found by code-inspection.
--- net/core/page_pool.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/core/page_pool.c +4 -2
@@ -287,8 +287,10 @@ static int page_pool_init(struct page_pool *pool, }if (pool->mp_ops) { -if (!pool->dma_map || !pool->dma_sync) -return -EOPNOTSUPP ; +if (!pool->dma_map || !pool->dma_sync) { + err = -EOPNOTSUPP ; + goto free_ptr_ring; + }if (WARN_ON (!is_kernel_rodata ((unsigned long )pool->mp_ops))) { err = -EFAULT ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 53/142 Octeontx2-vf: Fix max packet length errors
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hariprasad Kelam <[email protected]>
[ Upstream commit a64494aafc56939564e3e9e57f99df5c27204e04 ]
Once driver submits the packets to the hardware, each packet traverse through multiple transmit levels in the following order:
SMQ -> TL4 -> TL3 -> TL2 -> TL1
The SMQ supports configurable minimum and maximum packet sizes. It enters to a hang state, if driver submits packets with out of bound lengths.
To avoid the same, implement packet length validation before submitting packets to the hardware. Increment tx_dropped counter on failure.
--- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 4 +++- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 1 + .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 3 +++ .../net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 10 ++++++++++ drivers/net/ethernet/marvell/octeontx2/nic/rep.c | 13 ++++++++++++- drivers/net/ethernet/marvell/octeontx2/nic/rep.h | 1 + 6 files changed, 30 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +3 -1
@@ -124,7 +124,9 @@ void otx2_get_dev_stats(struct otx2_nic *pfvf) dev_stats->rx_ucast_frames; dev_stats->tx_bytes =OTX2_GET_TX_STATS (TX_OCTS ); - dev_stats->tx_drops =OTX2_GET_TX_STATS (TX_DROP ); + dev_stats->tx_drops =OTX2_GET_TX_STATS (TX_DROP ) + + (unsigned long )atomic_long_read (&dev_stats->tx_discards); + dev_stats->tx_bcast_frames =OTX2_GET_TX_STATS (TX_BCAST ); dev_stats->tx_mcast_frames =OTX2_GET_TX_STATS (TX_MCAST ); dev_stats->tx_ucast_frames =OTX2_GET_TX_STATS (TX_UCAST );
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +1 -0
@@ -149,6 +149,7 @@ struct otx2_dev_stats {u64 tx_bcast_frames;u64 tx_mcast_frames;u64 tx_drops; +atomic_long_t tx_discards; };/* Driver counted stats */
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +3 -0
@@ -2153,6 +2153,7 @@ static netdev_tx_t otx2_xmit(struct sk_buff *skb, struct net_device *netdev) {struct otx2_nic *pf =netdev_priv (netdev);int qidx =skb_get_queue_mapping (skb); +struct otx2_dev_stats *dev_stats;struct otx2_snd_queue *sq;struct netdev_queue *txq;int sq_idx;
@@ -2165,6 +2166,8 @@ static netdev_tx_t otx2_xmit(struct sk_buff *skb, struct net_device *netdev)/* Check for minimum and maximum packet length */ if (skb->len <=ETH_HLEN || (!skb_shinfo (skb)->gso_size && skb->len > pf->tx_max_pktlen)) { + dev_stats = &pf->hw.dev_stats; +atomic_long_inc (&dev_stats->tx_discards);dev_kfree_skb (skb);return NETDEV_TX_OK ; }
drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c +10 -0
@@ -391,9 +391,19 @@ static netdev_tx_t otx2vf_xmit(struct sk_buff *skb, struct net_device *netdev) {struct otx2_nic *vf =netdev_priv (netdev);int qidx =skb_get_queue_mapping (skb); +struct otx2_dev_stats *dev_stats;struct otx2_snd_queue *sq;struct netdev_queue *txq; +/* Check for minimum and maximum packet length */ +if (skb->len <=ETH_HLEN || + (!skb_shinfo (skb)->gso_size && skb->len > vf->tx_max_pktlen)) { + dev_stats = &vf->hw.dev_stats; +atomic_long_inc (&dev_stats->tx_discards); +dev_kfree_skb (skb); +return NETDEV_TX_OK ; + } + sq = &vf->qset.sq[qidx]; txq =netdev_get_tx_queue (netdev, qidx);
drivers/net/ethernet/marvell/octeontx2/nic/rep.c +12 -1
@@ -371,7 +371,8 @@ static void rvu_rep_get_stats(struct work_struct *work) stats->rx_mcast_frames = rsp->rx.mcast; stats->tx_bytes = rsp->tx.octs; stats->tx_frames = rsp->tx.ucast + rsp->tx.bcast + rsp->tx.mcast; - stats->tx_drops = rsp->tx.drop; + stats->tx_drops = rsp->tx.drop + + (unsigned long )atomic_long_read (&stats->tx_discards); exit:mutex_unlock (&priv->mbox.lock); }
@@ -418,6 +419,16 @@ static netdev_tx_t rvu_rep_xmit(struct sk_buff *skb, struct net_device *dev)struct otx2_nic *pf = rep->mdev;struct otx2_snd_queue *sq;struct netdev_queue *txq; +struct rep_stats *stats; + +/* Check for minimum and maximum packet length */ +if (skb->len <=ETH_HLEN || + (!skb_shinfo (skb)->gso_size && skb->len > pf->tx_max_pktlen)) { + stats = &rep->stats; +atomic_long_inc (&stats->tx_discards); +dev_kfree_skb (skb); +return NETDEV_TX_OK ; + } sq = &pf->qset.sq[rep->rep_id]; txq =netdev_get_tx_queue (dev,0 );
drivers/net/ethernet/marvell/octeontx2/nic/rep.h +1 -0
@@ -27,6 +27,7 @@ struct rep_stats {u64 tx_bytes;u64 tx_frames;u64 tx_drops; +atomic_long_t tx_discards; };struct rep_dev {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 54/142 atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit ec79003c5f9d2c7f9576fc69b8dbda80305cbe3a ]
syzbot reported the splat below. [0]
When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message.
The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc.
The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer.
struct atmtcp_control {
struct atmtcp_hdr hdr; /* must be first */
...
atm_kptr_t vcc; /* both directions */
...
} __ATM_API_ALIGN;
typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;The special message is processed in atmtcp_recv_control() called from atmtcp_c_send().
atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths:
1. .ndo_start_xmit() (vcc->send() == atm_send_aal0())
2. vcc_sendmsg()
The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control.
Let's add a new ->pre_send() hook to validate messages from sendmsg().
[0]:
Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 </TASK> Modules linked in:
--- drivers/atm/atmtcp.c | 17 ++++++++++++++--- include/linux/atmdev.h | 1 + net/atm/common.c | 15 ++++++++++++--- 3 files changed, 27 insertions(+), 6 deletions(-)
drivers/atm/atmtcp.c +14 -3
@@ -279,6 +279,19 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)return NULL ; } +static int atmtcp_c_pre_send (struct atm_vcc *vcc,struct sk_buff *skb) +{ +struct atmtcp_hdr *hdr; + +if (skb->len <sizeof (struct atmtcp_hdr )) +return -EINVAL ; + + hdr = (struct atmtcp_hdr *)skb->data; +if (hdr->length ==ATMTCP_HDR_MAGIC ) +return -EINVAL ; + +return 0 ; +}static int atmtcp_c_send (struct atm_vcc *vcc,struct sk_buff *skb) {
@@ -288,9 +301,6 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)struct sk_buff *new_skb;int result =0 ; -if (skb->len <sizeof (struct atmtcp_hdr )) - goto done; - dev = vcc->dev_data; hdr = (struct atmtcp_hdr *) skb->data;if (hdr->length ==ATMTCP_HDR_MAGIC ) {
@@ -347,6 +357,7 @@ static const struct atmdev_ops atmtcp_v_dev_ops = {static const struct atmdev_ops atmtcp_c_dev_ops = { .close = atmtcp_c_close, + .pre_send = atmtcp_c_pre_send, .send = atmtcp_c_send };
include/linux/atmdev.h +1 -0
@@ -185,6 +185,7 @@ struct atmdev_ops { /* only send is required */int (*compat_ioctl)(struct atm_dev *dev,unsigned int cmd,void __user *arg);#endif +int (*pre_send)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send_bh)(struct atm_vcc *vcc,struct sk_buff *skb);int (*send_oam)(struct atm_vcc *vcc,void *cell,int flags);
net/atm/common.c +12 -3
@@ -635,18 +635,27 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) skb->dev =NULL ;/* for paths shared with net_device interfaces */ if (!copy_from_iter_full (skb_put (skb, size), size, &m->msg_iter)) { -atm_return_tx (vcc, skb); -kfree_skb (skb); error = -EFAULT ; - goto out; + goto free_skb; }if (eff != size)memset (skb->data + size,0 , eff-size); + +if (vcc->dev->ops->pre_send) { + error = vcc->dev->ops->pre_send (vcc, skb); +if (error) + goto free_skb; + } + error = vcc->dev->ops->send (vcc, skb); error = error ? error : size; out:release_sock (sk);return error; +free_skb: +atm_return_tx (vcc, skb); +kfree_skb (skb); + goto out; }__poll_t vcc_poll (struct file *file,struct socket *sock,poll_table *wait)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 55/142 drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <[email protected]>
[ Upstream commit f529b8915543fb9ceb732cec5571f7fe12bc9530 ]
The 'tag' parameter is passed by value and is not actually used after being incremented, so remove the increment. It's the function that calls gm200_flcn_pio_imem_wr that is supposed to (and does) increment 'tag'.
--- drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c +1 -1
@@ -103,7 +103,7 @@ gm200_flcn_pio_imem_wr_init(struct nvkm_falcon *falcon, u8 port, bool sec, u32 istatic void gm200_flcn_pio_imem_wr (struct nvkm_falcon *falcon,u8 port,const u8 *img,int len,u16 tag) { -nvkm_falcon_wr32 (falcon,0x188 + (port *0x10 ), tag++); +nvkm_falcon_wr32 (falcon,0x188 + (port *0x10 ), tag);while (len >=4 ) {nvkm_falcon_wr32 (falcon,0x184 + (port *0x10 ), *(u32 *)img); img +=4 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 29/142 drm/msm: Defer fd_install in SUBMIT ioctl
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit f22853435bbd1e9836d0dce7fd99c040b94c2bf1 ]
Avoid fd_install() until there are no more potential error paths, to avoid put_unused_fd() after the fd is made visible to userspace.
Patchwork: https://patchwork.freedesktop.org/patch/665363/
--- drivers/gpu/drm/msm/msm_gem_submit.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/msm/msm_gem_submit.c +7 -7
@@ -869,12 +869,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,if (ret ==0 && args->flags &MSM_SUBMIT_FENCE_FD_OUT ) { sync_file =sync_file_create (submit->user_fence); -if (!sync_file) { +if (!sync_file) ret = -ENOMEM ; - }else { -fd_install (out_fence_fd, sync_file->file); - args->fence_fd = out_fence_fd; - } }if (ret)
@@ -902,10 +898,14 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, out_unlock:mutex_unlock (&queue->lock); out_post_unlock: -if (ret && (out_fence_fd >=0 )) { -put_unused_fd (out_fence_fd); +if (ret) { +if (out_fence_fd >=0 ) +put_unused_fd (out_fence_fd);if (sync_file)fput (sync_file->file); + }else if (sync_file) { +fd_install (out_fence_fd, sync_file->file); + args->fence_fd = out_fence_fd; }if (!IS_ERR_OR_NULL (submit)) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 56/142 drm/nouveau: remove unused memory target test
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <[email protected]>
[ Upstream commit 64c722b5e7f6b909b0e448e580f64628a0d76208 ]
The memory target check is a hold-over from a refactor. It's harmless but distracting, so just remove it.
--- drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
drivers/gpu/drm/nouveau/nvkm/falcon/gm200.c +3 -10
@@ -249,9 +249,11 @@ int gm200_flcn_fw_load(struct nvkm_falcon_fw *fw) {struct nvkm_falcon *falcon = fw->falcon; -int target, ret; +int ret;if (fw->inst) { +int target; +nvkm_falcon_mask (falcon,0x048 ,0x00000001 ,0x00000001 );switch (nvkm_memory_target (fw->inst)) {
@@ -285,15 +287,6 @@ gm200_flcn_fw_load(struct nvkm_falcon_fw *fw) }if (fw->boot) { -switch (nvkm_memory_target (&fw->fw.mem.memory)) { -case NVKM_MEM_TARGET_VRAM : target =4 ;break ; -case NVKM_MEM_TARGET_HOST : target =5 ;break ; -case NVKM_MEM_TARGET_NCOH : target =6 ;break ; -default : -WARN_ON (1 ); -return -EINVAL ; - } - ret =nvkm_falcon_pio_wr (falcon, fw->boot,0 ,0 ,IMEM , falcon->code.limit - fw->boot_size, fw->boot_size, fw->boot_addr >>8 , false);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 57/142 ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Tantilov <[email protected]>
[ Upstream commit 60dfe2434eed13082f26eb7409665dfafb38fa51 ]
Issuing a reset when the driver is loaded without RDMA support, will results in a crash as it attempts to remove RDMA's non-existent auxbus device:
echo 1 > /sys/class/net/<if>/device/reset
BUG: kernel NULL pointer dereference, address: 0000000000000008 ... RIP: 0010:ice_unplug_aux_dev+0x29/0x70 [ice] ... Call Trace: <TASK> ice_prepare_for_reset+0x77/0x260 [ice] pci_dev_save_and_disable+0x2c/0x70 pci_reset_function+0x88/0x130 reset_store+0x5a/0xa0 kernfs_fop_write_iter+0x15e/0x210 vfs_write+0x273/0x520 ksys_write+0x6b/0xe0 do_syscall_64+0x79/0x3b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
ice_unplug_aux_dev() checks pf->cdev_info->adev for NULL pointer, but pf->cdev_info will also be NULL, leading to the deref in the trace above.
Introduce a flag to be set when the creation of the auxbus device is successful, to avoid multiple NULL pointer checks in ice_unplug_aux_dev().
--- drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_idc.c | 10 ++++++---- 2 files changed, 7 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice.h +1 -0
@@ -509,6 +509,7 @@ enum ice_pf_flags {ICE_FLAG_LINK_LENIENT_MODE_ENA ,ICE_FLAG_PLUG_AUX_DEV ,ICE_FLAG_UNPLUG_AUX_DEV , +ICE_FLAG_AUX_DEV_CREATED ,ICE_FLAG_MTU_CHANGED ,ICE_FLAG_GNSS ,/* GNSS successfully initialized */ ICE_FLAG_DPLL, /* SyncE/PTP dplls initialized */
drivers/net/ethernet/intel/ice/ice_idc.c +6 -4
@@ -336,6 +336,7 @@ int ice_plug_aux_dev(struct ice_pf *pf)mutex_lock (&pf->adev_mutex); cdev->adev = adev;mutex_unlock (&pf->adev_mutex); +set_bit (ICE_FLAG_AUX_DEV_CREATED , pf->flags);return 0 ; }
@@ -347,15 +348,16 @@ void ice_unplug_aux_dev(struct ice_pf *pf) {struct auxiliary_device *adev; +if (!test_and_clear_bit (ICE_FLAG_AUX_DEV_CREATED , pf->flags)) +return ; +mutex_lock (&pf->adev_mutex); adev = pf->cdev_info->adev; pf->cdev_info->adev =NULL ;mutex_unlock (&pf->adev_mutex); -if (adev) { -auxiliary_device_delete (adev); -auxiliary_device_uninit (adev); - } +auxiliary_device_delete (adev); +auxiliary_device_uninit (adev); }/**
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 58/142 ice: dont leave device non-functional if Tx scheduler config fails
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 86aae43f21cf784c1d7f6a9af93e5116b0f232ab ]
The ice_cfg_tx_topo function attempts to apply Tx scheduler topology configuration based on NVM parameters, selecting either a 5 or 9 layer topology.
As part of this flow, the driver acquires the "Global Configuration Lock", which is a hardware resource associated with programming the DDP package to the device. This "lock" is implemented by firmware as a way to guarantee that only one PF can program the DDP for a device. Unlike a traditional lock, once a PF has acquired this lock, no other PF will be able to acquire it again (including that PF) until a CORER of the device. Future requests to acquire the lock report that global configuration has already completed.
The following flow is used to program the Tx topology:
* Read the DDP package for scheduler configuration data
* Acquire the global configuration lock
* Program Tx scheduler topology according to DDP package data
* Trigger a CORER which clears the global configuration lock
This is followed by the flow for programming the DDP package:
* Acquire the global configuration lock (again)
* Download the DDP package to the device
* Release the global configuration lock.
However, if configuration of the Tx topology fails, (i.e. ice_get_set_tx_topo returns an error code), the driver exits ice_cfg_tx_topo() immediately, and fails to trigger CORER.
While the global configuration lock is held, the firmware rejects most AdminQ commands, as it is waiting for the DDP package download (or Tx scheduler topology programming) to occur.
The current driver flows assume that the global configuration lock has been reset by CORER after programming the Tx topology. Thus, the same PF attempts to acquire the global lock again, and fails. This results in the driver reporting "an unknown error occurred when loading the DDP package". It then attempts to enter safe mode, but ultimately fails to finish ice_probe() since nearly all AdminQ command report error codes, and the driver stops loading the device at some point during its initialization.
The only currently known way that ice_get_set_tx_topo() can fail is with certain older DDP packages which contain invalid topology configuration, on firmware versions which strictly validate this data. The most recent releases of the DDP have resolved the invalid data. However, it is still poor practice to essentially brick the device, and prevent access to the device even through safe mode or recovery mode. It is also plausible that this command could fail for some other reason in the future.
We cannot simply release the global lock after a failed call to ice_get_set_tx_topo(). Releasing the lock indicates to firmware that global configuration (downloading of the DDP) has completed. Future attempts by this or other PFs to load the DDP will fail with a report that the DDP package has already been downloaded. Then, PFs will enter safe mode as they realize that the package on the device does not meet the minimum version requirement to load. The reported error messages are confusing, as they indicate the version of the default "safe mode" package in the NVM, rather than the version of the file loaded from /lib/firmware.
Instead, we need to trigger CORER to clear global configuration. This is the lowest level of hardware reset which clears the global configuration lock and related state. It also clears any already downloaded DDP. Crucially, it does *not* clear the Tx scheduler topology configuration.
Refactor ice_cfg_tx_topo() to always trigger a CORER after acquiring the global lock, regardless of success or failure of the topology configuration.
We need to re-initialize the HW structure when we trigger the CORER. Thus, it makes sense for this to be the responsibility of ice_cfg_tx_topo() rather than its caller, ice_init_tx_topology(). This avoids needless re-initialization in cases where we don't attempt to update the Tx scheduler topology, such as if it has already been programmed.
There is one catch: failure to re-initialize the HW struct should stop ice_probe(). If this function fails, we won't have a valid HW structure and cannot ensure the device is functioning properly. To handle this, ensure ice_cfg_tx_topo() returns a limited set of error codes. Set aside one specifically, -ENODEV, to indicate that the ice_init_tx_topology() should fail and stop probe.
Other error codes indicate failure to apply the Tx scheduler topology. This is treated as a non-fatal error, with an informational message informing the system administrator that the updated Tx topology did not apply. This allows the device to load and function with the default Tx scheduler topology, rather than failing to load entirely.
Note that this use of CORER will not result in loops with future PFs attempting to also load the invalid Tx topology configuration. The first PF will acquire the global configuration lock as part of programming the DDP. Each PF after this will attempt to acquire the global lock as part of programming the Tx topology, and will fail with the indication from firmware that global configuration is already complete. Tx scheduler topology configuration is only performed during driver init (probe or devlink reload) and not during cleanup for a CORER that happens after probe completes.
--- drivers/net/ethernet/intel/ice/ice_ddp.c | 44 ++++++++++++++++------- drivers/net/ethernet/intel/ice/ice_main.c | 16 ++++++--- 2 files changed, 43 insertions(+), 17 deletions(-)
drivers/net/ethernet/intel/ice/ice_ddp.c +32 -12
@@ -2376,7 +2376,13 @@ ice_get_set_tx_topo(struct ice_hw *hw, u8 *buf, u16 buf_size,* The function will apply the new Tx topology from the package buffer * if available. * -* Return: zero when update was successful, negative values otherwise. +* Return: +* * 0 - Successfully applied topology configuration. +* * -EBUSY - Failed to acquire global configuration lock. +* * -EEXIST - Topology configuration has already been applied. +* * -EIO - Unable to apply topology configuration. +* * -ENODEV - Failed to re-initialize device after applying configuration. +* * Other negative error codes indicate unexpected failures. */ int ice_cfg_tx_topo (struct ice_hw *hw,const void *buf,u32 len) {
@@ -2409,7 +2415,7 @@ int ice_cfg_tx_topo(struct ice_hw *hw, const void *buf, u32 len)if (status) {ice_debug (hw,ICE_DBG_INIT ,"Get current topology is failed\n" ); -return status; +return -EIO ; }/* Is default topology already applied ? */
@@ -2496,31 +2502,45 @@ int ice_cfg_tx_topo(struct ice_hw *hw, const void *buf, u32 len) ICE_GLOBAL_CFG_LOCK_TIMEOUT);if (status) {ice_debug (hw,ICE_DBG_INIT ,"Failed to acquire global lock\n" ); -return status; +return -EBUSY ; }/* Check if reset was triggered already. */ reg =rd32 (hw,GLGEN_RSTAT );if (reg &GLGEN_RSTAT_DEVSTATE_M ) { -/* Reset is in progress, re-init the HW again */ ice_debug (hw,ICE_DBG_INIT ,"Reset is in progress. Layer topology might be applied already\n" );ice_check_reset (hw); -return 0 ; +/* Reset is in progress, re-init the HW again */ + goto reinit_hw; }/* Set new topology */ status =ice_get_set_tx_topo (hw, new_topo, size,NULL ,NULL , true);if (status) { -ice_debug (hw,ICE_DBG_INIT ,"Failed setting Tx topology\n" ); -return status; +ice_debug (hw,ICE_DBG_INIT ,"Failed to set Tx topology, status %pe\n" , +ERR_PTR (status)); +/* only report -EIO here as the caller checks the error value +* and reports an informational error message informing that +* the driver failed to program Tx topology. +*/ + status = -EIO ; } -/* New topology is updated, delay 1 second before issuing the CORER */ +/* Even if Tx topology config failed, we need to CORE reset here to +* clear the global configuration lock. Delay 1 second to allow +* hardware to settle then issue a CORER +*/ msleep (1000 );ice_reset (hw,ICE_RESET_CORER ); -/* CORER will clear the global lock, so no explicit call -* required for release. -*/ +ice_check_reset (hw); + +reinit_hw: +/* Since we triggered a CORER, re-initialize hardware */ +ice_deinit_hw (hw); +if (ice_init_hw (hw)) { +ice_debug (hw,ICE_DBG_INIT ,"Failed to re-init hardware after setting Tx topology\n" ); +return -ENODEV ; + } -return 0 ; +return status; }
drivers/net/ethernet/intel/ice/ice_main.c +11 -5
@@ -4532,17 +4532,23 @@ ice_init_tx_topology(struct ice_hw *hw, const struct firmware *firmware)dev_info (dev,"Tx scheduling layers switching feature disabled\n" ); else dev_info(dev, "Tx scheduling layers switching feature enabled\n"); -/* if there was a change in topology ice_cfg_tx_topo triggered -* a CORER and we need to re-init hw +return 0 ; + }else if (err == -ENODEV ) { +/* If we failed to re-initialize the device, we can no longer +* continue loading. */ -ice_deinit_hw (hw); - err =ice_init_hw (hw); - +dev_warn (dev,"Failed to initialize hardware after applying Tx scheduling configuration.\n" );return err; }else if (err == -EIO ) {dev_info (dev,"DDP package does not support Tx scheduling layers switching feature - please update to the latest DDP package and try again\n" ); +return 0 ; + }else if (err == -EEXIST ) { +return 0 ; } +/* Do not treat this as a fatal error. */ +dev_info (dev,"Failed to apply Tx scheduling configuration, err %pe\n" , +ERR_PTR (err));return 0 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 59/142 ice: use fixed adapter index for E825C embedded devices
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <[email protected]>
[ Upstream commit 5c5e5b52bf05c7fe88768318c041052c5fac36b8 ]
The ice_adapter structure is used by the ice driver to connect multiple physical functions of a device in software. It was introduced by commit 0e2bddf9e5f9 ("ice: add ice_adapter for shared data across PFs on the same NIC") and is primarily used for PTP support, as well as for handling certain cross-PF synchronization.
The original design of ice_adapter used PCI address information to determine which devices should be connected. This was extended to support E825C devices by commit fdb7f54700b1 ("ice: Initial support for E825C hardware in ice_adapter"), which used the device ID for E825C devices instead of the PCI address.
Later, commit 0093cb194a75 ("ice: use DSN instead of PCI BDF for ice_adapter index") replaced the use of Bus/Device/Function addressing with use of the device serial number.
E825C devices may appear in "Dual NAC" configuration which has multiple physical devices tied to the same clock source and which need to use the same ice_adapter. Unfortunately, each "NAC" has its own NVM which has its own unique Device Serial Number. Thus, use of the DSN for connecting ice_adapter does not work properly. It "worked" in the pre-production systems because the DSN was not initialized on the test NVMs and all the NACs had the same zero'd serial number.
Since we cannot rely on the DSN, lets fall back to the logic in the original E825C support which used the device ID. This is safe for E825C only because of the embedded nature of the device. It isn't a discreet adapter that can be plugged into an arbitrary system. All E825C devices on a given system are connected to the same clock source and need to be configured through the same PTP clock.
To make this separation clear, reserve bit 63 of the 64-bit index values as a "fixed index" indicator. Always clear this bit when using the device serial number as an index.
For E825C, use a fixed value defined as the 0x579C E825C backplane device ID bitwise ORed with the fixed index indicator. This is slightly different than the original logic of just using the device ID directly. Doing so prevents a potential issue with systems where only one of the NACs is connected with an external PHY over SGMII. In that case, one NAC would have the E825C_SGMII device ID, but the other would not.
Separate the determination of the full 64-bit index from the 32-bit reduction logic. Provide both ice_adapter_index() and a wrapping ice_adapter_xa_index() which handles reducing the index to a long on 32-bit systems. As before, cache the full index value in the adapter structure to warn about collisions.
This fixes issues with E825C not initializing PTP on both NACs, due to failure to connect the appropriate devices to the same ice_adapter.
--- drivers/net/ethernet/intel/ice/ice_adapter.c | 49 +++++++++++++++----- drivers/net/ethernet/intel/ice/ice_adapter.h | 4 +- 2 files changed, 40 insertions(+), 13 deletions(-)
drivers/net/ethernet/intel/ice/ice_adapter.c +38 -11
@@ -13,16 +13,45 @@static DEFINE_XARRAY (ice_adapters);static DEFINE_MUTEX (ice_adapters_mutex); -static unsigned long ice_adapter_index (u64 dsn) +#define ICE_ADAPTER_FIXED_INDEX BIT_ULL(63) + +#define ICE_ADAPTER_INDEX_E825C \ + (ICE_DEV_ID_E825C_BACKPLANE | ICE_ADAPTER_FIXED_INDEX) + +static u64 ice_adapter_index (struct pci_dev *pdev) { +switch (pdev->device) { +case ICE_DEV_ID_E825C_BACKPLANE : +case ICE_DEV_ID_E825C_QSFP : +case ICE_DEV_ID_E825C_SFP : +case ICE_DEV_ID_E825C_SGMII : +/* E825C devices have multiple NACs which are connected to the +* same clock source, and which must share the same +* ice_adapter structure. We can't use the serial number since +* each NAC has its own NVM generated with its own unique +* Device Serial Number. Instead, rely on the embedded nature +* of the E825C devices, and use a fixed index. This relies on +* the fact that all E825C physical functions in a given +* system are part of the same overall device. +*/ +return ICE_ADAPTER_INDEX_E825C ; +default : +return pci_get_dsn (pdev) & ~ICE_ADAPTER_FIXED_INDEX ; + } +} + +static unsigned long ice_adapter_xa_index (struct pci_dev *pdev) +{ +u64 index =ice_adapter_index (pdev); +#if BITS_PER_LONG ==64 -return dsn; +return index;#else -return (u32 )dsn ^ (u32)(dsn >>32 ); +return (u32 )index ^ (u32)(index >>32 );#endif } -static struct ice_adapter *ice_adapter_new (u64 dsn) +static struct ice_adapter *ice_adapter_new (struct pci_dev *pdev) {struct ice_adapter *adapter;
@@ -30,7 +59,7 @@ static struct ice_adapter *ice_adapter_new(u64 dsn)if (!adapter)return NULL ; - adapter->device_serial_number = dsn; + adapter->index =ice_adapter_index (pdev);spin_lock_init (&adapter->ptp_gltsyn_time_lock);refcount_set (&adapter->refcount,1 );
@@ -63,24 +92,23 @@ static void ice_adapter_free(struct ice_adapter *adapter)*/ struct ice_adapter *ice_adapter_get (struct pci_dev *pdev) { -u64 dsn =pci_get_dsn (pdev);struct ice_adapter *adapter;unsigned long index;int err; - index =ice_adapter_index (dsn); + index =ice_adapter_xa_index (pdev); scoped_guard(mutex, &ice_adapters_mutex) { err =xa_insert (&ice_adapters, index,NULL ,GFP_KERNEL );if (err == -EBUSY ) { adapter =xa_load (&ice_adapters, index);refcount_inc (&adapter->refcount); -WARN_ON_ONCE (adapter->device_serial_number != dsn); +WARN_ON_ONCE (adapter->index !=ice_adapter_index (pdev));return adapter; }if (err)return ERR_PTR (err); - adapter =ice_adapter_new (dsn); + adapter =ice_adapter_new (pdev);if (!adapter)return ERR_PTR (-ENOMEM );xa_store (&ice_adapters, index, adapter,GFP_KERNEL );
@@ -99,11 +127,10 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev)*/ void ice_adapter_put (struct pci_dev *pdev) { -u64 dsn =pci_get_dsn (pdev);struct ice_adapter *adapter;unsigned long index; - index =ice_adapter_index (dsn); + index =ice_adapter_xa_index (pdev); scoped_guard(mutex, &ice_adapters_mutex) { adapter =xa_load (&ice_adapters, index);if (WARN_ON (!adapter))
drivers/net/ethernet/intel/ice/ice_adapter.h +2 -2
@@ -32,7 +32,7 @@ struct ice_port_list {* @refcount: Reference count. struct ice_pf objects hold the references. * @ctrl_pf: Control PF of the adapter * @ports: Ports list -* @device_serial_number: DSN cached for collision detection on 32bit systems +* @index: 64-bit index cached for collision detection on 32bit systems */ struct ice_adapter {refcount_t refcount;
@@ -41,7 +41,7 @@ struct ice_adapter {struct ice_pf *ctrl_pf;struct ice_port_list ports; -u64 device_serial_number; +u64 index; };struct ice_adapter *ice_adapter_get (struct pci_dev *pdev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 30/142 of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oreoluwa Babatunde <[email protected]>
[ Upstream commit 2c223f7239f376a90d71903ec474ba887cf21d94 ]
Restructure the call site for dma_contiguous_early_fixup() to where the reserved_mem nodes are being parsed from the DT so that dma_mmu_remap[] is populated before dma_contiguous_remap() is called.
--- drivers/of/of_reserved_mem.c | 16 ++++++++++++---- include/linux/dma-map-ops.h | 3 +++ kernel/dma/contiguous.c | 2 -- 3 files changed, 15 insertions(+), 6 deletions(-)
drivers/of/of_reserved_mem.c +12 -4
@@ -25,6 +25,7 @@#include <linux/memblock.h> #include <linux/kmemleak.h> #include <linux/cma.h> +#include <linux/dma-map-ops.h> #include "of_private.h"
@@ -175,13 +176,17 @@ static int __init __reserved_mem_reserve_reg(unsigned long node, base =dt_mem_next_cell (dt_root_addr_cells, &prop); size =dt_mem_next_cell (dt_root_size_cells, &prop); -if (size && -early_init_dt_reserve_memory (base, size, nomap) ==0 ) +if (size &&early_init_dt_reserve_memory (base, size, nomap) ==0 ) { +/* Architecture specific contiguous memory fixup. */ +if (of_flat_dt_is_compatible (node,"shared-dma-pool" ) && +of_get_flat_dt_prop (node,"reusable" ,NULL )) +dma_contiguous_early_fixup (base, size);pr_debug ("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n" , uname, &base, (unsigned long )(size /SZ_1M )); -else + }else {pr_err ("Reserved memory: failed to reserve memory for node '%s': base %pa, size %lu MiB\n" , uname, &base, (unsigned long )(size /SZ_1M )); + } len -= t_len; }
@@ -472,7 +477,10 @@ static int __init __reserved_mem_alloc_size(unsigned long node, const char *unam uname, (unsigned long)(size / SZ_1M));return -ENOMEM ; } - +/* Architecture specific contiguous memory fixup. */ +if (of_flat_dt_is_compatible (node,"shared-dma-pool" ) && +of_get_flat_dt_prop (node,"reusable" ,NULL )) +dma_contiguous_early_fixup (base, size);/* Save region in the reserved_mem array */ fdt_reserved_mem_save_node (node, uname, base, size);return 0 ;
include/linux/dma-map-ops.h +3 -0
@@ -153,6 +153,9 @@ static inline void dma_free_contiguous(struct device *dev, struct page *page, {__free_pages (page,get_order (size)); } +static inline void dma_contiguous_early_fixup (phys_addr_t base,unsigned long size) +{ +}#endif /* CONFIG_DMA_CMA*/ #ifdef CONFIG_DMA_DECLARE_COHERENT
kernel/dma/contiguous.c +0 -2
@@ -483,8 +483,6 @@ static int __init rmem_cma_setup(struct reserved_mem *rmem)pr_err ("Reserved memory: unable to setup CMA region\n" );return err; } -/* Architecture specific contiguous memory fixup. */ -dma_contiguous_early_fixup (rmem->base, rmem->size);if (default_cma) dma_contiguous_default_area = cma;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 31/142 HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
[ Upstream commit 1db9df89a213318a48d958385dc1b17b379dc32b ]
The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined.
It caused stack-out-of-bounds and kernel crash:
kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]
kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75
kernel:
kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary) kernel: Workqueue: async async_run_entry_fn kernel: Call Trace: kernel: <TASK> kernel: dump_stack_lvl+0x76/0xa0 kernel: print_report+0xd1/0x660 kernel: ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kernel: ? __kasan_slab_free+0x5d/0x80 kernel: ? kasan_addr_to_slab+0xd/0xb0 kernel: kasan_report+0xe1/0x120 kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: kasan_check_range+0x11c/0x200 kernel: __asan_memcpy+0x3b/0x80 kernel: quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c] kernel: quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c] [...] kernel: </TASK> kernel: kernel: The buggy address belongs to stack of task kworker/u33:2/75 kernel: and is located at offset 48 in frame: kernel: quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c] kernel: kernel: This frame has 3 objects: kernel: [32, 36) 'hid_desc_addr' kernel: [48, 59) 'i2c_param' kernel: [80, 224) 'i2c_config'
ACPI DSD methods return:
\_SB.PC00.THC0.ICRS Buffer 000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00
\_SB.PC00.THC0.ISUB Buffer 00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00
Adding reserved padding to quicki2c_subip_acpi_parameter/config.
--- drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h +2 -0
@@ -71,6 +71,7 @@ struct quicki2c_subip_acpi_parameter {u16 device_address;u64 connection_speed;u8 addressing_mode; +u8 reserved; } __packed;/**
@@ -120,6 +121,7 @@ struct quicki2c_subip_acpi_config {u64 HMTD ;u64 HMRD ;u64 HMSL ; +u8 reserved; };struct device ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 32/142 HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
[ Upstream commit a7fc15ed629be89e51e09b743277c53e0a0168f5 ]
Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0)
Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
--- drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c +2 -2
@@ -1539,7 +1539,7 @@ int thc_i2c_subip_regs_save(struct thc_device *dev)for (int i =0 ; i <ARRAY_SIZE (i2c_subip_regs); i++) { ret =thc_i2c_subip_pio_read (dev, i2c_subip_regs[i], - &read_size, (u32 *)&dev->i2c_subip_regs + i); + &read_size, &dev->i2c_subip_regs[i]);if (ret <0 )return ret; }
@@ -1562,7 +1562,7 @@ int thc_i2c_subip_regs_restore(struct thc_device *dev)for (int i =0 ; i <ARRAY_SIZE (i2c_subip_regs); i++) { ret =thc_i2c_subip_pio_write (dev, i2c_subip_regs[i], - write_size, (u32 *)&dev->i2c_subip_regs + i); + write_size, &dev->i2c_subip_regs[i]);if (ret <0 )return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 33/142 HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Even Xu <[email protected]>
[ Upstream commit afa17a09c699410113199dc15256c6ea2b4133f7 ]
After driver module is removed and during re-install stage, if there is continueous user touching on the screen, it is a risk impacting THC hardware initialization which causes driver installation failure.
This patch enhances this flow by quiescing the external touch interrupt after driver is removed which keeps THC hardware ignore external interrupt during this remove and re-install stage.
--- drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c +1 -0
@@ -406,6 +406,7 @@ static struct quicki2c_device *quicki2c_dev_init(struct pci_dev *pdev, void __io*/ static void quicki2c_dev_deinit (struct quicki2c_device *qcdev) { +thc_interrupt_quiesce (qcdev->thc_hw, true);thc_interrupt_enable (qcdev->thc_hw, false);thc_ltr_unconfig (qcdev->thc_hw);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 34/142 drm/msm/kms: move snapshot init earlier in KMS init
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 553666f839b86545300773954df7426a45c169c4 ]
Various parts of the display driver can be triggering the display snapshot (including the IOMMU fault handlers). Move the call to msm_disp_snapshot_init() before KMS initialization, otherwise it is possible to ocassionally trigger the kernel fault during init:
__lock_acquire+0x44/0x2798 (P) lock_acquire+0x114/0x25c _raw_spin_lock_irqsave+0x6c/0x90 kthread_queue_work+0x2c/0xac msm_disp_snapshot_state+0x2c/0x4c msm_kms_fault_handler+0x2c/0x74 msm_disp_fault_handler+0x30/0x48 report_iommu_fault+0x54/0x128 arm_smmu_context_fault+0x74/0x184 __handle_irq_event_percpu+0xa4/0x24c handle_irq_event_percpu+0x20/0x5c handle_irq_event+0x48/0x84 handle_fasteoi_irq+0xcc/0x170 generic_handle_domain_irq+0x48/0x70 gic_handle_irq+0x54/0x11c call_on_irq_stack+0x3c/0x50 do_interrupt_handler+0x54/0x78 el1_interrupt+0x3c/0x5c el1h_64_irq_handler+0x20/0x30 el1h_64_irq+0x6c/0x70 _raw_spin_unlock_irqrestore+0x44/0x68 (P) klist_next+0xc4/0x124 bus_for_each_drv+0x9c/0xe8 __device_attach+0xfc/0x190 device_initial_probe+0x1c/0x2c bus_probe_device+0x44/0xa0 device_add+0x204/0x3e4 platform_device_add+0x170/0x244 platform_device_register_full+0x130/0x138 drm_connector_hdmi_audio_init+0xc0/0x108 drm_bridge_connector_init+0x318/0x394 msm_dsi_manager_connector_init+0xac/0xdc msm_dsi_modeset_init+0x78/0xc0 _dpu_kms_drm_obj_init+0x198/0x75c dpu_kms_hw_init+0x2f8/0x494 msm_drm_kms_init+0xb0/0x230 msm_drm_init+0x218/0x250 msm_drm_bind+0x3c/0x4c try_to_bring_up_aggregate_device+0x208/0x2a4 __component_add+0xa8/0x188 component_add+0x1c/0x2c dsi_dev_attach+0x24/0x34 dsi_host_attach+0x68/0xa0 devm_mipi_dsi_attach+0x40/0xcc lt9611_attach_dsi+0x94/0x118 lt9611_probe+0x368/0x3c8 i2c_device_probe+0x2d0/0x3d8 really_probe+0x130/0x354 __driver_probe_device+0xac/0x110 driver_probe_device+0x44/0x110 __device_attach_driver+0xb0/0x138 bus_for_each_drv+0x90/0xe8 __device_attach+0xfc/0x190 device_initial_probe+0x1c/0x2c bus_probe_device+0x44/0xa0 deferred_probe_work_func+0xac/0x110 process_one_work+0x20c/0x51c process_scheduled_works+0x58/0x88 worker_thread+0x1ec/0x304 kthread+0x194/0x1d4 ret_from_fork+0x10/0x20
Patchwork: https://patchwork.freedesktop.org/patch/664149/
--- drivers/gpu/drm/msm/msm_kms.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/msm_kms.c +6 -4
@@ -258,6 +258,12 @@ int msm_drm_kms_init(struct device *dev, const struct drm_driver *drv)if (ret)return ret; + ret =msm_disp_snapshot_init (ddev); +if (ret) { +DRM_DEV_ERROR (dev,"msm_disp_snapshot_init failed ret = %d\n" , ret); +return ret; + } + ret = priv->kms_init (ddev);if (ret) {DRM_DEV_ERROR (dev,"failed to load kms\n" );
@@ -310,10 +316,6 @@ int msm_drm_kms_init(struct device *dev, const struct drm_driver *drv) goto err_msm_uninit; } - ret =msm_disp_snapshot_init (ddev); -if (ret) -DRM_DEV_ERROR (dev,"msm_disp_snapshot_init failed ret = %d\n" , ret); -drm_mode_config_reset (ddev);return 0 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 35/142 drm/msm/dpu: correct dpu_plane_virtual_atomic_check()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 1a76b255eceb9c570c6228f6393e1d63d97a22ba ]
Fix c&p error in dpu_plane_virtual_atomic_check(), compare CRTC width too, in addition to CRTC height.
Patchwork: https://patchwork.freedesktop.org/patch/664170/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +1 -1
@@ -1169,7 +1169,7 @@ static int dpu_plane_virtual_atomic_check(struct drm_plane *plane,if (!old_plane_state || !old_plane_state->fb || old_plane_state->src_w != plane_state->src_w || old_plane_state->src_h != plane_state->src_h || - old_plane_state->src_w != plane_state->src_w || + old_plane_state->crtc_w != plane_state->crtc_w || old_plane_state->crtc_h != plane_state->crtc_h ||msm_framebuffer_format (old_plane_state->fb) !=msm_framebuffer_format (plane_state->fb))
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 26/142 platform/x86: int3472: add hpd pin support
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongcheng Yan <[email protected]>
commit a032fe30cf09b6723ab61a05aee057311b00f9e1 upstream.
Typically HDMI to MIPI CSI-2 bridges have a pin to signal image data is being received. On the host side this is wired to a GPIO for polling or interrupts. This includes the Lontium HDMI to MIPI CSI-2 bridges lt6911uxe and lt6911uxc.
The GPIO "hpd" is used already by other HDMI to CSI-2 bridges, use it here as well.
--- drivers/platform/x86/intel/int3472/discrete.c | 6 ++++++ include/linux/platform_data/x86/int3472.h | 1 + 2 files changed, 7 insertions(+)
drivers/platform/x86/intel/int3472/discrete.c +6 -0
@@ -193,6 +193,10 @@ static void int3472_get_con_id_and_polar *con_id ="privacy-led" ; *gpio_flags =GPIO_ACTIVE_HIGH ;break ; +case INT3472_GPIO_TYPE_HOTPLUG_DETECT : + *con_id ="hpd" ; + *gpio_flags =GPIO_ACTIVE_HIGH ; +break ;case INT3472_GPIO_TYPE_POWER_ENABLE : *con_id ="avdd" ; *gpio_flags =GPIO_ACTIVE_HIGH ;
@@ -223,6 +227,7 @@ static void int3472_get_con_id_and_polar* 0x0b Power enable * 0x0c Clock enable * 0x0d Privacy LED +* 0x13 Hotplug detect * * There are some known platform specific quirks where that does not quite * hold up; for example where a pin with type 0x01 (Power down) is mapped to
@@ -292,6 +297,7 @@ static int skl_int3472_handle_gpio_resouswitch (type) {case INT3472_GPIO_TYPE_RESET :case INT3472_GPIO_TYPE_POWERDOWN : +case INT3472_GPIO_TYPE_HOTPLUG_DETECT : ret =skl_int3472_map_gpio_to_sensor (int3472, agpio, con_id, gpio_flags);if (ret) err_msg ="Failed to map GPIO pin to sensor\n" ;
include/linux/platform_data/x86/int3472.h +1 -0
@@ -27,6 +27,7 @@#define INT3472_GPIO_TYPE_CLK_ENABLE 0x0c#define INT3472_GPIO_TYPE_PRIVACY_LED 0x0d#define INT3472_GPIO_TYPE_HANDSHAKE 0x12 +#define INT3472_GPIO_TYPE_HOTPLUG_DETECT 0x13#define INT3472_PDEV_MAX_NAME_LEN 23#define INT3472_MAX_SENSOR_GPIOS 3
Greg Kroah-Hartman
maintainerPATCH 61/142 ixgbe: fix ixgbe_orom_civd_info struct layout
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jedrzej Jagielski <[email protected]>
[ Upstream commit ed913b343dcf9f623e7436fa1a153c89b22d109b ]
The current layout of struct ixgbe_orom_civd_info causes incorrect data storage due to compiler-inserted padding. This results in issues when writing OROM data into the structure.
Add the __packed attribute to ensure the structure layout matches the expected binary format without padding.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_type_e610.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c +1 -1
@@ -3123,7 +3123,7 @@ static int ixgbe_get_orom_ver_info(struct ixgbe_hw *hw,if (err)return err; - combo_ver =le32_to_cpu (civd.combo_ver); + combo_ver =get_unaligned_le32 (&civd.combo_ver); orom->major = (u8 )FIELD_GET (IXGBE_OROM_VER_MASK , combo_ver); orom->patch = (u8 )FIELD_GET (IXGBE_OROM_VER_PATCH_MASK , combo_ver);
drivers/net/ethernet/intel/ixgbe/ixgbe_type_e610.h +1 -1
@@ -1150,7 +1150,7 @@ struct ixgbe_orom_civd_info {__le32 combo_ver;/* Combo Image Version number */ u8 combo_name_len;/* Length of the unicode combo image version string, max of 32 */ __le16 combo_name[32 ];/* Unicode string representing the Combo Image version */ -}; +} __packed;/* Function specific capabilities */ struct ixgbe_hw_func_caps {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 70/142 drm/xe/vm: Dont pin the vm_resv during validation
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
[ Upstream commit 7551865cd12af2dc47e5a174eebcfb0b94b5449b ]
The pinning has the odd side-effect that unlocking *any* resv during validation triggers an "unlocking pinned lock" warning.
--- drivers/gpu/drm/xe/xe_bo.c | 5 ++--- drivers/gpu/drm/xe/xe_vm.h | 15 ++------------- 2 files changed, 4 insertions(+), 16 deletions(-)
drivers/gpu/drm/xe/xe_bo.c +2 -3
@@ -2435,7 +2435,6 @@ int xe_bo_validate(struct xe_bo *bo, struct xe_vm *vm, bool allow_res_evict) .no_wait_gpu = false, .gfp_retry_mayfail = true, }; -struct pin_cookie cookie;int ret;if (vm) {
@@ -2446,10 +2445,10 @@ int xe_bo_validate(struct xe_bo *bo, struct xe_vm *vm, bool allow_res_evict) ctx.resv =xe_vm_resv (vm); } - cookie =xe_vm_set_validating (vm, allow_res_evict); +xe_vm_set_validating (vm, allow_res_evict);trace_xe_bo_validate (bo); ret =ttm_bo_validate (&bo->ttm, &bo->placement, &ctx); -xe_vm_clear_validating (vm, allow_res_evict, cookie); +xe_vm_clear_validating (vm, allow_res_evict);return ret; }
drivers/gpu/drm/xe/xe_vm.h +2 -13
@@ -310,22 +310,14 @@ void xe_vm_snapshot_free(struct xe_vm_snapshot *snap);* Register this task as currently making bos resident for the vm. Intended * to avoid eviction by the same task of shared bos bound to the vm. * Call with the vm's resv lock held. -* -* Return: A pin cookie that should be used for xe_vm_clear_validating(). */ -static inline struct pin_cookie xe_vm_set_validating (struct xe_vm *vm, -bool allow_res_evict) +static inline void xe_vm_set_validating (struct xe_vm *vm,bool allow_res_evict) { -struct pin_cookie cookie = {}; -if (vm && !allow_res_evict) {xe_vm_assert_held (vm); - cookie =lockdep_pin_lock (&xe_vm_resv (vm)->lock.base);/* Pairs with READ_ONCE in xe_vm_is_validating() */ WRITE_ONCE (vm->validating, current); } - -return cookie; }/**
@@ -333,17 +325,14 @@ static inline struct pin_cookie xe_vm_set_validating(struct xe_vm *vm,* @vm: Pointer to the vm or NULL * @allow_res_evict: Eviction from @vm was allowed. Must be set to the same * value as for xe_vm_set_validation(). -* @cookie: Cookie obtained from xe_vm_set_validating(). * * Register this task as currently making bos resident for the vm. Intended * to avoid eviction by the same task of shared bos bound to the vm. * Call with the vm's resv lock held. */ -static inline void xe_vm_clear_validating (struct xe_vm *vm,bool allow_res_evict, -struct pin_cookie cookie) +static inline void xe_vm_clear_validating (struct xe_vm *vm,bool allow_res_evict) {if (vm && !allow_res_evict) { -lockdep_unpin_lock (&xe_vm_resv (vm)->lock.base, cookie);/* Pairs with READ_ONCE in xe_vm_is_validating() */ WRITE_ONCE (vm->validating,NULL ); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 71/142 drm/xe: Dont trigger rebind on initial dma-buf validation
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 16ca06aa2c2218cb21907c0c45a746958c944def ]
On the first validate of an imported dma-buf (initial bind), the device has no GPU mappings, so a rebind is unnecessary. Rebinding here is harmful in multi-GPU setups and for VMs using preempt-fence mode, as it would evict in-flight GPU work.
v2:
- Drop dma_buf_validated, check for XE_PL_SYSTEM (Thomas)
--- drivers/gpu/drm/xe/xe_bo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_bo.c +2 -1
@@ -796,7 +796,8 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict, }if (ttm_bo->type == ttm_bo_type_sg) { - ret =xe_bo_move_notify (bo, ctx); +if (new_mem->mem_type ==XE_PL_SYSTEM ) + ret =xe_bo_move_notify (bo, ctx);if (!ret) ret =xe_bo_move_dmabuf (ttm_bo, new_mem);return ret;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 72/142 block: validate QoS before calling __rq_qos_done_bio()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <[email protected]>
[ Upstream commit e3ef9445cd9d90e43de0bd3cd55d437773dfd139 ]
If a bio has BIO_QOS_xxx set, it doesn't guarantee that q->rq_qos is also present at-least for stacked block devices. For instance, in case of NVMe when multipath is enabled, the bottom device may have QoS enabled but top device doesn't. So always validate QoS is enabled and q->rq_qos is present before calling __rq_qos_done_bio().
--- block/blk-rq-qos.h | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
block/blk-rq-qos.h +8 -5
@@ -149,12 +149,15 @@ static inline void rq_qos_done_bio(struct bio *bio) q =bdev_get_queue (bio->bi_bdev);/* -* If a bio has BIO_QOS_xxx set, it implicitly implies that -* q->rq_qos is present. So, we skip re-checking q->rq_qos -* here as an extra optimization and directly call -* __rq_qos_done_bio(). +* A BIO may carry BIO_QOS_* flags even if the associated request_queue +* does not have rq_qos enabled. This can happen with stacked block +* devices — for example, NVMe multipath, where it's possible that the +* bottom device has QoS enabled but the top device does not. Therefore, +* always verify that q->rq_qos is present and QoS is enabled before +* calling __rq_qos_done_bio(). */ -__rq_qos_done_bio (q->rq_qos, bio); +if (test_bit (QUEUE_FLAG_QOS_ENABLED , &q->queue_flags) && q->rq_qos) +__rq_qos_done_bio (q->rq_qos, bio); }static inline void rq_qos_throttle (struct request_queue *q,struct bio *bio)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 73/142 phy: mscc: Fix when PTP clock is register and unregister
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <[email protected]>
[ Upstream commit 882e57cbc7204662f6c5672d5b04336c1d790b03 ]
It looks like that every time when the interface was set down and up the driver was creating a new ptp clock. On top of this the function ptp_clock_unregister was never called.
Therefore fix this by calling ptp_clock_register and initialize the mii_ts struct inside the probe function and call ptp_clock_unregister when driver is removed.
--- drivers/net/phy/mscc/mscc.h | 4 ++++ drivers/net/phy/mscc/mscc_main.c | 4 +--- drivers/net/phy/mscc/mscc_ptp.c | 34 ++++++++++++++++++++------------ 3 files changed, 26 insertions(+), 16 deletions(-)
drivers/net/phy/mscc/mscc.h +4 -0
@@ -481,6 +481,7 @@ static inline void vsc8584_config_macsec_intr(struct phy_device *phydev)void vsc85xx_link_change_notify (struct phy_device *phydev);void vsc8584_config_ts_intr (struct phy_device *phydev);int vsc8584_ptp_init (struct phy_device *phydev); +void vsc8584_ptp_deinit (struct phy_device *phydev);int vsc8584_ptp_probe_once (struct phy_device *phydev);int vsc8584_ptp_probe (struct phy_device *phydev);irqreturn_t vsc8584_handle_ts_interrupt (struct phy_device *phydev);
@@ -495,6 +496,9 @@ static inline int vsc8584_ptp_init(struct phy_device *phydev) {return 0 ; } +static inline void vsc8584_ptp_deinit (struct phy_device *phydev) +{ +}static inline int vsc8584_ptp_probe_once (struct phy_device *phydev) {return 0 ;
drivers/net/phy/mscc/mscc_main.c +1 -3
@@ -2338,9 +2338,7 @@ static int vsc85xx_probe(struct phy_device *phydev)static void vsc85xx_remove (struct phy_device *phydev) { -struct vsc8531_private *priv = phydev->priv; - -skb_queue_purge (&priv->rx_skbs_list); +vsc8584_ptp_deinit (phydev); }/* Microsemi VSC85xx PHYs */
drivers/net/phy/mscc/mscc_ptp.c +21 -13
@@ -1298,7 +1298,6 @@ static void vsc8584_set_input_clk_configured(struct phy_device *phydev)static int __vsc8584_init_ptp (struct phy_device *phydev) { -struct vsc8531_private *vsc8531 = phydev->priv;static const u32 ltc_seq_e[] = {0 ,400000 ,0 ,0 ,0 };static const u8 ltc_seq_a[] = {8 ,6 ,5 ,4 ,2 };u32 val;
@@ -1515,17 +1514,7 @@ static int __vsc8584_init_ptp(struct phy_device *phydev)vsc85xx_ts_eth_cmp1_sig (phydev); - vsc8531->mii_ts.rxtstamp = vsc85xx_rxtstamp; - vsc8531->mii_ts.txtstamp = vsc85xx_txtstamp; - vsc8531->mii_ts.hwtstamp = vsc85xx_hwtstamp; - vsc8531->mii_ts.ts_info = vsc85xx_ts_info; - phydev->mii_ts = &vsc8531->mii_ts; - -memcpy (&vsc8531->ptp->caps, &vsc85xx_clk_caps,sizeof (vsc85xx_clk_caps)); - - vsc8531->ptp->ptp_clock =ptp_clock_register (&vsc8531->ptp->caps, - &phydev->mdio.dev); -return PTR_ERR_OR_ZERO (vsc8531->ptp->ptp_clock); +return 0 ; }void vsc8584_config_ts_intr (struct phy_device *phydev)
@@ -1552,6 +1541,16 @@ int vsc8584_ptp_init(struct phy_device *phydev)return 0 ; } +void vsc8584_ptp_deinit (struct phy_device *phydev) +{ +struct vsc8531_private *vsc8531 = phydev->priv; + +if (vsc8531->ptp->ptp_clock) { +ptp_clock_unregister (vsc8531->ptp->ptp_clock); +skb_queue_purge (&vsc8531->rx_skbs_list); + } +} +irqreturn_t vsc8584_handle_ts_interrupt (struct phy_device *phydev) {struct vsc8531_private *priv = phydev->priv;
@@ -1612,7 +1611,16 @@ int vsc8584_ptp_probe(struct phy_device *phydev) vsc8531->ptp->phydev = phydev; -return 0 ; + vsc8531->mii_ts.rxtstamp = vsc85xx_rxtstamp; + vsc8531->mii_ts.txtstamp = vsc85xx_txtstamp; + vsc8531->mii_ts.hwtstamp = vsc85xx_hwtstamp; + vsc8531->mii_ts.ts_info = vsc85xx_ts_info; + phydev->mii_ts = &vsc8531->mii_ts; + +memcpy (&vsc8531->ptp->caps, &vsc85xx_clk_caps,sizeof (vsc85xx_clk_caps)); + vsc8531->ptp->ptp_clock =ptp_clock_register (&vsc8531->ptp->caps, + &phydev->mdio.dev); +return PTR_ERR_OR_ZERO (vsc8531->ptp->ptp_clock); }int vsc8584_ptp_probe_once (struct phy_device *phydev)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 74/142 net: macb: Fix offset error in gem_update_stats
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 16c8a3a67ec799fc731919e3e51be9af6cdf541d ]
hw_stats now has only one variable for tx_octets/rx_octets, so we should only increment p once, not twice. This would cause the statistics to be reported under the wrong categories in ethtool -S --all-groups (which uses hw_stats) but not ethtool -S (which uses ethtool_stats).
--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -3090,7 +3090,7 @@ static void gem_update_stats(struct macb *bp)/* Add GEM_OCTTXH, GEM_OCTRXH */ val = bp->macb_reg_readl (bp, offset +4 ); bp->ethtool_stats[i] += ((u64 )val) <<32 ; - *(p++) += ((u64 )val) <<32 ; + *p += ((u64 )val) <<32 ; } }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 75/142 bnxt_en: Fix memory corruption when FW resources change during ifdown
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sreekanth Reddy <[email protected]>
[ Upstream commit 2747328ba2714f1a7454208dbbc1dc0631990b4a ]
bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.
In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings().
Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +16 -5
@@ -12844,6 +12844,17 @@ static int bnxt_set_xps_mapping(struct bnxt *bp)return rc; } +static int bnxt_tx_nr_rings (struct bnxt *bp) +{ +return bp->num_tc ? bp->tx_nr_rings_per_tc * bp->num_tc : + bp->tx_nr_rings_per_tc; +} + +static int bnxt_tx_nr_rings_per_tc (struct bnxt *bp) +{ +return bp->num_tc ? bp->tx_nr_rings / bp->num_tc : bp->tx_nr_rings; +} +static int __bnxt_open_nic (struct bnxt *bp,bool irq_re_init,bool link_re_init) {int rc =0 ;
@@ -16338,7 +16349,7 @@ static void bnxt_trim_dflt_sh_rings(struct bnxt *bp) bp->cp_nr_rings =min_t (int, bp->tx_nr_rings_per_tc, bp->rx_nr_rings); bp->rx_nr_rings = bp->cp_nr_rings; bp->tx_nr_rings_per_tc = bp->cp_nr_rings; - bp->tx_nr_rings = bp->tx_nr_rings_per_tc; + bp->tx_nr_rings =bnxt_tx_nr_rings (bp); }static int bnxt_set_dflt_rings (struct bnxt *bp,bool sh)
@@ -16370,7 +16381,7 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh)bnxt_trim_dflt_sh_rings (bp); else bp->cp_nr_rings = bp->tx_nr_rings_per_tc + bp->rx_nr_rings; - bp->tx_nr_rings = bp->tx_nr_rings_per_tc; + bp->tx_nr_rings =bnxt_tx_nr_rings (bp); avail_msix =bnxt_get_max_func_irqs (bp) - bp->cp_nr_rings;if (avail_msix >=BNXT_MIN_ROCE_CP_RINGS ) {
@@ -16383,7 +16394,7 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh) rc =__bnxt_reserve_rings (bp);if (rc && rc != -ENODEV )netdev_warn (bp->dev,"Unable to reserve tx rings\n" ); - bp->tx_nr_rings_per_tc = bp->tx_nr_rings; + bp->tx_nr_rings_per_tc =bnxt_tx_nr_rings_per_tc (bp);if (sh)bnxt_trim_dflt_sh_rings (bp);
@@ -16392,7 +16403,7 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh) rc =__bnxt_reserve_rings (bp);if (rc && rc != -ENODEV )netdev_warn (bp->dev,"2nd rings reservation failed.\n" ); - bp->tx_nr_rings_per_tc = bp->tx_nr_rings; + bp->tx_nr_rings_per_tc =bnxt_tx_nr_rings_per_tc (bp); }if (BNXT_CHIP_TYPE_NITRO_A0 (bp)) { bp->rx_nr_rings++;
@@ -16426,7 +16437,7 @@ static int bnxt_init_dflt_ring_mode(struct bnxt *bp)if (rc) goto init_dflt_ring_err; - bp->tx_nr_rings_per_tc = bp->tx_nr_rings; + bp->tx_nr_rings_per_tc =bnxt_tx_nr_rings_per_tc (bp);bnxt_set_dflt_rfs (bp);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 76/142 bnxt_en: Adjust TX rings if reservation is less than requested
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit 1ee581c24dfdcbc6de25aac95a48c1f08e9a542c ]
Before we accept an ethtool request to increase a resource (such as rings), we call the FW to check that the requested resource is likely available first before we commit. But it is still possible that the actual reservation or allocation can fail. The existing code is missing the logic to adjust the TX rings in case the reserved TX rings are less than requested. Add a warning message (a similar message for RX rings already exists) and add the logic to adjust the TX rings. Without this fix, the number of TX rings reported to the stack can exceed the actual TX rings and ethtool -l will report more than the actual TX rings.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +12 -0
@@ -8017,6 +8017,11 @@ static int __bnxt_reserve_rings(struct bnxt *bp) hwr.rx = rx_rings <<1 ; tx_cp =bnxt_num_tx_to_cp (bp, hwr.tx); hwr.cp = sh ?max_t (int, tx_cp, rx_rings) : tx_cp + rx_rings; +if (hwr.tx != bp->tx_nr_rings) { +netdev_warn (bp->dev, +"Able to reserve only %d out of %d requested TX rings\n" , + hwr.tx, bp->tx_nr_rings); + } bp->tx_nr_rings = hwr.tx;/* If we cannot reserve all the RX rings, reset the RSS map only
@@ -12872,6 +12877,13 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)if (rc)return rc; +/* Make adjustments if reserved TX rings are less than requested */ + bp->tx_nr_rings -= bp->tx_nr_rings_xdp; + bp->tx_nr_rings_per_tc =bnxt_tx_nr_rings_per_tc (bp); +if (bp->tx_nr_rings_xdp) { + bp->tx_nr_rings_xdp = bp->tx_nr_rings_per_tc; + bp->tx_nr_rings += bp->tx_nr_rings_xdp; + } rc =bnxt_alloc_mem (bp, irq_re_init);if (rc) {netdev_err (bp->dev,"bnxt_alloc_mem err: %x\n" , rc);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 77/142 bnxt_en: Fix stats context reservation logic
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit b4fc8faacfea2538184a1dbd616ae9447a361f3d ]
The HW resource reservation logic allows the L2 driver to use the RoCE resources if the RoCE driver is not registered. When calculating the stats contexts available for L2, we should not blindly subtract the stats contexts reserved for RoCE unless the RoCE driver is registered. This bug may cause the L2 rings to be less than the number requested when we are close to running out of stats contexts.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -1
@@ -8009,7 +8009,8 @@ static int __bnxt_reserve_rings(struct bnxt *bp) } rx_rings =min_t (int, rx_rings, hwr.grp); hwr.cp =min_t (int, hwr.cp, bp->cp_nr_rings); -if (hwr.stat >bnxt_get_ulp_stat_ctxs (bp)) +if (bnxt_ulp_registered (bp->edev) && + hwr.stat >bnxt_get_ulp_stat_ctxs (bp)) hwr.stat -=bnxt_get_ulp_stat_ctxs (bp); hwr.cp =min_t (int, hwr.cp, hwr.stat); rc =bnxt_trim_rings (bp, &rx_rings, &hwr.tx, hwr.cp, sh);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 78/142 net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lama Kayal <[email protected]>
[ Upstream commit 2c0a959bebdc1ada13cf9a8242f177c5400299e6 ]
In the error path of hws_pool_buddy_init(), the buddy allocator cleanup doesn't free the allocator structure itself, causing a memory leak.
Add the missing kfree() to properly release all allocated memory.
--- drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c +1 -0
@@ -124,6 +124,7 @@ static int hws_pool_buddy_init(struct mlx5hws_pool *pool)mlx5hws_err (pool->ctx,"Failed to create resource type: %d size %zu\n" , pool->type, pool->alloc_log_sz);mlx5hws_buddy_cleanup (buddy); +kfree (buddy);return -ENOMEM ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 79/142 net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lama Kayal <[email protected]>
[ Upstream commit a630f83592cdad1253523a1b760cfe78fef6cd9c ]
When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak.
Fix by jumping to free_shared_stc label instead to ensure proper cleanup.
--- drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c +1 -1
@@ -117,7 +117,7 @@ static int hws_action_get_shared_stc_nic(struct mlx5hws_context *ctx,mlx5hws_err (ctx,"No such stc_type: %d\n" , stc_type);pr_warn ("HWS: Invalid stc_type: %d\n" , stc_type); ret = -EINVAL ; - goto unlock_and_out; + goto free_shared_stc; } ret = mlx5hws_action_alloc_single_stc(ctx, &stc_attr, tbl_type,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 62/142 dt-bindings: display/msm: qcom,mdp5: drop lut clock
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7ab3b7579a6d2660a3425b9ea93b9a140b07f49c ]
None of MDP5 platforms have a LUT clock on the display-controller, it was added by the mistake. Drop it, fixing DT warnings on MSM8976 / MSM8956 platforms. Technically it's an ABI break, but no other platforms are affected.
Patchwork: https://patchwork.freedesktop.org/patch/667822/
--- Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml | 1 - 1 file changed, 1 deletion(-)
Documentation/devicetree/bindings/display/msm/qcom,mdp5.yaml +0 -1
@@ -60,7 +60,6 @@ properties: - const: bus - const: core - const: vsync - - const: lut - const: tbu - const: tbu_rt # MSM8996 has additional iommu clock
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 80/142 net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lama Kayal <[email protected]>
[ Upstream commit 24b6e53140475b56cadcccd4e82a93aa5bacf1eb ]
In mlx5hws_pat_calc_nop(), src_field and dst_field are passed to hws_action_modify_get_target_fields() which should set their values. However, if an invalid action type is encountered, these variables remain uninitialized and are later used to update prev_src_field and prev_dst_field.
Initialize both variables to INVALID_FIELD to ensure they have defined values in all code paths.
--- .../net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c +3 -1
@@ -527,7 +527,6 @@ int mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, u32 *nop_locations, __be64 *new_pat) {u16 prev_src_field =INVALID_FIELD , prev_dst_field =INVALID_FIELD ; -u16 src_field, dst_field;u8 action_type;bool dependent;size_t i, j;
@@ -539,6 +538,9 @@ int mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions,return 0 ;for (i =0 , j =0 ; i < num_actions; i++, j++) { +u16 src_field =INVALID_FIELD ; +u16 dst_field =INVALID_FIELD ; +if (j >= max_actions)return -EINVAL ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 81/142 net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lama Kayal <[email protected]>
[ Upstream commit 00a50e4e8974cbf5d6a1dc91cfa5cce4aa7af05a ]
In mlx5hws_pat_get_pattern(), when mlx5hws_pat_add_pattern_to_cache() fails, the function attempts to clean up the pattern created by mlx5hws_cmd_header_modify_pattern_create(). However, it incorrectly uses *pattern_id which hasn't been set yet, instead of the local ptrn_id variable that contains the actual pattern ID.
This results in attempting to destroy a pattern using uninitialized data from the output parameter, rather than the valid pattern ID returned by the firmware.
Use ptrn_id instead of *pattern_id in the cleanup path to properly destroy the created pattern.
--- drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c +1 -1
@@ -279,7 +279,7 @@ int mlx5hws_pat_get_pattern(struct mlx5hws_context *ctx,return ret; clean_pattern: -mlx5hws_cmd_header_modify_pattern_destroy (ctx->mdev, *pattern_id); +mlx5hws_cmd_header_modify_pattern_destroy (ctx->mdev, ptrn_id); out_unlock:mutex_unlock (&ctx->pattern_cache->lock);return ret;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 82/142 net/mlx5: Reload auxiliary drivers on fw_activate
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit 34cc6a54914f478c93e176450fae6313404f9f74 ]
The devlink reload fw_activate command performs firmware activation followed by driver reload, while devlink reload driver_reinit triggers only driver reload. However, the driver reload logic differs between the two modes, as on driver_reinit mode mlx5 also reloads auxiliary drivers, while in fw_activate mode the auxiliary drivers are suspended where applicable.
Additionally, following the cited commit, if the device has multiple PFs, the behavior during fw_activate may vary between PFs: one PF may suspend auxiliary drivers, while another reloads them.
Align devlink dev reload fw_activate behavior with devlink dev reload driver_reinit, to reload all auxiliary drivers.
--- drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +1 -1
@@ -107,7 +107,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netliif (err)return err; -mlx5_unload_one_devl_locked (dev, true); +mlx5_unload_one_devl_locked (dev, false); err =mlx5_health_wait_pci_up (dev);if (err)NL_SET_ERR_MSG_MOD (extack,"FW activate aborted, PCI reads fail after reset" );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 83/142 net/mlx5: Fix lockdep assertion on sync reset unload event
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit 902a8bc23a24882200f57cadc270e15a2cfaf2bb ]
Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fw_activate option, the PF already holds the devlink lock while handling unload event. In this case, delegate sync reset unload event handling back to the devlink callback process to avoid double-locking and resolve the lockdep warning.
Kernel log:
WARNING: CPU: 9 PID: 1578 at devl_assert_locked+0x31/0x40 [...] Call Trace: <TASK> mlx5_unload_one_devl_locked+0x2c/0xc0 [mlx5_core] mlx5_sync_reset_unload_event+0xaf/0x2f0 [mlx5_core] process_one_work+0x222/0x640 worker_thread+0x199/0x350 kthread+0x10b/0x230 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x8e/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
--- .../net/ethernet/mellanox/mlx5/core/devlink.c | 2 +- .../ethernet/mellanox/mlx5/core/fw_reset.c | 120 ++++++++++-------- .../ethernet/mellanox/mlx5/core/fw_reset.h | 1 + 3 files changed, 69 insertions(+), 54 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/devlink.c +1 -1
@@ -107,7 +107,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netliif (err)return err; -mlx5_unload_one_devl_locked (dev, false); +mlx5_sync_reset_unload_flow (dev, true); err =mlx5_health_wait_pci_up (dev);if (err)NL_SET_ERR_MSG_MOD (extack,"FW activate aborted, PCI reads fail after reset" );
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +67 -53
174 lines not on this page · raw message
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h +1 -0
@@ -12,6 +12,7 @@ int mlx5_fw_reset_set_reset_sync(struct mlx5_core_dev *dev, u8 reset_type_sel,int mlx5_fw_reset_set_live_patch (struct mlx5_core_dev *dev);int mlx5_fw_reset_wait_reset_done (struct mlx5_core_dev *dev); +void mlx5_sync_reset_unload_flow (struct mlx5_core_dev *dev,bool locked);int mlx5_fw_reset_verify_fw_complete (struct mlx5_core_dev *dev,struct netlink_ext_ack *extack);void mlx5_fw_reset_events_start (struct mlx5_core_dev *dev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 84/142 net/mlx5: Nack sync reset when SFs are present
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit 26e42ec7712d392d561964514b1f253b1a96f42d ]
If PF (Physical Function) has SFs (Sub-Functions), since the SFs are not taking part in the synchronization flow, sync reset can lead to fatal error on the SFs, as the function will be closed unexpectedly from the SF point of view.
Add a check to prevent sync reset when there are SFs on a PF device which is not ECPF, as ECPF is teardowned gracefully before reset.
--- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 6 ++++++ drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c | 10 ++++++++++ drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h | 6 ++++++ 3 files changed, 22 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +6 -0
@@ -6,6 +6,7 @@#include "fw_reset.h" #include "diag/fw_tracer.h" #include "lib/tout.h" +#include "sf/sf.h" enum {MLX5_FW_RESET_FLAGS_RESET_REQUESTED ,
@@ -428,6 +429,11 @@ static bool mlx5_is_reset_now_capable(struct mlx5_core_dev *dev,return false; } +if (!mlx5_core_is_ecpf (dev) && !mlx5_sf_table_empty (dev)) { +mlx5_core_warn (dev,"SFs should be removed before reset\n" ); +return false; + } +#if IS_ENABLED (CONFIG_HOTPLUG_PCI_PCIE )if (reset_method !=MLX5_MFRL_REG_PCI_RESET_METHOD_HOT_RESET ) { err =mlx5_check_hotplug_interrupt (dev, bridge);
drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c +10 -0
@@ -518,3 +518,13 @@ void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev)WARN_ON (!xa_empty (&table->function_ids));kfree (table); } + +bool mlx5_sf_table_empty (const struct mlx5_core_dev *dev) +{ +struct mlx5_sf_table *table = dev->priv.sf_table; + +if (!table) +return true; + +return xa_empty (&table->function_ids); +}
drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h +6 -0
@@ -17,6 +17,7 @@ void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev);int mlx5_sf_table_init (struct mlx5_core_dev *dev);void mlx5_sf_table_cleanup (struct mlx5_core_dev *dev); +bool mlx5_sf_table_empty (const struct mlx5_core_dev *dev); int mlx5_devlink_sf_port_new(struct devlink *devlink, const struct devlink_port_new_attrs *add_attr,
@@ -61,6 +62,11 @@ static inline void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) { } +static inline bool mlx5_sf_table_empty (const struct mlx5_core_dev *dev) +{ +return true; +} +#endif #endif
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 85/142 net/mlx5: Prevent flow steering mode changes in switchdev mode
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <[email protected]>
[ Upstream commit cf9a8627b9a369ba01d37be6f71b297beb688faa ]
Changing flow steering modes is not allowed when eswitch is in switchdev mode. This fix ensures that any steering mode change, including to firmware steering, is correctly blocked while eswitch mode is switchdev.
--- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +7 -8
@@ -3706,6 +3706,13 @@ static int mlx5_fs_mode_validate(struct devlink *devlink, u32 id,char *value = val.vstr;u8 eswitch_mode; + eswitch_mode =mlx5_eswitch_mode (dev); +if (eswitch_mode ==MLX5_ESWITCH_OFFLOADS ) { +NL_SET_ERR_MSG_FMT_MOD (extack, +"Changing fs mode is not supported when eswitch offloads enabled." ); +return -EOPNOTSUPP ; + } +if (!strcmp (value,"dmfs" ))return 0 ;
@@ -3731,14 +3738,6 @@ static int mlx5_fs_mode_validate(struct devlink *devlink, u32 id,return -EINVAL ; } - eswitch_mode =mlx5_eswitch_mode (dev); -if (eswitch_mode ==MLX5_ESWITCH_OFFLOADS ) { -NL_SET_ERR_MSG_FMT_MOD (extack, -"Moving to %s is not supported when eswitch offloads enabled." , - value); -return -EOPNOTSUPP ; - } -return 0 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 86/142 net/mlx5e: Update and set Xon/Xoff upon MTU set
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb ]
Xon/Xoff sizes are derived from calculation that include the MTU size. Set Xon/Xoff when MTU is set.
If Xon/Xoff fails, set the previous MTU.
--- .../mellanox/mlx5/core/en/port_buffer.h | 12 ++++++++++++ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 ++++++++++++++++- 2 files changed, 28 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h +12 -0
@@ -66,11 +66,23 @@ struct mlx5e_port_buffer {struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER ]; }; +#ifdef CONFIG_MLX5_CORE_EN_DCB int mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv,u32 change,unsigned int mtu,struct ieee_pfc *pfc,u32 *buffer_size,u8 *prio2buffer); +#else +static inline int +mlx5e_port_manual_buffer_config (struct mlx5e_priv *priv, +u32 change,unsigned int mtu, +void *pfc, +u32 *buffer_size, +u8 *prio2buffer) +{ +return 0 ; +} +#endif int mlx5e_port_query_buffer (struct mlx5e_priv *priv,struct mlx5e_port_buffer *port_buffer);
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +16 -1
@@ -48,6 +48,7 @@#include "en.h" #include "en/dim.h" #include "en/txrx.h" +#include "en/port_buffer.h" #include "en_tc.h" #include "en_rep.h" #include "en_accel/ipsec.h"
@@ -2985,9 +2986,11 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)struct mlx5e_params *params = &priv->channels.params;struct net_device *netdev = priv->netdev;struct mlx5_core_dev *mdev = priv->mdev; -u16 mtu; +u16 mtu, prev_mtu;int err; +mlx5e_query_mtu (mdev, params, &prev_mtu); + err =mlx5e_set_mtu (mdev, params, params->sw_mtu);if (err)return err;
@@ -2997,6 +3000,18 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)netdev_warn (netdev,"%s: VPort MTU %d is different than netdev mtu %d\n" , __func__, mtu, params->sw_mtu); +if (mtu != prev_mtu &&MLX5_BUFFER_SUPPORTED (mdev)) { + err =mlx5e_port_manual_buffer_config (priv,0 , mtu, +NULL ,NULL ,NULL ); +if (err) { +netdev_warn (netdev,"%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n" , + __func__, mtu, err, prev_mtu); + +mlx5e_set_mtu (mdev, params, prev_mtu); +return err; + } + } + params->sw_mtu = mtu;return 0 ; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 87/142 net/mlx5e: Update and set Xon/Xoff upon port speed set
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit d24341740fe48add8a227a753e68b6eedf4b385a ]
Xon/Xoff sizes are derived from calculations that include the port speed.
These settings need to be updated and applied whenever the port speed is changed.
The port speed is typically set after the physical link goes down and is negotiated as part of the link-up process between the two connected interfaces.
Xon/Xoff parameters being updated at the point where the new negotiated speed is established.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +2 -0
@@ -136,6 +136,8 @@ void mlx5e_update_carrier(struct mlx5e_priv *priv)if (up) {netdev_info (priv->netdev,"Link up\n" );netif_carrier_on (priv->netdev); +mlx5e_port_manual_buffer_config (priv,0 , priv->netdev->mtu, +NULL ,NULL ,NULL ); }else {netdev_info (priv->netdev,"Link down\n" );netif_carrier_off (priv->netdev);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 88/142 net/mlx5e: Set local Xoff after FW update
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Lazar <[email protected]>
[ Upstream commit aca0c31af61e0d5cf1675a0cbd29460b95ae693c ]
The local Xoff value is being set before the firmware (FW) update. In case of a failure where the FW is not updated with the new value, there is no fallback to the previous value.
Update the local Xoff value after the FW has been successfully set.
--- drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c +2 -1
@@ -575,7 +575,6 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,if (err)return err; } - priv->dcbx.xoff = xoff;/* Apply the settings */ if (update_buffer) {
@@ -584,6 +583,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,return err; } + priv->dcbx.xoff = xoff; +if (update_prio2buffer) err =mlx5e_port_set_priority2buffer (priv->mdev, prio2buffer);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 89/142 net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit 4f23382841e67174211271a454811dd17c0ef3c5 ]
Enabling RX FIFO Overflow interrupts is counterproductive and causes an interrupt storm when RX FIFO overflows. Disabling this interrupt has no side effect and eliminates interrupt storms when the RX FIFO overflows.
Commit 8a7cb245cf28 ("net: stmmac: Do not enable RX FIFO overflow interrupts") disables RX FIFO overflow interrupts for DWMAC4 IP and removes the corresponding handling of this interrupt. This patch is doing the same thing for XGMAC IP.
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +0 -4
@@ -203,10 +203,6 @@ static void dwxgmac2_dma_rx_mode(struct stmmac_priv *priv, void __iomem *ioaddr, }writel (value, ioaddr +XGMAC_MTL_RXQ_OPMODE (channel)); - -/* Enable MTL RX overflow */ - value =readl (ioaddr +XGMAC_MTL_QINTEN (channel)); -writel (value |XGMAC_RXOIE , ioaddr +XGMAC_MTL_QINTEN (channel)); } static void dwxgmac2_dma_tx_mode(struct stmmac_priv *priv, void __iomem *ioaddr,
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 63/142 drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Yang <[email protected]>
[ Upstream commit abebfed208515726760d79cf4f9f1a76b9a10a84 ]
The drm_atomic_get_new_connector_state() can return NULL if the connector is not part of the atomic state. Add a check to prevent a NULL pointer dereference.
This follows the same pattern used in dpu_encoder_update_topology() within the same file, which checks for NULL before using conn_state.
Patchwork: https://patchwork.freedesktop.org/patch/665188/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +2 -0
@@ -729,6 +729,8 @@ bool dpu_encoder_needs_modeset(struct drm_encoder *drm_enc, struct drm_atomic_streturn false; conn_state =drm_atomic_get_new_connector_state (state, connector); +if (!conn_state) +return false;/** * These checks are duplicated from dpu_encoder_update_topology() since
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 90/142 net: stmmac: xgmac: Correct supported speed modes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit 42ef11b2bff5b6a2910c28d2ea47cc00e0fbcaec ]
Correct supported speed modes as per the XGMAC databook. Commit 9cb54af214a7 ("net: stmmac: Fix IP-cores specific MAC capabilities") removes support for 10M, 100M and 1000HD. 1000HD is not supported by XGMAC IP, but it does support 10M and 100M FD mode for XGMAC version >= 2_20, and it also supports 10M and 100M HD mode if the HDSEL bit is set in the MAC_HW_FEATURE0 reg. This commit enables support for 10M and 100M speed modes for XGMAC IP based on XGMAC version and MAC capabilities.
--- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 13 +++++++++++-- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 5 +++++ 2 files changed, 16 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +11 -2
@@ -49,6 +49,14 @@ static void dwxgmac2_core_init(struct mac_device_info *hw,writel (XGMAC_INT_DEFAULT_EN , ioaddr +XGMAC_INT_EN ); } +static void dwxgmac2_update_caps (struct stmmac_priv *priv) +{ +if (!priv->dma_cap.mbps_10_100) + priv->hw->link.caps &= ~(MAC_10 |MAC_100 ); +else if (!priv->dma_cap.half_duplex) + priv->hw->link.caps &= ~(MAC_10HD |MAC_100HD ); +} +static void dwxgmac2_set_mac (void __iomem *ioaddr,bool enable) {u32 tx =readl (ioaddr +XGMAC_TX_CONFIG );
@@ -1424,6 +1432,7 @@ static void dwxgmac2_set_arp_offload(struct mac_device_info *hw, bool en,const struct stmmac_ops dwxgmac210_ops = { .core_init = dwxgmac2_core_init, + .update_caps = dwxgmac2_update_caps, .set_mac = dwxgmac2_set_mac, .rx_ipc = dwxgmac2_rx_ipc, .rx_queue_enable = dwxgmac2_rx_queue_enable,
@@ -1532,8 +1541,8 @@ int dwxgmac2_setup(struct stmmac_priv *priv) mac->mcast_bits_log2 =ilog2 (mac->multicast_filter_bins); mac->link.caps =MAC_ASYM_PAUSE |MAC_SYM_PAUSE | -MAC_1000FD |MAC_2500FD |MAC_5000FD | -MAC_10000FD ; +MAC_10 |MAC_100 |MAC_1000FD | +MAC_2500FD |MAC_5000FD |MAC_10000FD ; mac->link.duplex =0 ; mac->link.speed10 =XGMAC_CONFIG_SS_10_MII ; mac->link.speed100 =XGMAC_CONFIG_SS_100_MII ;
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +5 -0
@@ -382,8 +382,11 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv,static int dwxgmac2_get_hw_feature (void __iomem *ioaddr,struct dma_features *dma_cap) { +struct stmmac_priv *priv;u32 hw_cap; + priv = container_of(dma_cap, struct stmmac_priv, dma_cap); +/* MAC HW feature 0 */ hw_cap =readl (ioaddr +XGMAC_HW_FEATURE0 ); dma_cap->edma = (hw_cap &XGMAC_HWFEAT_EDMA ) >>31 ;
@@ -406,6 +409,8 @@ static int dwxgmac2_get_hw_feature(void __iomem *ioaddr, dma_cap->vlhash = (hw_cap &XGMAC_HWFEAT_VLHASH ) >>4 ; dma_cap->half_duplex = (hw_cap &XGMAC_HWFEAT_HDSEL ) >>3 ; dma_cap->mbps_1000 = (hw_cap &XGMAC_HWFEAT_GMIISEL ) >>1 ; +if (dma_cap->mbps_1000 && priv->synopsys_id >=DWXGMAC_CORE_2_20 ) + dma_cap->mbps_10_100 =1 ;/* MAC HW feature 1 */ hw_cap =readl (ioaddr +XGMAC_HW_FEATURE1 );
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 91/142 net: stmmac: Set CIC bit only for TX queues with COE
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <[email protected]>
[ Upstream commit b1eded580ab28119de0b0f21efe37ee2b4419144 ]
Currently, in the AF_XDP transmit paths, the CIC bit of TX Desc3 is set for all packets. Setting this bit for packets transmitting through queues that don't support checksum offloading causes the TX DMA to get stuck after transmitting some packets. This patch ensures the CIC bit of TX Desc3 is set only if the TX queue supports checksum offloading.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +4 -2
@@ -2584,6 +2584,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget)struct netdev_queue *nq =netdev_get_tx_queue (priv->dev, queue);struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[queue]; +bool csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported;struct xsk_buff_pool *pool = tx_q->xsk_pool;unsigned int entry = tx_q->cur_tx;struct dma_desc *tx_desc =NULL ;
@@ -2671,7 +2672,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget) }stmmac_prepare_tx_desc (priv, tx_desc,1 , xdp_desc.len, - true, priv->mode, true, true, + csum, priv->mode, true, true, xdp_desc.len);stmmac_enable_dma_transmission (priv, priv->ioaddr, queue);
@@ -4983,6 +4984,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue, {struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[queue];struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue]; +bool csum = !priv->plat->tx_queues_cfg[queue].coe_unsupported;unsigned int entry = tx_q->cur_tx;struct dma_desc *tx_desc;dma_addr_t dma_addr;
@@ -5034,7 +5036,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,stmmac_set_desc_addr (priv, tx_desc, dma_addr);stmmac_prepare_tx_desc (priv, tx_desc,1 , xdpf->len, - true, priv->mode, true, true, + csum, priv->mode, true, true, xdpf->len); tx_q->tx_count_frames++;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 92/142 net: hv_netvsc: fix loss of early receive events from host during channel open.
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dipayaan Roy <[email protected]>
[ Upstream commit 9448ccd853368582efa9db05db344f8bb9dffe0f ]
The hv_netvsc driver currently enables NAPI after opening the primary and subchannels. This ordering creates a race: if the Hyper-V host places data in the host -> guest ring buffer and signals the channel before napi_enable() has been called, the channel callback will run but napi_schedule_prep() will return false. As a result, the NAPI poller never gets scheduled, the data in the ring buffer is not consumed, and the receive queue may remain permanently stuck until another interrupt happens to arrive.
Fix this by enabling NAPI and registering it with the RX/TX queues before vmbus channel is opened. This guarantees that any early host signal after open will correctly trigger NAPI scheduling and the ring buffer will be drained.
--- drivers/net/hyperv/netvsc.c | 17 ++++++++--------- drivers/net/hyperv/rndis_filter.c | 23 ++++++++++++++++------- 2 files changed, 24 insertions(+), 16 deletions(-)
drivers/net/hyperv/netvsc.c +8 -9
@@ -1812,6 +1812,11 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,/* Enable NAPI handler before init callbacks */ netif_napi_add (ndev, &net_device->chan_table[0 ].napi, netvsc_poll); +napi_enable (&net_device->chan_table[0 ].napi); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX , + &net_device->chan_table[0 ].napi); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX , + &net_device->chan_table[0 ].napi);/* Open the channel */ device->channel->next_request_id_callback = vmbus_next_request_id;
@@ -1831,12 +1836,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device,/* Channel is opened */ netdev_dbg (ndev,"hv_netvsc channel opened successfully\n" ); -napi_enable (&net_device->chan_table[0 ].napi); -netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX , - &net_device->chan_table[0 ].napi); -netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX , - &net_device->chan_table[0 ].napi); -/* Connect with the NetVsp */ ret =netvsc_connect_vsp (device, net_device, device_info);if (ret !=0 ) {
@@ -1854,14 +1853,14 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, close:RCU_INIT_POINTER (net_device_ctx->nvdev,NULL ); -netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX ,NULL ); -netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX ,NULL ); -napi_disable (&net_device->chan_table[0 ].napi);/* Now, we can close the channel safely */ vmbus_close (device->channel); cleanup: +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_TX ,NULL ); +netif_queue_set_napi (ndev,0 ,NETDEV_QUEUE_TYPE_RX ,NULL ); +napi_disable (&net_device->chan_table[0 ].napi);netif_napi_del (&net_device->chan_table[0 ].napi); cleanup2:
drivers/net/hyperv/rndis_filter.c +16 -7
@@ -1252,17 +1252,26 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc) new_sc->rqstor_size =netvsc_rqstor_size (netvsc_ring_bytes); new_sc->max_pkt_size =NETVSC_MAX_PKT_SIZE ; +/* Enable napi before opening the vmbus channel to avoid races +* as the host placing data on the host->guest ring may be left +* out if napi was not enabled. +*/ +napi_enable (&nvchan->napi); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_RX , + &nvchan->napi); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_TX , + &nvchan->napi); + ret =vmbus_open (new_sc, netvsc_ring_bytes, netvsc_ring_bytes,NULL ,0 , netvsc_channel_cb, nvchan); -if (ret ==0 ) { -napi_enable (&nvchan->napi); -netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_RX , - &nvchan->napi); -netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_TX , - &nvchan->napi); - }else { +if (ret !=0 ) {netdev_notice (ndev,"sub channel open failed: %d\n" , ret); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_TX , +NULL ); +netif_queue_set_napi (ndev, chn_index,NETDEV_QUEUE_TYPE_RX , +NULL ); +napi_disable (&nvchan->napi); }if (atomic_inc_return (&nvscdev->open_chn) == nvscdev->num_chn)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 93/142 io_uring/kbuf: fix signedness in this_len calculation
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qingyue Zhang <[email protected]>
[ Upstream commit c64eff368ac676e8540344d27a3de47e0ad90d21 ]
When importing and using buffers, buf->len is considered unsigned. However, buf->len is converted to signed int when committing. This can lead to unexpected behavior if the buffer is large enough to be interpreted as a negative value. Make min_t calculation unsigned.
--- io_uring/kbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/kbuf.c +1 -1
@@ -39,7 +39,7 @@ static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len)u32 this_len; buf =io_ring_head_to_buf (bl->buf_ring, bl->head, bl->mask); - this_len =min_t (int, len, buf->len); + this_len =min_t (u32, len, buf->len); buf->len -= this_len;if (buf->len) { buf->addr += this_len;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 64/142 octeontx2: Set appropriate PF, VF masks and shifts based on silicon
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep <[email protected]>
[ Upstream commit 25d51ebf0f54f9c2424f28bb29125cf24f120df0 ]
Number of RVU PFs on CN20K silicon have increased to 96 from maximum of 32 that were supported on earlier silicons. Every RVU PF and VF is identified by HW using a 16bit PF_FUNC value. Due to the change in Max number of PFs in CN20K, the bit encoding of this PF_FUNC has changed.
This patch handles the change by using helper functions(using silicon check) to use PF,VF masks and shifts to support both new silicon CN20K, OcteonTx series. These helper functions are used in different modules.
Also moved the NIX AF register offset macros to other files which will be posted in coming patches.
Stable-dep-of: d280233fc866 ("Octeontx2-af: Fix NIX X2P calibration failures")
--- .../marvell/octeontx2/otx2_cpt_common.h | 5 +- .../marvell/octeontx2/otx2_cptpf_mbox.c | 13 ++-- .../marvell/octeontx2/otx2_cptpf_ucode.c | 4 +- .../marvell/octeontx2/otx2_cptvf_mbox.c | 6 +- .../marvell/octeontx2/af/mcs_rvu_if.c | 6 +- .../net/ethernet/marvell/octeontx2/af/rvu.c | 30 ++++---- .../net/ethernet/marvell/octeontx2/af/rvu.h | 52 +++++++++++--- .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 68 +++++++++---------- .../ethernet/marvell/octeontx2/af/rvu_cn10k.c | 4 +- .../ethernet/marvell/octeontx2/af/rvu_cpt.c | 4 +- .../marvell/octeontx2/af/rvu_debugfs.c | 22 +++--- .../ethernet/marvell/octeontx2/af/rvu_nix.c | 54 ++++++++------- .../ethernet/marvell/octeontx2/af/rvu_npc.c | 8 ++- .../marvell/octeontx2/af/rvu_npc_hash.c | 16 ++--- .../marvell/octeontx2/af/rvu_npc_hash.h | 4 +- .../ethernet/marvell/octeontx2/af/rvu_rep.c | 13 ++-- .../ethernet/marvell/octeontx2/af/rvu_sdp.c | 10 +-- .../marvell/octeontx2/af/rvu_switch.c | 8 +-- .../marvell/octeontx2/nic/cn10k_ipsec.c | 2 +- .../marvell/octeontx2/nic/cn10k_ipsec.h | 2 +- .../marvell/octeontx2/nic/otx2_common.h | 11 +-- .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 21 +++--- .../ethernet/marvell/octeontx2/nic/otx2_reg.h | 30 -------- .../ethernet/marvell/octeontx2/nic/otx2_tc.c | 3 +- .../net/ethernet/marvell/octeontx2/nic/rep.c | 7 +- include/linux/soc/marvell/silicons.h | 25 +++++++ 26 files changed, 225 insertions(+), 203 deletions(-) create mode 100644 include/linux/soc/marvell/silicons.h
drivers/crypto/marvell/octeontx2/otx2_cpt_common.h +2 -3
@@ -18,9 +18,8 @@#define OTX2_CPT_MAX_VFS_NUM 128#define OTX2_CPT_RVU_FUNC_ADDR_S (blk, slot, offs) \ (((blk) << 20) | ((slot) << 12) | (offs)) -#define OTX2_CPT_RVU_PFFUNC (pf, func) \ - ((((pf) & RVU_PFVF_PF_MASK) << RVU_PFVF_PF_SHIFT) | \ - (((func) & RVU_PFVF_FUNC_MASK) << RVU_PFVF_FUNC_SHIFT)) + +#define OTX2_CPT_RVU_PFFUNC (pdev, pf, func) rvu_make_pcifunc(pdev, pf, func)#define OTX2_CPT_INVALID_CRYPTO_ENG_GRP 0xFF#define OTX2_CPT_NAME_LENGTH 64
drivers/crypto/marvell/octeontx2/otx2_cptpf_mbox.c +6 -7
@@ -142,7 +142,7 @@ static int send_inline_ipsec_inbound_msg(struct otx2_cptpf_dev *cptpf,memset (req,0 ,sizeof (*req)); req->hdr.id =MBOX_MSG_CPT_INLINE_IPSEC_CFG ; req->hdr.sig =OTX2_MBOX_REQ_SIG ; - req->hdr.pcifunc =OTX2_CPT_RVU_PFFUNC (cptpf->pf_id,0 ); + req->hdr.pcifunc =OTX2_CPT_RVU_PFFUNC (cptpf->pdev, cptpf->pf_id,0 ); req->dir =CPT_INLINE_INBOUND ; req->slot = slot; req->sso_pf_func_ovrd = cptpf->sso_pf_func_ovrd;
@@ -184,7 +184,8 @@ static int rx_inline_ipsec_lf_cfg(struct otx2_cptpf_dev *cptpf, u8 egrp, nix_req->gen_cfg.opcode =cpt_inline_rx_opcode (pdev); nix_req->gen_cfg.param1 = req->param1; nix_req->gen_cfg.param2 = req->param2; - nix_req->inst_qsel.cpt_pf_func =OTX2_CPT_RVU_PFFUNC (cptpf->pf_id,0 ); + nix_req->inst_qsel.cpt_pf_func = +OTX2_CPT_RVU_PFFUNC (cptpf->pdev, cptpf->pf_id,0 ); nix_req->inst_qsel.cpt_slot =0 ; ret =otx2_cpt_send_mbox_msg (&cptpf->afpf_mbox, pdev);if (ret)
@@ -392,9 +393,8 @@ void otx2_cptpf_vfpf_mbox_handler(struct work_struct *work) msg = (struct mbox_msghdr *)(mdev->mbase + offset);/* Set which VF sent this message based on mbox IRQ */ - msg->pcifunc = ((u16 )cptpf->pf_id <<RVU_PFVF_PF_SHIFT ) | - ((vf->vf_id +1 ) &RVU_PFVF_FUNC_MASK ); - + msg->pcifunc =rvu_make_pcifunc (cptpf->pdev, cptpf->pf_id, + (vf->vf_id +1 )); err =cptpf_handle_vf_req (cptpf, vf, msg, msg->next_msgoff - offset);/*
@@ -469,8 +469,7 @@ static void process_afpf_mbox_msg(struct otx2_cptpf_dev *cptpf,switch (msg->id) {case MBOX_MSG_READY : - cptpf->pf_id = (msg->pcifunc >>RVU_PFVF_PF_SHIFT ) & -RVU_PFVF_PF_MASK ; + cptpf->pf_id =rvu_get_pf (cptpf->pdev, msg->pcifunc);break ;case MBOX_MSG_MSIX_OFFSET : rsp_msix = (struct msix_offset_rsp *) msg;
drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c +3 -1
@@ -176,7 +176,9 @@ static int cptx_set_ucode_base(struct otx2_cpt_eng_grp_info *eng_grp,/* Set PF number for microcode fetches */ ret =otx2_cpt_write_af_reg (&cptpf->afpf_mbox, cptpf->pdev,CPT_AF_PF_FUNC , - cptpf->pf_id <<RVU_PFVF_PF_SHIFT , blkaddr); +rvu_make_pcifunc (cptpf->pdev, + cptpf->pf_id,0 ), + blkaddr);if (ret)return ret;
drivers/crypto/marvell/octeontx2/otx2_cptvf_mbox.c +3 -3
@@ -189,7 +189,7 @@ int otx2_cptvf_send_eng_grp_num_msg(struct otx2_cptvf_dev *cptvf, int eng_type) } req->hdr.id =MBOX_MSG_GET_ENG_GRP_NUM ; req->hdr.sig =OTX2_MBOX_REQ_SIG ; - req->hdr.pcifunc =OTX2_CPT_RVU_PFFUNC (cptvf->vf_id,0 ); + req->hdr.pcifunc =OTX2_CPT_RVU_PFFUNC (cptvf->pdev, cptvf->vf_id,0 ); req->eng_type = eng_type;return otx2_cpt_send_mbox_msg (mbox, pdev);
@@ -210,7 +210,7 @@ int otx2_cptvf_send_kvf_limits_msg(struct otx2_cptvf_dev *cptvf) } req->id =MBOX_MSG_GET_KVF_LIMITS ; req->sig =OTX2_MBOX_REQ_SIG ; - req->pcifunc =OTX2_CPT_RVU_PFFUNC (cptvf->vf_id,0 ); + req->pcifunc =OTX2_CPT_RVU_PFFUNC (cptvf->pdev, cptvf->vf_id,0 );return otx2_cpt_send_mbox_msg (mbox, pdev); }
@@ -230,7 +230,7 @@ int otx2_cptvf_send_caps_msg(struct otx2_cptvf_dev *cptvf) } req->id =MBOX_MSG_GET_CAPS ; req->sig =OTX2_MBOX_REQ_SIG ; - req->pcifunc =OTX2_CPT_RVU_PFFUNC (cptvf->vf_id,0 ); + req->pcifunc =OTX2_CPT_RVU_PFFUNC (cptvf->pdev, cptvf->vf_id,0 );return otx2_cpt_send_mbox_msg (mbox, pdev); }
drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c +3 -3
@@ -97,7 +97,7 @@ int mcs_add_intr_wq_entry(struct mcs *mcs, struct mcs_intr_event *event)if (pcifunc &RVU_PFVF_FUNC_MASK ) pfvf = &mcs->vf[rvu_get_hwvf (rvu, pcifunc)];else - pfvf = &mcs->pf[rvu_get_pf (pcifunc)]; + pfvf = &mcs->pf[rvu_get_pf (rvu->pdev, pcifunc)]; event->intr_mask &= pfvf->intr_mask;
@@ -123,7 +123,7 @@ static int mcs_notify_pfvf(struct mcs_intr_event *event, struct rvu *rvu)struct mcs_intr_info *req;int pf; - pf =rvu_get_pf (event->pcifunc); + pf =rvu_get_pf (rvu->pdev, event->pcifunc);mutex_lock (&rvu->mbox_lock);
@@ -193,7 +193,7 @@ int rvu_mbox_handler_mcs_intr_cfg(struct rvu *rvu,if (pcifunc &RVU_PFVF_FUNC_MASK ) pfvf = &mcs->vf[rvu_get_hwvf (rvu, pcifunc)];else - pfvf = &mcs->pf[rvu_get_pf (pcifunc)]; + pfvf = &mcs->pf[rvu_get_pf (rvu->pdev, pcifunc)]; mcs->pf_map[0 ] = pcifunc; pfvf->intr_mask = req->intr_mask;
drivers/net/ethernet/marvell/octeontx2/af/rvu.c +12 -18
@@ -294,7 +294,7 @@ int rvu_get_blkaddr(struct rvu *rvu, int blktype, u16 pcifunc) devnum =rvu_get_hwvf (rvu, pcifunc); }else { is_pf = true; - devnum =rvu_get_pf (pcifunc); + devnum =rvu_get_pf (rvu->pdev, pcifunc); }/* Check if the 'pcifunc' has a NIX LF from 'BLKADDR_NIX0' or
@@ -359,7 +359,7 @@ static void rvu_update_rsrc_map(struct rvu *rvu, struct rvu_pfvf *pfvf, devnum =rvu_get_hwvf (rvu, pcifunc); }else { is_pf = true; - devnum =rvu_get_pf (pcifunc); + devnum =rvu_get_pf (rvu->pdev, pcifunc); } block->fn_map[lf] = attach ? pcifunc :0 ;
@@ -400,11 +400,6 @@ static void rvu_update_rsrc_map(struct rvu *rvu, struct rvu_pfvf *pfvf,rvu_write64 (rvu,BLKADDR_RVUM , reg | (devnum <<16 ), num_lfs); } -inline int rvu_get_pf (u16 pcifunc) -{ -return (pcifunc >>RVU_PFVF_PF_SHIFT ) &RVU_PFVF_PF_MASK ; -} -void rvu_get_pf_numvfs (struct rvu *rvu,int pf,int *numvfs,int *hwvf) {u64 cfg;
@@ -422,7 +417,7 @@ int rvu_get_hwvf(struct rvu *rvu, int pcifunc)int pf, func;u64 cfg; - pf =rvu_get_pf (pcifunc); + pf =rvu_get_pf (rvu->pdev, pcifunc); func = pcifunc &RVU_PFVF_FUNC_MASK ;/* Get first HWVF attached to this PF */
@@ -437,7 +432,7 @@ struct rvu_pfvf *rvu_get_pfvf(struct rvu *rvu, int pcifunc)if (pcifunc &RVU_PFVF_FUNC_MASK )return &rvu->hwvf[rvu_get_hwvf (rvu, pcifunc)];else -return &rvu->pf[rvu_get_pf (pcifunc)]; +return &rvu->pf[rvu_get_pf (rvu->pdev, pcifunc)]; }static bool is_pf_func_valid (struct rvu *rvu,u16 pcifunc)
@@ -445,7 +440,7 @@ static bool is_pf_func_valid(struct rvu *rvu, u16 pcifunc)int pf, vf, nvfs;u64 cfg; - pf =rvu_get_pf (pcifunc); + pf =rvu_get_pf (rvu->pdev, pcifunc);if (pf >= rvu->hw->total_pfs)return false;
@@ -1487,7 +1482,7 @@ int rvu_get_nix_blkaddr(struct rvu *rvu, u16 pcifunc) pf =rvu_get_pfvf (rvu, pcifunc & ~RVU_PFVF_FUNC_MASK );/* All CGX mapped PFs are set with assigned NIX block during init */ -if (is_pf_cgxmapped (rvu,rvu_get_pf (pcifunc))) { +if (is_pf_cgxmapped (rvu,rvu_get_pf (rvu->pdev, pcifunc))) { blkaddr = pf->nix_blkaddr; }else if (is_lbk_vf (rvu, pcifunc)) { vf = pcifunc -1 ;
@@ -1501,7 +1496,7 @@ int rvu_get_nix_blkaddr(struct rvu *rvu, u16 pcifunc) }/* if SDP1 then the blkaddr is NIX1 */ -if (is_sdp_pfvf (pcifunc) && pf->sdp_info->node_id ==1 ) +if (is_sdp_pfvf (rvu, pcifunc) && pf->sdp_info->node_id ==1 ) blkaddr =BLKADDR_NIX1 ;switch (blkaddr) {
@@ -2006,7 +2001,7 @@ int rvu_mbox_handler_vf_flr(struct rvu *rvu, struct msg_req *req, vf = pcifunc &RVU_PFVF_FUNC_MASK ; cfg =rvu_read64 (rvu,BLKADDR_RVUM , -RVU_PRIV_PFX_CFG (rvu_get_pf (pcifunc))); +RVU_PRIV_PFX_CFG (rvu_get_pf (rvu->pdev, pcifunc))); numvfs = (cfg >>12 ) &0xFF ;if (vf && vf <= numvfs)
@@ -2229,9 +2224,8 @@ static void __rvu_mbox_handler(struct rvu_work *mwork, int type, bool poll)/* Set which PF/VF sent this message based on mbox IRQ */ switch (type) {case TYPE_AFPF : - msg->pcifunc &= - ~(RVU_PFVF_PF_MASK <<RVU_PFVF_PF_SHIFT ); - msg->pcifunc |= (devid <<RVU_PFVF_PF_SHIFT ); + msg->pcifunc &=rvu_pcifunc_pf_mask (rvu->pdev); + msg->pcifunc |=rvu_make_pcifunc (rvu->pdev, devid,0 );break ;case TYPE_AFVF : msg->pcifunc &=
@@ -2249,7 +2243,7 @@ static void __rvu_mbox_handler(struct rvu_work *mwork, int type, bool poll)if (msg->pcifunc &RVU_PFVF_FUNC_MASK )dev_warn (rvu->dev,"Error %d when processing message %s (0x%x) from PF%d:VF%d\n" , err,otx2_mbox_id2name (msg->id), - msg->id,rvu_get_pf (msg->pcifunc), + msg->id,rvu_get_pf (rvu->pdev, msg->pcifunc), (msg->pcifunc &RVU_PFVF_FUNC_MASK ) -1 );else dev_warn(rvu->dev, "Error %d when processing message %s (0x%x) from PF%d\n",
@@ -2773,7 +2767,7 @@ static void rvu_flr_handler(struct work_struct *work) cfg =rvu_read64 (rvu,BLKADDR_RVUM ,RVU_PRIV_PFX_CFG (pf)); numvfs = (cfg >>12 ) &0xFF ; - pcifunc = pf <<RVU_PFVF_PF_SHIFT ; + pcifunc =rvu_make_pcifunc (rvu->pdev, pf,0 );for (vf =0 ; vf < numvfs; vf++)__rvu_flr_handler (rvu, (pcifunc | (vf +1 )));
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +43 -9
92 lines not on this page · raw message
drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +34 -34
268 lines not on this page · raw message
drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c +2 -2
@@ -66,7 +66,7 @@ static int lmtst_map_table_ops(struct rvu *rvu, u32 index, u64 *val,#define LMT_MAP_TBL_W1_OFF 8static u32 rvu_get_lmtst_tbl_index (struct rvu *rvu,u16 pcifunc) { -return ((rvu_get_pf (pcifunc) *LMT_MAX_VFS ) + +return ((rvu_get_pf (rvu->pdev, pcifunc) *LMT_MAX_VFS ) + (pcifunc &RVU_PFVF_FUNC_MASK )) *LMT_MAPTBL_ENTRY_SIZE ; }
@@ -83,7 +83,7 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc,mutex_lock (&rvu->rsrc_lock);rvu_write64 (rvu,BLKADDR_RVUM ,RVU_AF_SMMU_ADDR_REQ , iova); - pf =rvu_get_pf (pcifunc) &RVU_PFVF_PF_MASK ; + pf =rvu_get_pf (rvu->pdev, pcifunc) &RVU_OTX2_PFVF_PF_MASK ; val =BIT_ULL (63 ) |BIT_ULL (14 ) |BIT_ULL (13 ) | pf <<8 | ((pcifunc &RVU_PFVF_FUNC_MASK ) &0xFF );rvu_write64 (rvu,BLKADDR_RVUM ,RVU_AF_SMMU_TXN_REQ , val);
drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c +2 -2
@@ -410,7 +410,7 @@ static bool is_cpt_pf(struct rvu *rvu, u16 pcifunc) {int cpt_pf_num = rvu->cpt_pf_num; -if (rvu_get_pf (pcifunc) != cpt_pf_num) +if (rvu_get_pf (rvu->pdev, pcifunc) != cpt_pf_num)return false;if (pcifunc &RVU_PFVF_FUNC_MASK )return false;
@@ -422,7 +422,7 @@ static bool is_cpt_vf(struct rvu *rvu, u16 pcifunc) {int cpt_pf_num = rvu->cpt_pf_num; -if (rvu_get_pf (pcifunc) != cpt_pf_num) +if (rvu_get_pf (rvu->pdev, pcifunc) != cpt_pf_num)return false;if (!(pcifunc &RVU_PFVF_FUNC_MASK ))return false;
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +11 -11
@@ -688,7 +688,7 @@ static int get_max_column_width(struct rvu *rvu)for (pf =0 ; pf < rvu->hw->total_pfs; pf++) {for (vf =0 ; vf <= rvu->hw->total_vfs; vf++) { - pcifunc = pf <<10 | vf; + pcifunc =rvu_make_pcifunc (rvu->pdev, pf, vf);if (!pcifunc)continue ;
@@ -759,7 +759,7 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,for (vf =0 ; vf <= rvu->hw->total_vfs; vf++) { off =0 ; flag =0 ; - pcifunc = pf <<10 | vf; + pcifunc =rvu_make_pcifunc (rvu->pdev, pf, vf);if (!pcifunc)continue ;
@@ -842,7 +842,7 @@ static int rvu_dbg_rvu_pf_cgx_map_display(struct seq_file *filp, void *unused) cgx[0 ] =0 ; lmac[0 ] =0 ; - pcifunc = pf <<10 ; + pcifunc =rvu_make_pcifunc (rvu->pdev, pf,0 ); pfvf =rvu_get_pfvf (rvu, pcifunc);if (pfvf->nix_blkaddr ==BLKADDR_NIX0 )
@@ -2623,10 +2623,10 @@ static int rvu_dbg_nix_band_prof_ctx_display(struct seq_file *m, void *unused) pcifunc = ipolicer->pfvf_map[idx];if (!(pcifunc &RVU_PFVF_FUNC_MASK ))seq_printf (m,"Allocated to :: PF %d\n" , -rvu_get_pf (pcifunc)); +rvu_get_pf (rvu->pdev, pcifunc));else seq_printf (m,"Allocated to :: PF %d VF %d\n" , -rvu_get_pf (pcifunc), +rvu_get_pf (rvu->pdev, pcifunc), (pcifunc &RVU_PFVF_FUNC_MASK ) -1 );print_band_prof_ctx (m, &aq_rsp.prof); }
@@ -2983,10 +2983,10 @@ static void rvu_print_npc_mcam_info(struct seq_file *s,if (!(pcifunc &RVU_PFVF_FUNC_MASK ))seq_printf (s,"\n\t\t Device \t\t: PF%d\n" , -rvu_get_pf (pcifunc)); +rvu_get_pf (rvu->pdev, pcifunc));else seq_printf (s,"\n\t\t Device \t\t: PF%d VF%d\n" , -rvu_get_pf (pcifunc), +rvu_get_pf (rvu->pdev, pcifunc), (pcifunc &RVU_PFVF_FUNC_MASK ) -1 );if (entry_acnt) {
@@ -3049,13 +3049,13 @@ static int rvu_dbg_npc_mcam_info_display(struct seq_file *filp, void *unsued)seq_puts (filp,"\n\t\t Current allocation\n" );seq_puts (filp,"\t\t====================\n" );for (pf =0 ; pf < rvu->hw->total_pfs; pf++) { - pcifunc = (pf <<RVU_PFVF_PF_SHIFT ); + pcifunc =rvu_make_pcifunc (rvu->pdev, pf,0 );rvu_print_npc_mcam_info (filp, pcifunc, blkaddr); cfg =rvu_read64 (rvu,BLKADDR_RVUM ,RVU_PRIV_PFX_CFG (pf)); numvfs = (cfg >>12 ) &0xFF ;for (vf =0 ; vf < numvfs; vf++) { - pcifunc = (pf <<RVU_PFVF_PF_SHIFT ) | (vf +1 ); + pcifunc =rvu_make_pcifunc (rvu->pdev, pf, (vf +1 ));rvu_print_npc_mcam_info (filp, pcifunc, blkaddr); } }
@@ -3326,7 +3326,7 @@ static int rvu_dbg_npc_mcam_show_rules(struct seq_file *s, void *unused)mutex_lock (&mcam->lock);list_for_each_entry (iter, &mcam->mcam_rules, list) { - pf = (iter->owner >>RVU_PFVF_PF_SHIFT ) &RVU_PFVF_PF_MASK ; + pf =rvu_get_pf (rvu->pdev, iter->owner);seq_printf (s,"\n\tInstalled by: PF%d " , pf);if (iter->owner &RVU_PFVF_FUNC_MASK ) {
@@ -3344,7 +3344,7 @@ static int rvu_dbg_npc_mcam_show_rules(struct seq_file *s, void *unused)rvu_dbg_npc_mcam_show_flows (s, iter);if (is_npc_intf_rx (iter->intf)) { target = iter->rx_action.pf_func; - pf = (target >>RVU_PFVF_PF_SHIFT ) &RVU_PFVF_PF_MASK ; + pf =rvu_get_pf (rvu->pdev, target);seq_printf (s,"\tForward to: PF%d " , pf);if (target &RVU_PFVF_FUNC_MASK ) {
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +29 -25
196 lines not on this page · raw message
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +5 -3
@@ -147,7 +147,9 @@ static int npc_get_ucast_mcam_index(struct npc_mcam *mcam, u16 pcifunc,int npc_get_nixlf_mcam_index (struct npc_mcam *mcam,u16 pcifunc,int nixlf,int type) { -int pf =rvu_get_pf (pcifunc); + struct rvu_hwinfo *hw = container_of(mcam, struct rvu_hwinfo, mcam); +struct rvu *rvu = hw->rvu; +int pf =rvu_get_pf (rvu->pdev, pcifunc);int index;/* Check if this is for a PF */
@@ -698,7 +700,7 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc,/* RX_ACTION set to MCAST for CGX PF's */ if (hw->cap.nix_rx_multicast && pfvf->use_mce_list && -is_pf_cgxmapped (rvu,rvu_get_pf (pcifunc))) { +is_pf_cgxmapped (rvu,rvu_get_pf (rvu->pdev, pcifunc))) { *(u64 *)&action =0 ; action.op =NIX_RX_ACTIONOP_MCAST ; pfvf =rvu_get_pfvf (rvu, pcifunc & ~RVU_PFVF_FUNC_MASK );
@@ -3434,7 +3436,7 @@ int rvu_npc_set_parse_mode(struct rvu *rvu, u16 pcifunc, u64 mode, u8 dir, {struct rvu_pfvf *pfvf =rvu_get_pfvf (rvu, pcifunc);int blkaddr, nixlf, rc, intf_mode; -int pf =rvu_get_pf (pcifunc); +int pf =rvu_get_pf (rvu->pdev, pcifunc);u64 rxpkind, txpkind;u8 cgx_id, lmac_id;
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c +8 -8
@@ -1465,7 +1465,7 @@ static int rvu_npc_exact_update_table_entry(struct rvu *rvu, u8 cgx_id, u8 lmac_int rvu_npc_exact_promisc_disable (struct rvu *rvu,u16 pcifunc) {struct npc_exact_table *table; -int pf =rvu_get_pf (pcifunc); +int pf =rvu_get_pf (rvu->pdev, pcifunc);u8 cgx_id, lmac_id;u32 drop_mcam_idx;bool *promisc;
@@ -1512,7 +1512,7 @@ int rvu_npc_exact_promisc_disable(struct rvu *rvu, u16 pcifunc)int rvu_npc_exact_promisc_enable (struct rvu *rvu,u16 pcifunc) {struct npc_exact_table *table; -int pf =rvu_get_pf (pcifunc); +int pf =rvu_get_pf (rvu->pdev, pcifunc);u8 cgx_id, lmac_id;u32 drop_mcam_idx;bool *promisc;
@@ -1560,7 +1560,7 @@ int rvu_npc_exact_promisc_enable(struct rvu *rvu, u16 pcifunc)int rvu_npc_exact_mac_addr_reset (struct rvu *rvu,struct cgx_mac_addr_reset_req *req,struct msg_rsp *rsp) { -int pf =rvu_get_pf (req->hdr.pcifunc); +int pf =rvu_get_pf (rvu->pdev, req->hdr.pcifunc);u32 seq_id = req->index;struct rvu_pfvf *pfvf;u8 cgx_id, lmac_id;
@@ -1593,7 +1593,7 @@ int rvu_npc_exact_mac_addr_update(struct rvu *rvu,struct cgx_mac_addr_update_req *req, struct cgx_mac_addr_update_rsp *rsp) { - int pf = rvu_get_pf(req->hdr.pcifunc); + int pf = rvu_get_pf(rvu->pdev, req->hdr.pcifunc);struct npc_exact_table_entry *entry;struct npc_exact_table *table;struct rvu_pfvf *pfvf;
@@ -1675,7 +1675,7 @@ int rvu_npc_exact_mac_addr_add(struct rvu *rvu,struct cgx_mac_addr_add_req *req, struct cgx_mac_addr_add_rsp *rsp) { - int pf = rvu_get_pf(req->hdr.pcifunc); + int pf = rvu_get_pf(rvu->pdev, req->hdr.pcifunc);struct rvu_pfvf *pfvf;u8 cgx_id, lmac_id;int rc =0 ;
@@ -1711,7 +1711,7 @@ int rvu_npc_exact_mac_addr_del(struct rvu *rvu,struct cgx_mac_addr_del_req *req, struct msg_rsp *rsp) { - int pf = rvu_get_pf(req->hdr.pcifunc); + int pf = rvu_get_pf(rvu->pdev, req->hdr.pcifunc);int rc; rc =rvu_npc_exact_del_table_entry_by_id (rvu, req->index);
@@ -1736,7 +1736,7 @@ int rvu_npc_exact_mac_addr_del(struct rvu *rvu,int rvu_npc_exact_mac_addr_set (struct rvu *rvu,struct cgx_mac_addr_set_or_get *req,struct cgx_mac_addr_set_or_get *rsp) { -int pf =rvu_get_pf (req->hdr.pcifunc); +int pf =rvu_get_pf (rvu->pdev, req->hdr.pcifunc);u32 seq_id = req->index;struct rvu_pfvf *pfvf;u8 cgx_id, lmac_id;
@@ -2001,7 +2001,7 @@ int rvu_npc_exact_init(struct rvu *rvu) }/* Filter rules are only for PF */ - pcifunc =RVU_PFFUNC (i,0 ); + pcifunc =RVU_PFFUNC (rvu->pdev, i,0 ); dev_dbg(rvu->dev, "%s:Drop rule cgx=%d lmac=%d chan(val=0x%llx, mask=0x%llx\n",
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.h +1 -3
@@ -139,9 +139,7 @@ static struct npc_mcam_kex_hash npc_mkex_hash_default __maybe_unused = {#define NPC_MCAM_DROP_RULE_MAX 30#define NPC_MCAM_SDP_DROP_RULE_IDX 0 -#define RVU_PFFUNC (pf, func) \ - ((((pf) & RVU_PFVF_PF_MASK) << RVU_PFVF_PF_SHIFT) | \ - (((func) & RVU_PFVF_FUNC_MASK) << RVU_PFVF_FUNC_SHIFT)) +#define RVU_PFFUNC (pdev, pf, func) rvu_make_pcifunc(pdev, pf, func)enum npc_exact_opc_type {NPC_EXACT_OPC_MEM ,
drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c +6 -7
@@ -39,7 +39,7 @@ static int rvu_rep_up_notify(struct rvu *rvu, struct rep_event *event)struct rep_event *msg;int pf; - pf =rvu_get_pf (event->pcifunc); + pf =rvu_get_pf (rvu->pdev, event->pcifunc);if (event->event &RVU_EVENT_MAC_ADDR_CHANGE )ether_addr_copy (pfvf->mac_addr, event->evt_data.mac);
@@ -114,10 +114,10 @@ int rvu_rep_notify_pfvf_state(struct rvu *rvu, u16 pcifunc, bool enable)struct rep_event *req;int pf; -if (!is_pf_cgxmapped (rvu,rvu_get_pf (pcifunc))) +if (!is_pf_cgxmapped (rvu,rvu_get_pf (rvu->pdev, pcifunc)))return 0 ; - pf =rvu_get_pf (rvu->rep_pcifunc); + pf =rvu_get_pf (rvu->pdev, rvu->rep_pcifunc);mutex_lock (&rvu->mbox_lock); req =otx2_mbox_alloc_msg_rep_event_up_notify (rvu, pf);
@@ -325,7 +325,7 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)if (!is_pf_cgxmapped (rvu, pf))continue ; - pcifunc = pf <<RVU_PFVF_PF_SHIFT ; + pcifunc =rvu_make_pcifunc (rvu->pdev, pf,0 );rvu_get_nix_blkaddr (rvu, pcifunc); rep = true;for (i =0 ; i <2 ; i++) {
@@ -345,8 +345,7 @@ int rvu_rep_install_mcam_rules(struct rvu *rvu)rvu_get_pf_numvfs (rvu, pf, &numvfs,NULL );for (vf =0 ; vf < numvfs; vf++) { - pcifunc = pf <<RVU_PFVF_PF_SHIFT | - ((vf +1 ) &RVU_PFVF_FUNC_MASK ); + pcifunc =rvu_make_pcifunc (rvu->pdev, pf, vf +1 );rvu_get_nix_blkaddr (rvu, pcifunc);/* Skip installimg rules if nixlf is not attached */
@@ -454,7 +453,7 @@ int rvu_mbox_handler_get_rep_cnt(struct rvu *rvu, struct msg_req *req,for (pf =0 ; pf < rvu->hw->total_pfs; pf++) {if (!is_pf_cgxmapped (rvu, pf))continue ; - pcifunc = pf <<RVU_PFVF_PF_SHIFT ; + pcifunc =rvu_make_pcifunc (rvu->pdev, pf,0 ); rvu->rep2pfvf_map[rep] = pcifunc; rsp->rep_pf_map[rep] = pcifunc; rep++;
drivers/net/ethernet/marvell/octeontx2/af/rvu_sdp.c +5 -5
@@ -17,9 +17,9 @@/* SDP PF number */ static int sdp_pf_num[MAX_SDP ] = {-1 ,-1 }; -bool is_sdp_pfvf (u16 pcifunc) +bool is_sdp_pfvf (struct rvu *rvu,u16 pcifunc) { -u16 pf =rvu_get_pf (pcifunc); +u16 pf =rvu_get_pf (rvu->pdev, pcifunc);u32 found =0 , i =0 ;while (i <MAX_SDP ) {
@@ -34,9 +34,9 @@ bool is_sdp_pfvf(u16 pcifunc)return true; } -bool is_sdp_pf (u16 pcifunc) +bool is_sdp_pf (struct rvu *rvu,u16 pcifunc) { -return (is_sdp_pfvf (pcifunc) && +return (is_sdp_pfvf (rvu, pcifunc) && !(pcifunc &RVU_PFVF_FUNC_MASK )); }
@@ -46,7 +46,7 @@ bool is_sdp_vf(struct rvu *rvu, u16 pcifunc)if (!(pcifunc & ~RVU_PFVF_FUNC_MASK ))return (rvu->vf_devid ==RVU_SDP_VF_DEVID ); -return (is_sdp_pfvf (pcifunc) && +return (is_sdp_pfvf (rvu, pcifunc) && !!(pcifunc &RVU_PFVF_FUNC_MASK )); }
drivers/net/ethernet/marvell/octeontx2/af/rvu_switch.c +4 -4
@@ -93,7 +93,7 @@ static int rvu_switch_install_rules(struct rvu *rvu)if (!is_pf_cgxmapped (rvu, pf))continue ; - pcifunc = pf <<10 ; + pcifunc =rvu_make_pcifunc (rvu->pdev, pf,0 );/* rvu_get_nix_blkaddr sets up the corresponding NIX block * address and NIX RX and TX interfaces for a pcifunc. * Generally it is called during attach call of a pcifunc but it
@@ -126,7 +126,7 @@ static int rvu_switch_install_rules(struct rvu *rvu)rvu_get_pf_numvfs (rvu, pf, &numvfs,NULL );for (vf =0 ; vf < numvfs; vf++) { - pcifunc = pf <<10 | ((vf +1 ) &0x3FF ); + pcifunc =rvu_make_pcifunc (rvu->pdev, pf, (vf +1 ));rvu_get_nix_blkaddr (rvu, pcifunc); err =rvu_switch_install_rx_rule (rvu, pcifunc,0x0 );
@@ -236,7 +236,7 @@ void rvu_switch_disable(struct rvu *rvu)if (!is_pf_cgxmapped (rvu, pf))continue ; - pcifunc = pf <<10 ; + pcifunc =rvu_make_pcifunc (rvu->pdev, pf,0 ); err =rvu_switch_install_rx_rule (rvu, pcifunc,0xFFF );if (err) dev_err(rvu->dev,
@@ -248,7 +248,7 @@ void rvu_switch_disable(struct rvu *rvu)rvu_get_pf_numvfs (rvu, pf, &numvfs,NULL );for (vf =0 ; vf < numvfs; vf++) { - pcifunc = pf <<10 | ((vf +1 ) &0x3FF ); + pcifunc =rvu_make_pcifunc (rvu->pdev, pf, (vf +1 )); err =rvu_switch_install_rx_rule (rvu, pcifunc,0xFFF );if (err) dev_err(rvu->dev,
drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c +1 -1
@@ -481,7 +481,7 @@ static int cn10k_outb_write_sa(struct otx2_nic *pf, struct qmem *sa_info) goto set_available;/* Trigger CTX flush to write dirty data back to DRAM */ - reg_val =FIELD_PREP (CPT_LF_CTX_FLUSH , sa_iova >>7 ); + reg_val =FIELD_PREP (CPT_LF_CTX_FLUSH_CPTR , sa_iova >>7 );otx2_write64 (pf,CN10K_CPT_LF_CTX_FLUSH , reg_val); set_available:
drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.h +1 -1
@@ -220,7 +220,7 @@ struct cpt_sg_s {#define CPT_LF_Q_SIZE_DIV40 GENMASK_ULL(14, 0)/* CPT LF CTX Flush Register */ -#define CPT_LF_CTX_FLUSH GENMASK_ULL(45, 0) +#define CPT_LF_CTX_FLUSH_CPTR GENMASK_ULL(45, 0)#ifdef CONFIG_XFRM_OFFLOAD int cn10k_ipsec_init (struct net_device *netdev);
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h +1 -10
@@ -28,6 +28,7 @@#include "otx2_reg.h" #include "otx2_txrx.h" #include "otx2_devlink.h" +#include <rvu.h> #include <rvu_trace.h> #include "qos.h" #include "rep.h"
@@ -900,21 +901,11 @@ MBOX_UP_MCS_MESSAGES/* Time to wait before watchdog kicks off */ #define OTX2_TX_TIMEOUT (100 * HZ) -#define RVU_PFVF_PF_SHIFT 10 -#define RVU_PFVF_PF_MASK 0x3F -#define RVU_PFVF_FUNC_SHIFT 0 -#define RVU_PFVF_FUNC_MASK 0x3FF -static inline bool is_otx2_vf (u16 pcifunc) {return !!(pcifunc &RVU_PFVF_FUNC_MASK ); } -static inline int rvu_get_pf (u16 pcifunc) -{ -return (pcifunc >>RVU_PFVF_PF_SHIFT ) &RVU_PFVF_PF_MASK ; -} - static inline dma_addr_t otx2_dma_map_page(struct otx2_nic *pfvf, struct page *page, size_t offset, size_t size,
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +12 -9
@@ -206,7 +206,8 @@ static int otx2_register_flr_me_intr(struct otx2_nic *pf, int numvfs)/* Register ME interrupt handler*/ irq_name = &hw->irq_name[RVU_PF_INT_VEC_VFME0 *NAME_SIZE ]; -snprintf (irq_name,NAME_SIZE ,"RVUPF%d_ME0" ,rvu_get_pf (pf->pcifunc)); +snprintf (irq_name,NAME_SIZE ,"RVUPF%d_ME0" , +rvu_get_pf (pf->pdev, pf->pcifunc)); ret =request_irq (pci_irq_vector (pf->pdev,RVU_PF_INT_VEC_VFME0 ), otx2_pf_me_intr_handler,0 , irq_name, pf);if (ret) {
@@ -216,7 +217,8 @@ static int otx2_register_flr_me_intr(struct otx2_nic *pf, int numvfs)/* Register FLR interrupt handler */ irq_name = &hw->irq_name[RVU_PF_INT_VEC_VFFLR0 *NAME_SIZE ]; -snprintf (irq_name,NAME_SIZE ,"RVUPF%d_FLR0" ,rvu_get_pf (pf->pcifunc)); +snprintf (irq_name,NAME_SIZE ,"RVUPF%d_FLR0" , +rvu_get_pf (pf->pdev, pf->pcifunc)); ret =request_irq (pci_irq_vector (pf->pdev,RVU_PF_INT_VEC_VFFLR0 ), otx2_pf_flr_intr_handler,0 , irq_name, pf);if (ret) {
@@ -228,7 +230,7 @@ static int otx2_register_flr_me_intr(struct otx2_nic *pf, int numvfs)if (numvfs >64 ) { irq_name = &hw->irq_name[RVU_PF_INT_VEC_VFME1 *NAME_SIZE ];snprintf (irq_name,NAME_SIZE ,"RVUPF%d_ME1" , -rvu_get_pf (pf->pcifunc)); +rvu_get_pf (pf->pdev, pf->pcifunc)); ret =request_irq (pci_irq_vector (pf->pdev,RVU_PF_INT_VEC_VFME1 ), otx2_pf_me_intr_handler,0 , irq_name, pf);
@@ -238,7 +240,7 @@ static int otx2_register_flr_me_intr(struct otx2_nic *pf, int numvfs) } irq_name = &hw->irq_name[RVU_PF_INT_VEC_VFFLR1 *NAME_SIZE ];snprintf (irq_name,NAME_SIZE ,"RVUPF%d_FLR1" , -rvu_get_pf (pf->pcifunc)); +rvu_get_pf (pf->pdev, pf->pcifunc)); ret =request_irq (pci_irq_vector (pf->pdev,RVU_PF_INT_VEC_VFFLR1 ), otx2_pf_flr_intr_handler,0 , irq_name, pf);
@@ -701,7 +703,7 @@ static int otx2_register_pfvf_mbox_intr(struct otx2_nic *pf, int numvfs) irq_name = &hw->irq_name[RVU_PF_INT_VEC_VFPF_MBOX0 *NAME_SIZE ];if (pf->pcifunc)snprintf (irq_name,NAME_SIZE , -"RVUPF%d_VF Mbox0" ,rvu_get_pf (pf->pcifunc)); +"RVUPF%d_VF Mbox0" ,rvu_get_pf (pf->pdev, pf->pcifunc));else snprintf (irq_name,NAME_SIZE ,"RVUPF_VF Mbox0" ); err = request_irq(pci_irq_vector(pf->pdev, RVU_PF_INT_VEC_VFPF_MBOX0),
@@ -717,7 +719,8 @@ static int otx2_register_pfvf_mbox_intr(struct otx2_nic *pf, int numvfs) irq_name = &hw->irq_name[RVU_PF_INT_VEC_VFPF_MBOX1 *NAME_SIZE ];if (pf->pcifunc)snprintf (irq_name,NAME_SIZE , -"RVUPF%d_VF Mbox1" ,rvu_get_pf (pf->pcifunc)); +"RVUPF%d_VF Mbox1" , +rvu_get_pf (pf->pdev, pf->pcifunc));else snprintf (irq_name,NAME_SIZE ,"RVUPF_VF Mbox1" ); err = request_irq(pci_irq_vector(pf->pdev,
@@ -1972,7 +1975,7 @@ int otx2_open(struct net_device *netdev)if (err) {dev_err (pf->dev,"RVUPF%d: IRQ registration failed for QERR\n" , -rvu_get_pf (pf->pcifunc)); +rvu_get_pf (pf->pdev, pf->pcifunc)); goto err_disable_napi; }
@@ -1990,7 +1993,7 @@ int otx2_open(struct net_device *netdev)if (name_len >=NAME_SIZE ) {dev_err (pf->dev,"RVUPF%d: IRQ registration failed for CQ%d, irq name is too long\n" , -rvu_get_pf (pf->pcifunc), qidx); +rvu_get_pf (pf->pdev, pf->pcifunc), qidx); err = -EINVAL ; goto err_free_cints; }
@@ -2001,7 +2004,7 @@ int otx2_open(struct net_device *netdev)if (err) {dev_err (pf->dev,"RVUPF%d: IRQ registration failed for CQ%d\n" , -rvu_get_pf (pf->pcifunc), qidx); +rvu_get_pf (pf->pdev, pf->pcifunc), qidx); goto err_free_cints; } vec++;
drivers/net/ethernet/marvell/octeontx2/nic/otx2_reg.h +0 -30
@@ -138,36 +138,6 @@#define NIX_LF_CINTX_ENA_W1S (a) (NIX_LFBASE | 0xD40 | (a) << 12)#define NIX_LF_CINTX_ENA_W1C (a) (NIX_LFBASE | 0xD50 | (a) << 12) -/* NIX AF transmit scheduler registers */ -#define NIX_AF_SMQX_CFG (a) (0x700 | (u64)(a) << 16) -#define NIX_AF_TL4X_SDP_LINK_CFG (a) (0xB10 | (u64)(a) << 16) -#define NIX_AF_TL1X_SCHEDULE (a) (0xC00 | (u64)(a) << 16) -#define NIX_AF_TL1X_CIR (a) (0xC20 | (u64)(a) << 16) -#define NIX_AF_TL1X_TOPOLOGY (a) (0xC80 | (u64)(a) << 16) -#define NIX_AF_TL2X_PARENT (a) (0xE88 | (u64)(a) << 16) -#define NIX_AF_TL2X_SCHEDULE (a) (0xE00 | (u64)(a) << 16) -#define NIX_AF_TL2X_TOPOLOGY (a) (0xE80 | (u64)(a) << 16) -#define NIX_AF_TL2X_CIR (a) (0xE20 | (u64)(a) << 16) -#define NIX_AF_TL2X_PIR (a) (0xE30 | (u64)(a) << 16) -#define NIX_AF_TL3X_PARENT (a) (0x1088 | (u64)(a) << 16) -#define NIX_AF_TL3X_SCHEDULE (a) (0x1000 | (u64)(a) << 16) -#define NIX_AF_TL3X_SHAPE (a) (0x1010 | (u64)(a) << 16) -#define NIX_AF_TL3X_CIR (a) (0x1020 | (u64)(a) << 16) -#define NIX_AF_TL3X_PIR (a) (0x1030 | (u64)(a) << 16) -#define NIX_AF_TL3X_TOPOLOGY (a) (0x1080 | (u64)(a) << 16) -#define NIX_AF_TL4X_PARENT (a) (0x1288 | (u64)(a) << 16) -#define NIX_AF_TL4X_SCHEDULE (a) (0x1200 | (u64)(a) << 16) -#define NIX_AF_TL4X_SHAPE (a) (0x1210 | (u64)(a) << 16) -#define NIX_AF_TL4X_CIR (a) (0x1220 | (u64)(a) << 16) -#define NIX_AF_TL4X_PIR (a) (0x1230 | (u64)(a) << 16) -#define NIX_AF_TL4X_TOPOLOGY (a) (0x1280 | (u64)(a) << 16) -#define NIX_AF_MDQX_SCHEDULE (a) (0x1400 | (u64)(a) << 16) -#define NIX_AF_MDQX_SHAPE (a) (0x1410 | (u64)(a) << 16) -#define NIX_AF_MDQX_CIR (a) (0x1420 | (u64)(a) << 16) -#define NIX_AF_MDQX_PIR (a) (0x1430 | (u64)(a) << 16) -#define NIX_AF_MDQX_PARENT (a) (0x1480 | (u64)(a) << 16) -#define NIX_AF_TL3_TL2X_LINKX_CFG (a, b) (0x1700 | (u64)(a) << 16 | (b) << 3) -/* LMT LF registers */ #define LMT_LFBASE BIT_ULL(RVU_FUNC_BLKADDR_SHIFT)#define LMT_LF_LMTLINEX (a) (LMT_LFBASE | 0x000 | (a) << 12)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c +2 -1
@@ -467,7 +467,8 @@ static int otx2_tc_parse_actions(struct otx2_nic *nic, target = act->dev;if (target->dev.parent) { priv =netdev_priv (target); -if (rvu_get_pf (nic->pcifunc) !=rvu_get_pf (priv->pcifunc)) { +if (rvu_get_pf (nic->pdev, nic->pcifunc) != +rvu_get_pf (nic->pdev, priv->pcifunc)) {NL_SET_ERR_MSG_MOD (extack,"can't redirect to other pf/vf" );return -EOPNOTSUPP ;
drivers/net/ethernet/marvell/octeontx2/nic/rep.c +4 -3
@@ -244,10 +244,10 @@ static int rvu_rep_devlink_port_register(struct rep_dev *rep)if (!(rep->pcifunc &RVU_PFVF_FUNC_MASK )) { attrs.flavour =DEVLINK_PORT_FLAVOUR_PHYSICAL ; - attrs.phys.port_number =rvu_get_pf (rep->pcifunc); + attrs.phys.port_number =rvu_get_pf (priv->pdev, rep->pcifunc); }else { attrs.flavour =DEVLINK_PORT_FLAVOUR_PCI_VF ; - attrs.pci_vf.pf =rvu_get_pf (rep->pcifunc); + attrs.pci_vf.pf =rvu_get_pf (priv->pdev, rep->pcifunc); attrs.pci_vf.vf = rep->pcifunc &RVU_PFVF_FUNC_MASK ; }
@@ -683,7 +683,8 @@ int rvu_rep_create(struct otx2_nic *priv, struct netlink_ext_ack *extack) rep->pcifunc = pcifunc;snprintf (ndev->name,sizeof (ndev->name),"Rpf%dvf%d" , -rvu_get_pf (pcifunc), (pcifunc &RVU_PFVF_FUNC_MASK )); +rvu_get_pf (priv->pdev, pcifunc), + (pcifunc &RVU_PFVF_FUNC_MASK )); ndev->hw_features = (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | NETIF_F_RXHASH |
include/linux/soc/marvell/silicons.h new file +25 -0
@@ -0,0 +1,25 @@ +/* SPDX-License-Identifier: GPL-2.0-only +* Copyright (C) 2024 Marvell. +*/ + +#ifndef __SOC_SILICON_H +#define __SOC_SILICON_H + +#include <linux/types.h> +#include <linux/pci.h> + +#if defined(CONFIG_ARM64 ) + +#define CN20K_CHIPID 0x20 +/* +* Silicon check for CN20K family +*/ +static inline bool is_cn20k (struct pci_dev *pdev) +{ +return (pdev->subsystem_device &0xFF ) ==CN20K_CHIPID ; +} +#else +#define is_cn20k (pdev) ((void)(pdev), 0) +#endif + +#endif /* __SOC_SILICON_H */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 65/142 Octeontx2-af: Fix NIX X2P calibration failures
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hariprasad Kelam <[email protected]>
[ Upstream commit d280233fc86692f495d5e08092e5422bc2f583a8 ]
Before configuring the NIX block, the AF driver initiates the "NIX block X2P bus calibration" and verifies that NIX interfaces such as CGX and LBK are active and functioning correctly.
On few silicon variants(CNF10KA and CNF10KB), X2P calibration failures have been observed on some CGX blocks that are not mapped to the NIX block.
Since both NIX-mapped and non-NIX-mapped CGX blocks share the same VENDOR,DEVICE,SUBSYS_DEVID, it's not possible to skip probe based on these parameters.
This patch introuduces "is_cgx_mapped_to_nix" API to detect and skip probe of non NIX mapped CGX blocks.
--- drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 +++++++ drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 14 ++++++++++++++ 2 files changed, 21 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +7 -0
@@ -1940,6 +1940,13 @@ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto err_release_regions; } +if (!is_cn20k (pdev) && + !is_cgx_mapped_to_nix (pdev->subsystem_device, cgx->cgx_id)) { +dev_notice (dev,"CGX %d not mapped to NIX, skipping probe\n" , + cgx->cgx_id); + goto err_release_regions; + } + cgx->lmac_count = cgx->mac_ops->get_nr_lmacs (cgx);if (!cgx->lmac_count) {dev_notice (dev,"CGX %d LMAC count is zero, skipping probe\n" , cgx->cgx_id);
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +14 -0
@@ -761,6 +761,20 @@ static inline bool is_cn10kb(struct rvu *rvu)return false; } +static inline bool is_cgx_mapped_to_nix (unsigned short id,u8 cgx_id) +{ +/* On CNF10KA and CNF10KB silicons only two CGX blocks are connected +* to NIX. +*/ +if (id ==PCI_SUBSYS_DEVID_CNF10K_A || id ==PCI_SUBSYS_DEVID_CNF10K_B ) +return cgx_id <=1 ; + +return !(cgx_id && !(id ==PCI_SUBSYS_DEVID_96XX || + id ==PCI_SUBSYS_DEVID_98XX || + id ==PCI_SUBSYS_DEVID_CN10K_A || + id ==PCI_SUBSYS_DEVID_CN10K_B )); +} +static inline bool is_rvu_npc_hash_extract_en (struct rvu *rvu) {u64 npc_const3;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 66/142 mISDN: hfcpci: Fix warning when deleting uninitialized timer
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Riabchun <[email protected]>
[ Upstream commit 97766512a9951b9fd6fc97f1b93211642bb0b220 ]
With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:
[ 250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0 [ 250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0 [ 250.218775] Modules linked in: hfcpci(-) mISDN_core [ 250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary) [ 250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0 [ 250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d [ 250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286 [ 250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95 [ 250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0 [ 250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39 [ 250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001 [ 250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8 [ 250.232454] FS: 00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000 [ 250.233851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0 [ 250.236117] Call Trace: [ 250.236599] <TASK> [ 250.236967] ? trace_irq_enable.constprop.0+0xd4/0x130 [ 250.237920] debug_object_assert_init+0x1f6/0x310 [ 250.238762] ? __pfx_debug_object_assert_init+0x10/0x10 [ 250.239658] ? __lock_acquire+0xdea/0x1c70 [ 250.240369] __try_to_del_timer_sync+0x69/0x140 [ 250.241172] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 250.242058] ? __timer_delete_sync+0xc6/0x120 [ 250.242842] ? lock_acquire+0x30/0x80 [ 250.243474] ? __timer_delete_sync+0xc6/0x120 [ 250.244262] __timer_delete_sync+0x98/0x120 [ 250.245015] HFC_cleanup+0x10/0x20 [hfcpci] [ 250.245704] __do_sys_delete_module+0x348/0x510 [ 250.246461] ? __pfx___do_sys_delete_module+0x10/0x10 [ 250.247338] do_syscall_64+0xc1/0x360 [ 250.247924] entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fix this by initializing hfc_tl timer with DEFINE_TIMER macro. Also, use mod_timer instead of manual timeout update.
--- drivers/isdn/hardware/mISDN/hfcpci.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/isdn/hardware/mISDN/hfcpci.c +5 -7
@@ -39,12 +39,13 @@#include "hfc_pci.h" +static void hfcpci_softirq (struct timer_list *unused);static const char *hfcpci_revision ="2.0" ;static int HFC_cnt;static uint debug;static uint poll, tics; -static struct timer_list hfc_tl; +static DEFINE_TIMER(hfc_tl, hfcpci_softirq);static unsigned long hfc_jiffies;MODULE_AUTHOR ("Karsten Keil" );
@@ -2305,8 +2306,7 @@ hfcpci_softirq(struct timer_list *unused) hfc_jiffies = jiffies +1 ; else hfc_jiffies += tics; - hfc_tl.expires = hfc_jiffies; -add_timer (&hfc_tl); +mod_timer (&hfc_tl, hfc_jiffies); } static int __init
@@ -2332,10 +2332,8 @@ HFC_init(void)if (poll !=HFCPCI_BTRANS_THRESHOLD ) {printk (KERN_INFO "%s: Using alternative poll value of %d\n" , __func__, poll); -timer_setup (&hfc_tl, hfcpci_softirq,0 ); - hfc_tl.expires = jiffies + tics; - hfc_jiffies = hfc_tl.expires; -add_timer (&hfc_tl); + hfc_jiffies = jiffies + tics; +mod_timer (&hfc_tl, hfc_jiffies); }else tics =0 ;/* indicate the use of controller's timer */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 67/142 net: dlink: fix multicast stats being counted incorrectly
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeounsu Moon <[email protected]>
[ Upstream commit 007a5ffadc4fd51739527f1503b7cf048f31c413 ]
McstFramesRcvdOk counts the number of received multicast packets, and it reports the value correctly.
However, reading McstFramesRcvdOk clears the register to zero. As a result, the driver was reporting only the packets since the last read, instead of the accumulated total.
Fix this by updating the multicast statistics accumulatively instaed of instantaneously.
Tested-on: D-Link DGE-550T Rev-A3
--- drivers/net/ethernet/dlink/dl2k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/dlink/dl2k.c +1 -1
@@ -1091,7 +1091,7 @@ get_stats (struct net_device *dev) dev->stats.rx_bytes +=dr32 (OctetRcvOk); dev->stats.tx_bytes +=dr32 (OctetXmtOk); - dev->stats.multicast =dr32 (McstFramesRcvdOk); + dev->stats.multicast +=dr32 (McstFramesRcvdOk); dev->stats.collisions +=dr32 (SingleColFrames) +dr32 (MultiColFrames);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 68/142 efi: stmm: Fix incorrect buffer allocation method
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
[ Upstream commit c5e81e672699e0c5557b2b755cc8f7a69aa92bff ]
The communication buffer allocated by setup_mm_hdr() is later on passed to tee_shm_register_kernel_buf(). The latter expects those buffers to be contiguous pages, but setup_mm_hdr() just uses kmalloc(). That can cause various corruptions or BUGs, specifically since commit 9aec2fb0fd5e ("slab: allocate frozen pages"), though it was broken before as well.
Fix this by using alloc_pages_exact() instead of kmalloc().
--- drivers/firmware/efi/stmm/tee_stmm_efi.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-)
drivers/firmware/efi/stmm/tee_stmm_efi.c +12 -9
@@ -143,6 +143,10 @@ static efi_status_t mm_communicate(u8 *comm_buf, size_t payload_size)return var_hdr->ret_status; } +#define COMM_BUF_SIZE (__payload_size) (MM_COMMUNICATE_HEADER_SIZE + \ + MM_VARIABLE_COMMUNICATE_SIZE + \ + (__payload_size)) +/** * setup_mm_hdr() - Allocate a buffer for StandAloneMM and initialize the * header data.
@@ -173,9 +177,8 @@ static void *setup_mm_hdr(u8 **dptr, size_t payload_size, size_t func,return NULL ; } - comm_buf =kzalloc (MM_COMMUNICATE_HEADER_SIZE + -MM_VARIABLE_COMMUNICATE_SIZE + payload_size, -GFP_KERNEL ); + comm_buf =alloc_pages_exact (COMM_BUF_SIZE (payload_size), +GFP_KERNEL | __GFP_ZERO);if (!comm_buf) { *ret =EFI_OUT_OF_RESOURCES ;return NULL ;
@@ -239,7 +242,7 @@ static efi_status_t get_max_payload(size_t *size)*/ *size -=2 ; out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -282,7 +285,7 @@ static efi_status_t get_property_int(u16 *name, size_t name_size,memcpy (var_property, &smm_property->property,sizeof (*var_property)); out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -347,7 +350,7 @@ static efi_status_t tee_get_variable(u16 *name, efi_guid_t *vendor,memcpy (data, (u8 *)var_acc->name + var_acc->name_size, var_acc->data_size); out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -404,7 +407,7 @@ static efi_status_t tee_get_next_variable(unsigned long *name_size,memcpy (name, var_getnext->name, var_getnext->name_size); out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -467,7 +470,7 @@ static efi_status_t tee_set_variable(efi_char16_t *name, efi_guid_t *vendor, ret =mm_communicate (comm_buf, payload_size);dev_dbg (pvt_data.dev,"Set Variable %s %d %lx\n" , __FILE__, __LINE__, ret); out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
@@ -507,7 +510,7 @@ static efi_status_t tee_query_variable_info(u32 attributes, *max_variable_size = mm_query_info->max_variable_size; out: -kfree (comm_buf); +free_pages_exact (comm_buf,COMM_BUF_SIZE (payload_size));return ret; }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 69/142 drm/xe/xe_sync: avoid race during ufence signaling
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zbigniew Kempczyński <[email protected]>
[ Upstream commit 04e1f683cd28dc9407b238543871a6e09a570dc0 ]
Marking ufence as signalled after copy_to_user() is too late. Worker thread which signals ufence by memory write might be raced with another userspace vm-bind call. In map/unmap scenario unmap may still see ufence is not signalled causing -EBUSY. Change the order of marking / write to user-fence fixes this issue.
--- drivers/gpu/drm/xe/xe_sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_sync.c +1 -1
@@ -77,6 +77,7 @@ static void user_fence_worker(struct work_struct *w) { struct xe_user_fence *ufence = container_of(w, struct xe_user_fence, worker); +WRITE_ONCE (ufence->signalled,1 );if (mmget_not_zero (ufence->mm)) {kthread_use_mm (ufence->mm);if (copy_to_user (ufence->addr, &ufence->value,sizeof (ufence->value)))
@@ -91,7 +92,6 @@ static void user_fence_worker(struct work_struct *w)* Wake up waiters only after updating the ufence state, allowing the UMD * to safely reuse the same ufence without encountering -EBUSY errors. */ -WRITE_ONCE (ufence->signalled,1 );wake_up_all (&ufence->xe->ufence_wq);user_fence_put (ufence); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 60/142 ice: fix incorrect counter for buffer allocation failures
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kubiak <[email protected]>
[ Upstream commit b1a0c977c6f1130f7dd125ee3db8c2435d7e3d41 ]
Currently, the driver increments alloc_page_failed when buffer allocation fails in ice_clean_rx_irq(). However, this counter is intended for page allocation failures, not buffer allocation issues.
This patch corrects the counter by incrementing alloc_buf_failed instead, ensuring accurate statistics reporting for buffer allocation failures.
--- drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/ice/ice_txrx.c +1 -1
@@ -1295,7 +1295,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) skb =ice_construct_skb (rx_ring, xdp);/* exit if we failed to retrieve a buffer */ if (!skb) { - rx_ring->ring_stats->rx_stats.alloc_page_failed++; + rx_ring->ring_stats->rx_stats.alloc_buf_failed++; xdp_verdict =ICE_XDP_CONSUMED ; }ice_put_rx_mbuf (rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict);
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 95/142 net: rose: convert use field to refcount_t
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit d860d1faa6b2ce3becfdb8b0c2b048ad31800061 ]
The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths.
For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues.
This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.
--- include/net/rose.h | 18 +++++++++++++----- net/rose/af_rose.c | 13 +++++++------ net/rose/rose_in.c | 12 ++++++------ net/rose/rose_route.c | 33 ++++++++++++++++++--------------- net/rose/rose_timer.c | 2 +- 5 files changed, 45 insertions(+), 33 deletions(-)
include/net/rose.h +13 -5
@@ -8,6 +8,7 @@#ifndef _ROSE_H#define _ROSE_H +#include <linux/refcount.h>#include <linux/rose.h> #include <net/ax25.h> #include <net/sock.h>
@@ -96,7 +97,7 @@ struct rose_neigh {ax25_cb *ax25;struct net_device *dev;unsigned short count; -unsigned short use; +refcount_t use;unsigned int number;char restarted;char dce_mode;
@@ -151,12 +152,19 @@ struct rose_sock {#define rose_sk (sk) ((struct rose_sock *)(sk)) +static inline void rose_neigh_hold (struct rose_neigh *rose_neigh) +{ +refcount_inc (&rose_neigh->use); +} +static inline void rose_neigh_put (struct rose_neigh *rose_neigh) { -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh); +if (refcount_dec_and_test (&rose_neigh->use)) { +if (rose_neigh->ax25) +ax25_cb_put (rose_neigh->ax25); +kfree (rose_neigh->digipeat); +kfree (rose_neigh); + } }/* af_rose.c */
net/rose/af_rose.c +7 -6
@@ -170,7 +170,7 @@ void rose_kill_by_neigh(struct rose_neigh *neigh)if (rose->neighbour == neigh) {rose_disconnect (s,ENETUNREACH ,ROSE_OUT_OF_ORDER ,0 ); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour); rose->neighbour =NULL ; } }
@@ -212,7 +212,7 @@ static void rose_kill_by_device(struct net_device *dev)if (rose->device == dev) {rose_disconnect (sk,ENETUNREACH ,ROSE_OUT_OF_ORDER ,0 );if (rose->neighbour) - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);netdev_put (rose->device, &rose->dev_tracker); rose->device =NULL ; }
@@ -655,7 +655,7 @@ static int rose_release(struct socket *sock)break ;case ROSE_STATE_2 : - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);release_sock (sk);rose_disconnect (sk,0 ,-1 ,-1 );lock_sock (sk);
@@ -823,6 +823,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le rose->lci =rose_new_lci (rose->neighbour);if (!rose->lci) { err = -ENETUNREACH ; +rose_neigh_put (rose->neighbour); goto out_release; }
@@ -834,12 +835,14 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le dev =rose_dev_first ();if (!dev) { err = -ENETUNREACH ; +rose_neigh_put (rose->neighbour); goto out_release; } user =ax25_findbyuid (current_euid ());if (!user) { err = -EINVAL ; +rose_neigh_put (rose->neighbour);dev_put (dev); goto out_release; }
@@ -874,8 +877,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le rose->state =ROSE_STATE_1 ; - rose->neighbour->use++; -rose_write_internal (sk,ROSE_CALL_REQUEST );rose_start_heartbeat (sk);rose_start_t1timer (sk);
@@ -1077,7 +1078,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros GFP_ATOMIC); make_rose->facilities = facilities; - make_rose->neighbour->use++; +rose_neigh_hold (make_rose->neighbour);if (rose_sk (sk)->defer) { make_rose->state =ROSE_STATE_5 ;
net/rose/rose_in.c +6 -6
@@ -56,7 +56,7 @@ static int rose_state1_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,ECONNREFUSED , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -79,12 +79,12 @@ static int rose_state2_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;case ROSE_CLEAR_CONFIRMATION :rose_disconnect (sk,0 ,-1 ,-1 ); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -120,7 +120,7 @@ static int rose_state3_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;case ROSE_RR :
@@ -233,7 +233,7 @@ static int rose_state4_machine(struct sock *sk, struct sk_buff *skb, int frametycase ROSE_CLEAR_REQUEST :rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);break ;default :
@@ -253,7 +253,7 @@ static int rose_state5_machine(struct sock *sk, struct sk_buff *skb, int frametyif (frametype ==ROSE_CLEAR_REQUEST ) {rose_write_internal (sk,ROSE_CLEAR_CONFIRMATION );rose_disconnect (sk,0 , skb->data[3 ], skb->data[4 ]); -rose_sk (sk)->neighbour->use--; +rose_neigh_put (rose_sk (sk)->neighbour); }return 0 ;
net/rose/rose_route.c +18 -15
@@ -93,11 +93,11 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, rose_neigh->ax25 =NULL ; rose_neigh->dev = dev; rose_neigh->count =0 ; - rose_neigh->use =0 ; rose_neigh->dce_mode =0 ; rose_neigh->loopback =0 ; rose_neigh->number = rose_neigh_no++; rose_neigh->restarted =0 ; +refcount_set (&rose_neigh->use,1 );skb_queue_head_init (&rose_neigh->queue);
@@ -255,10 +255,10 @@ static void rose_remove_route(struct rose_route *rose_route)struct rose_route *s;if (rose_route->neigh1 !=NULL ) - rose_route->neigh1->use--; +rose_neigh_put (rose_route->neigh1);if (rose_route->neigh2 !=NULL ) - rose_route->neigh2->use--; +rose_neigh_put (rose_route->neigh2);if ((s = rose_route_list) == rose_route) { rose_route_list = rose_route->next;
@@ -323,7 +323,7 @@ static int rose_del_node(struct rose_route_struct *rose_route,if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; -if (rose_neigh->count ==0 && rose_neigh->use ==0 ) { +if (rose_neigh->count ==0 ) {rose_remove_neigh (rose_neigh);rose_neigh_put (rose_neigh); }
@@ -375,11 +375,11 @@ void rose_add_loopback_neigh(void) sn->ax25 =NULL ; sn->dev =NULL ; sn->count =0 ; - sn->use =0 ; sn->dce_mode =1 ; sn->loopback =1 ; sn->number = rose_neigh_no++; sn->restarted =1 ; +refcount_set (&sn->use,1 );skb_queue_head_init (&sn->queue);
@@ -561,8 +561,7 @@ static int rose_clear_routes(void) s = rose_neigh; rose_neigh = rose_neigh->next; -if (s->use ==0 && !s->loopback) { - s->count =0 ; +if (!s->loopback) {rose_remove_neigh (s);rose_neigh_put (s); }
@@ -680,6 +679,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause,for (i =0 ; i < node->count; i++) {if (node->neighbour[i]->restarted) { res = node->neighbour[i]; +rose_neigh_hold (node->neighbour[i]); goto out; } }
@@ -691,6 +691,7 @@ struct rose_neigh *rose_get_neigh(rose_address *addr, unsigned char *cause,for (i =0 ; i < node->count; i++) {if (!rose_ftimer_running (node->neighbour[i])) { res = node->neighbour[i]; +rose_neigh_hold (node->neighbour[i]); goto out; } failed =1 ;
@@ -780,13 +781,13 @@ static void rose_del_route_by_neigh(struct rose_neigh *rose_neigh) }if (rose_route->neigh1 == rose_neigh) { - rose_route->neigh1->use--; +rose_neigh_put (rose_route->neigh1); rose_route->neigh1 =NULL ;rose_transmit_clear_request (rose_route->neigh2, rose_route->lci2,ROSE_OUT_OF_ORDER ,0 ); }if (rose_route->neigh2 == rose_neigh) { - rose_route->neigh2->use--; +rose_neigh_put (rose_route->neigh2); rose_route->neigh2 =NULL ;rose_transmit_clear_request (rose_route->neigh1, rose_route->lci1,ROSE_OUT_OF_ORDER ,0 ); }
@@ -915,7 +916,7 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)rose_clear_queues (sk); rose->cause =ROSE_NETWORK_CONGESTION ; rose->diagnostic =0 ; - rose->neighbour->use--; +rose_neigh_put (rose->neighbour); rose->neighbour =NULL ; rose->lci =0 ; rose->state =ROSE_STATE_0 ;
@@ -1040,12 +1041,12 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)if ((new_lci =rose_new_lci (new_neigh)) ==0 ) {rose_transmit_clear_request (rose_neigh, lci,ROSE_NETWORK_CONGESTION ,71 ); - goto out; + goto put_neigh; }if ((rose_route =kmalloc (sizeof (*rose_route),GFP_ATOMIC )) ==NULL ) {rose_transmit_clear_request (rose_neigh, lci,ROSE_NETWORK_CONGESTION ,120 ); - goto out; + goto put_neigh; } rose_route->lci1 = lci;
@@ -1058,8 +1059,8 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25) rose_route->lci2 = new_lci; rose_route->neigh2 = new_neigh; - rose_route->neigh1->use++; - rose_route->neigh2->use++; +rose_neigh_hold (rose_route->neigh1); +rose_neigh_hold (rose_route->neigh2); rose_route->next = rose_route_list; rose_route_list = rose_route;
@@ -1071,6 +1072,8 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)rose_transmit_link (skb, rose_route->neigh2); res =1 ; +put_neigh: +rose_neigh_put (new_neigh); out:spin_unlock_bh (&rose_route_list_lock);spin_unlock_bh (&rose_neigh_list_lock);
@@ -1186,7 +1189,7 @@ static int rose_neigh_show(struct seq_file *seq, void *v) (rose_neigh->loopback) ?"RSLOOP-0" :ax2asc (buf, &rose_neigh->callsign), rose_neigh->dev ? rose_neigh->dev->name :"???" , rose_neigh->count, - rose_neigh->use, +refcount_read (&rose_neigh->use) -1 , (rose_neigh->dce_mode) ?"DCE" :"DTE" , (rose_neigh->restarted) ?"yes" :"no" , ax25_display_timer(&rose_neigh->t0timer) / HZ,
net/rose/rose_timer.c +1 -1
@@ -180,7 +180,7 @@ static void rose_timer_expiry(struct timer_list *t)break ;case ROSE_STATE_2 :/* T3 */ - rose->neighbour->use--; +rose_neigh_put (rose->neighbour);rose_disconnect (sk,ETIMEDOUT ,-1 ,-1 );break ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 104/142 KVM: x86: use array_index_nospec with indices that come from guest
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thijs Raymakers <[email protected]>
commit c87bd4dd43a624109c3cc42d843138378a7f4548 upstream.
min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.
--- arch/x86/kvm/lapic.c | 2 ++ arch/x86/kvm/x86.c | 7 +++++-- 2 files changed, 7 insertions(+), 2 deletions(-)
arch/x86/kvm/lapic.c +2 -0
@@ -852,6 +852,8 @@ static int __pv_send_ipi(unsigned long *if (min > map->max_apic_id)return 0 ; + min =array_index_nospec (min, map->max_apic_id +1 ); +for_each_set_bit (i, ipi_bitmap,min ((u32 )BITS_PER_LONG , (map->max_apic_id - min +1 ))) {if (map->phys_map[min + i]) {
arch/x86/kvm/x86.c +5 -2
@@ -10051,8 +10051,11 @@ static void kvm_sched_yield(struct kvm_vrcu_read_lock (); map =rcu_dereference (vcpu->kvm->arch.apic_map); -if (likely (map) && dest_id <= map->max_apic_id && map->phys_map[dest_id]) - target = map->phys_map[dest_id]->vcpu; +if (likely (map) && dest_id <= map->max_apic_id) { + dest_id =array_index_nospec (dest_id, map->max_apic_id +1 ); +if (map->phys_map[dest_id]) + target = map->phys_map[dest_id]->vcpu; + }rcu_read_unlock ();
Greg Kroah-Hartman
maintainerPATCH 105/142 RISC-V: KVM: fix stack overrun when loading vlenb
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radim Krčmář <[email protected]>
commit 799766208f09f95677a9ab111b93872d414fbad7 upstream.
The userspace load can put up to 2048 bits into an xlen bit stack buffer. We want only xlen bits, so check the size beforehand.
--- arch/riscv/kvm/vcpu_vector.c | 2 ++ 1 file changed, 2 insertions(+)
arch/riscv/kvm/vcpu_vector.c +2 -0
@@ -182,6 +182,8 @@ int kvm_riscv_vcpu_set_reg_vector(structstruct kvm_cpu_context *cntx = &vcpu->arch.guest_context;unsigned long reg_val; +if (reg_size !=sizeof (reg_val)) +return -EINVAL ;if (copy_from_user (®_val, uaddr, reg_size))return -EFAULT ;if (reg_val != cntx->vector.vlenb)
Greg Kroah-Hartman
maintainerPATCH 106/142 x86/cpu/intel: Fix the constant_tsc model check for Pentium 4
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suchit Karunakaran <[email protected]>
commit 24963ae1b0b6596dc36e352c18593800056251d8 upstream.
Pentium 4's which are INTEL_P4_PRESCOTT (model 0x03) and later have a constant TSC. This was correctly captured until commit fadb6f569b10 ("x86/cpu/intel: Limit the non-architectural constant_tsc model checks").
In that commit, an error was introduced while selecting the last P4 model (0x06) as the upper bound. Model 0x06 was transposed to INTEL_P4_WILLAMETTE, which is just plain wrong. That was presumably a simple typo, probably just copying and pasting the wrong P4 model.
Fix the constant TSC logic to cover all later P4 models. End at INTEL_P4_CEDARMILL which accurately corresponds to the last P4 model.
--- arch/x86/kernel/cpu/intel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/intel.c +1 -1
@@ -262,7 +262,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)if (c->x86_power & (1 <<8 )) {set_cpu_cap (c,X86_FEATURE_CONSTANT_TSC );set_cpu_cap (c,X86_FEATURE_NONSTOP_TSC ); - }else if ((c->x86_vfm >=INTEL_P4_PRESCOTT && c->x86_vfm <=INTEL_P4_WILLAMETTE ) || + }else if ((c->x86_vfm >=INTEL_P4_PRESCOTT && c->x86_vfm <=INTEL_P4_CEDARMILL ) || (c->x86_vfm >=INTEL_CORE_YONAH && c->x86_vfm <=INTEL_IVYBRIDGE )) {set_cpu_cap (c,X86_FEATURE_CONSTANT_TSC ); }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 107/142 x86/microcode/AMD: Handle the case of no BIOS microcode
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <[email protected]>
commit fcf8239ad6a5de54fa7ce18e464c6b5951b982cb upstream.
Machines can be shipped without any microcode in the BIOS. Which means, the microcode patch revision is 0.
Handle that gracefully.
--- arch/x86/kernel/cpu/microcode/amd.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/microcode/amd.c +20 -2
@@ -171,8 +171,28 @@ static int cmp_id(const void *key, constreturn 1 ; } +static u32 cpuid_to_ucode_rev (unsigned int val) +{ +union zen_patch_rev p = {}; +union cpuid_1_eax c; + + c.full = val; + + p.stepping = c.stepping; + p.model = c.model; + p.ext_model = c.ext_model; + p.ext_fam = c.ext_fam; + +return p.ucode_rev; +} +static bool need_sha_check (u32 cur_rev) { +if (!cur_rev) { + cur_rev =cpuid_to_ucode_rev (bsp_cpuid_1_eax); +pr_info_once ("No current revision, generating the lowest one: 0x%x\n" , cur_rev); + } +switch (cur_rev >>8 ) {case 0x80012 :return cur_rev <=0x800126f ;break ;case 0x80082 :return cur_rev <=0x800820f ;break ;
@@ -749,8 +769,6 @@ static struct ucode_patch *cache_find_pa n.equiv_cpu = equiv_cpu; n.patch_id = uci->cpu_sig.rev; -WARN_ON_ONCE (!n.patch_id); -list_for_each_entry (p, µcode_cache, plist)if (patch_cpus_equivalent (p, &n, false))return p;
Greg Kroah-Hartman
maintainerPATCH 108/142 x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: K Prateek Nayak <[email protected]>
commit c2415c407a2cde01290d52ce2a1f81b0616379a3 upstream.
Prior to the topology parsing rewrite and the switchover to the new parsing logic for AMD processors in
c749ce393b8f ("x86/cpu: Use common topology code for AMD"),
the initial_apicid on these platforms was:
- First initialized to the LocalApicId from CPUID leaf 0x1 EBX[31:24].
- Then overwritten by the ExtendedLocalApicId in CPUID leaf 0xb EDX[31:0] on processors that supported topoext.
With the new parsing flow introduced in
f7fb3b2dd92c ("x86/cpu: Provide an AMD/HYGON specific topology parser"),
parse_8000_001e() now unconditionally overwrites the initial_apicid already parsed during cpu_parse_topology_ext().
Although this has not been a problem on baremetal platforms, on virtualized AMD guests that feature more than 255 cores, QEMU zeros out the CPUID leaf 0x8000001e on CPUs with CoreID > 255 to prevent collision of these IDs in EBX[7:0] which can only represent a maximum of 255 cores [1].
This results in the following FW_BUG being logged when booting a guest with more than 255 cores:
[Firmware Bug]: CPU 512: APIC ID mismatch. CPUID: 0x0000 APIC: 0x0200
AMD64 Architecture Programmer's Manual Volume 2: System Programming Pub. 24593 Rev. 3.42 [2] Section 16.12 "x2APIC_ID" mentions the Extended Enumeration leaf 0xb (Fn0000_000B_EDX[31:0])(which was later superseded by the extended leaf 0x80000026) provides the full x2APIC ID under all circumstances unlike the one reported by CPUID leaf 0x8000001e EAX which depends on the mode in which APIC is configured.
Rely on the APIC ID parsed during cpu_parse_topology_ext() from CPUID leaf 0x80000026 or 0xb and only use the APIC ID from leaf 0x8000001e if cpu_parse_topology_ext() failed (has_topoext is false).
On platforms that support the 0xb leaf (Zen2 or later, AMD guests on QEMU) or the extended leaf 0x80000026 (Zen4 or later), the initial_apicid is now set to the value parsed from EDX[31:0].
On older AMD/Hygon platforms that do not support the 0xb leaf but support the TOPOEXT extension (families 0x15, 0x16, 0x17[Zen1], and Hygon), retain current behavior where the initial_apicid is set using the 0x8000001e leaf.
Issue debugged by Naveen N Rao (AMD) <[email protected]> and Sairaj Kodilkar <[email protected]>.
[ bp: Massage commit message. ]
--- arch/x86/kernel/cpu/topology_amd.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
arch/x86/kernel/cpu/topology_amd.c +14 -9
@@ -81,20 +81,25 @@ static bool parse_8000_001e(struct topo_cpuid_leaf (0x8000001e , &leaf); - tscan->c->topo.initial_apicid = leaf.ext_apic_id; -/* -* If leaf 0xb is available, then the domain shifts are set -* already and nothing to do here. Only valid for family >= 0x17. +* If leaf 0xb/0x26 is available, then the APIC ID and the domain +* shifts are set already. */ -if (!has_topoext && tscan->c->x86 >=0x17 ) { +if (!has_topoext) { + tscan->c->topo.initial_apicid = leaf.ext_apic_id; +/* -* Leaf 0x80000008 set the CORE domain shift already. -* Update the SMT domain, but do not propagate it. +* Leaf 0x8000008 sets the CORE domain shift but not the +* SMT domain shift. On CPUs with family >= 0x17, there +* might be hyperthreads. */ -unsigned int nthreads = leaf.core_nthreads +1 ; +if (tscan->c->x86 >=0x17 ) { +/* Update the SMT domain, but do not propagate it. */ +unsigned int nthreads = leaf.core_nthreads +1 ; -topology_update_dom (tscan,TOPO_SMT_DOMAIN ,get_count_order (nthreads), nthreads); +topology_update_dom (tscan,TOPO_SMT_DOMAIN , +get_count_order (nthreads), nthreads); + } }store_node (tscan, leaf.nnodes_per_socket +1 , leaf.node_id);
Greg Kroah-Hartman
maintainerPATCH 109/142 HID: asus: fix UAF via HID_CLAIMED_INPUT validation
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4 upstream.
After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device.
This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees.
0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection
Below is the KASAN splat after triggering the UAF:
[ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfree+0xcf/0x350 [ 21.673700] input_dev_release+0xab/0xd0 [ 21.673700] device_release+0x9f/0x220 [ 21.673700] kobject_put+0x12b/0x220 [ 21.673700] put_device+0x12/0x20 [ 21.673700] input_free_device+0x4c/0xb0 [ 21.673700] hidinput_connect+0x1862/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220
[...]
--- drivers/hid/hid-asus.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +7 -1
@@ -1213,7 +1213,13 @@ static int asus_probe(struct hid_devicereturn ret; } -if (!drvdata->input) { +/* +* Check that input registration succeeded. Checking that +* HID_CLAIMED_INPUT is set prevents a UAF when all input devices +* were freed during registration due to no usages being mapped, +* leaving drvdata->input pointing to freed memory. +*/ +if (!drvdata->input || !(hdev->claimed &HID_CLAIMED_INPUT )) {hid_err (hdev,"Asus input not registered\n" ); ret = -ENOMEM ; goto err_stop_hw;
Greg Kroah-Hartman
maintainerPATCH 110/142 HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit 0379eb8691b9c4477da0277ae0832036ca4410b4 upstream.
A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it.
Below is the KASAN splat after the out of bounds access happens:
[ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] <TASK> [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40
[...]
--- drivers/hid/hid-multitouch.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/hid/hid-multitouch.c +8 -0
@@ -1461,6 +1461,14 @@ static const __u8 *mt_report_fixup(strucif (hdev->vendor ==I2C_VENDOR_ID_GOODIX && (hdev->product ==I2C_DEVICE_ID_GOODIX_01E8 || hdev->product ==I2C_DEVICE_ID_GOODIX_01E9 )) { +if (*size <608 ) { +dev_info ( + &hdev->dev, +"GT7868Q fixup: report descriptor is only %u bytes, skipping\n" , + *size); +return rdesc; + } +if (rdesc[607 ] ==0x15 ) { rdesc[607 ] =0x25 ; dev_info(
Greg Kroah-Hartman
maintainerPATCH 111/142 HID: elecom: add support for ELECOM M-DT2DRBK
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Hilgendorf <[email protected]>
commit 832e5777143e799a97e8f9b96f002a90f06ba548 upstream.
The DT2DRBK trackball has 8 buttons, but the report descriptor only specifies 5. This patch adds the device ID and performs a similar fixup as for other ELECOM devices to enable the remaining 3 buttons.
--- drivers/hid/hid-elecom.c | 2 ++ drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 3 files changed, 4 insertions(+)
drivers/hid/hid-elecom.c +2 -0
@@ -101,6 +101,7 @@ static const __u8 *elecom_report_fixup(s*/ mouse_button_fixup (hdev, rdesc, *rsize,12 ,30 ,14 ,20 ,8 );break ; +case USB_DEVICE_ID_ELECOM_M_DT2DRBK :case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C :/* * Report descriptor format:
@@ -123,6 +124,7 @@ static const struct hid_device_id elecom { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT2DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_010C) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
drivers/hid/hid-ids.h +1 -0
@@ -448,6 +448,7 @@#define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd#define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe#define USB_DEVICE_ID_ELECOM_M_DT1DRBK 0x00ff +#define USB_DEVICE_ID_ELECOM_M_DT2DRBK 0x018d#define USB_DEVICE_ID_ELECOM_M_HT1URBK_010C 0x010c#define USB_DEVICE_ID_ELECOM_M_HT1URBK_019B 0x019b#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
drivers/hid/hid-quirks.c +1 -0
@@ -410,6 +410,7 @@ static const struct hid_device_id hid_ha { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT2DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_010C) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
Greg Kroah-Hartman
maintainerPATCH 112/142 HID: quirks: add support for Legion Go dual dinput modes
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
commit 1f3214aae9f49faf495f3836216afbc6c5400b2e upstream.
The Legion Go features detachable controllers which support a dual dinput mode. In this mode, the controllers appear under a single HID device with two applications.
Currently, both controllers appear under the same event device, causing their controls to be mixed up. This patch separates the two so that they can be used independently.
In addition, the latest firmware update for the Legion Go swaps the IDs to the ones used by the Legion Go 2, so add those IDs as well.
--- drivers/hid/hid-ids.h | 2 ++ drivers/hid/hid-quirks.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/hid/hid-ids.h +2 -0
@@ -832,6 +832,8 @@#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E 0x602e#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093 0x6093 +#define USB_DEVICE_ID_LENOVO_LEGION_GO_DUAL_DINPUT 0x6184 +#define USB_DEVICE_ID_LENOVO_LEGION_GO2_DUAL_DINPUT 0x61ed#define USB_VENDOR_ID_LETSKETCH 0x6161#define USB_DEVICE_ID_WP9620N 0x4d15
drivers/hid/hid-quirks.c +2 -0
@@ -124,6 +124,8 @@ static const struct hid_device_id hid_qu { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_V2), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_T609A), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_ODDOR_HANDBRAKE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_LEGION_GO_DUAL_DINPUT), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_LEGION_GO2_DUAL_DINPUT), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019), HID_QUIRK_ALWAYS_POLL },
Greg Kroah-Hartman
maintainerPATCH 113/142 HID: logitech: Add ids for G PRO 2 LIGHTSPEED
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Coffin <[email protected]>
commit ab1bb82f3db20e23eace06db52031b1164a110c2 upstream.
Adds support for the G PRO 2 LIGHTSPEED Wireless via it's nano receiver or directly. This nano receiver appears to work identically to the 1_1 receiver for the case I've verified, which is the battery status through lg-hidpp.
The same appears to be the case wired, sharing much with the Pro X Superlight 2; differences seemed to lie in userland configuration rather than in interfaces used by hid_logitech_hidpp on the kernel side.
I verified the sysfs interface for battery charge/discharge status, and capacity read to be working on my 910-007290 device (white).
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-logitech-dj.c | 4 ++++ drivers/hid/hid-logitech-hidpp.c | 2 ++ 3 files changed, 7 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -907,6 +907,7 @@#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_2 0xc534#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1 0xc539#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1 0xc53f +#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_2 0xc543#define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY 0xc53a#define USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER 0xc548#define USB_DEVICE_ID_SPACETRAVELLER 0xc623
drivers/hid/hid-logitech-dj.c +4 -0
@@ -1983,6 +1983,10 @@ static const struct hid_device_id logi_d HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1), .driver_data = recvr_type_gaming_hidpp}, + {/* Logitech lightspeed receiver (0xc543) */ +HID_USB_DEVICE (USB_VENDOR_ID_LOGITECH , + USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_2), + .driver_data = recvr_type_gaming_hidpp}, { /* Logitech 27 MHz HID++ 1.0 receiver (0xc513) */ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER),
drivers/hid/hid-logitech-hidpp.c +2 -0
@@ -4596,6 +4596,8 @@ static const struct hid_device_id hidpp_ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC094) }, {/* Logitech G Pro X Superlight 2 Gaming Mouse over USB */ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC09b) }, + { /* Logitech G PRO 2 LIGHTSPEED Wireless Mouse over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xc09a) }, { /* G935 Gaming Headset */ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0x0a87),
Greg Kroah-Hartman
maintainerPATCH 96/142 net: rose: include node references in rose_neigh refcount
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit da9c9c877597170b929a6121a68dcd3dd9a80f45 ]
Current implementation maintains two separate reference counting
mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock.
This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented.
This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node().
These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.
--- net/rose/rose_route.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
net/rose/rose_route.c +16 -2
@@ -178,6 +178,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, } } rose_neigh->count++; +rose_neigh_hold (rose_neigh); goto out; }
@@ -187,6 +188,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, rose_node->neighbour[rose_node->count] = rose_neigh; rose_node->count++; rose_neigh->count++; +rose_neigh_hold (rose_neigh); } out:
@@ -322,6 +324,7 @@ static int rose_del_node(struct rose_route_struct *rose_route,for (i =0 ; i < rose_node->count; i++) {if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; +rose_neigh_put (rose_neigh);if (rose_neigh->count ==0 ) {rose_remove_neigh (rose_neigh);
@@ -430,6 +433,7 @@ int rose_add_loopback_node(const rose_address *address) rose_node_list = rose_node; rose_loopback_neigh->count++; +rose_neigh_hold (rose_loopback_neigh); out:spin_unlock_bh (&rose_node_list_lock);
@@ -461,6 +465,7 @@ void rose_del_loopback_node(const rose_address *address)rose_remove_node (rose_node); rose_loopback_neigh->count--; +rose_neigh_put (rose_loopback_neigh); out:spin_unlock_bh (&rose_node_list_lock);
@@ -500,6 +505,7 @@ void rose_rt_device_down(struct net_device *dev)memmove (&t->neighbour[i], &t->neighbour[i +1 ],sizeof (t->neighbour[0 ]) * (t->count - i)); +rose_neigh_put (s); }if (t->count <=0 )
@@ -543,6 +549,7 @@ static int rose_clear_routes(void) {struct rose_neigh *s, *rose_neigh;struct rose_node *t, *rose_node; +int i;spin_lock_bh (&rose_node_list_lock);spin_lock_bh (&rose_neigh_list_lock);
@@ -553,8 +560,12 @@ static int rose_clear_routes(void)while (rose_node !=NULL ) { t = rose_node; rose_node = rose_node->next; -if (!t->loopback) + +if (!t->loopback) { +for (i =0 ; i < rose_node->count; i++) +rose_neigh_put (t->neighbour[i]);rose_remove_node (t); + } }while (rose_neigh !=NULL ) {
@@ -1189,7 +1200,7 @@ static int rose_neigh_show(struct seq_file *seq, void *v) (rose_neigh->loopback) ?"RSLOOP-0" :ax2asc (buf, &rose_neigh->callsign), rose_neigh->dev ? rose_neigh->dev->name :"???" , rose_neigh->count, -refcount_read (&rose_neigh->use) -1 , +refcount_read (&rose_neigh->use) - rose_neigh->count -1 , (rose_neigh->dce_mode) ?"DCE" :"DTE" , (rose_neigh->restarted) ?"yes" :"no" , ax25_display_timer(&rose_neigh->t0timer) / HZ,
@@ -1294,6 +1305,7 @@ void __exit rose_rt_free(void)struct rose_neigh *s, *rose_neigh = rose_neigh_list;struct rose_node *t, *rose_node = rose_node_list;struct rose_route *u, *rose_route = rose_route_list; +int i;while (rose_neigh !=NULL ) { s = rose_neigh;
@@ -1307,6 +1319,8 @@ void __exit rose_rt_free(void) t = rose_node; rose_node = rose_node->next; +for (i =0 ; i < t->count; i++) +rose_neigh_put (t->neighbour[i]);rose_remove_node (t); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 114/142 HID: wacom: Add a new Art Pen 2
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping Cheng <[email protected]>
commit 9fc51941d9e7793da969b2c66e6f8213c5b1237f upstream.
--- drivers/hid/wacom_wac.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/wacom_wac.c +1 -0
@@ -684,6 +684,7 @@ static bool wacom_is_art_pen(int tool_idcase 0x885 :/* Intuos3 Marker Pen */ case 0x804 :/* Intuos4/5 13HD/24HD Marker Pen */ case 0x10804 :/* Intuos4/5 13HD/24HD Art Pen */ +case 0x204 :/* Art Pen 2 */ is_art_pen = true;break ; }
Greg Kroah-Hartman
maintainerPATCH 115/142 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjong Kim <[email protected]>
commit 185c926283da67a72df20a63a5046b3b4631b7d9 upstream.
in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has
invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger
page fault error for address(0xffffffffffffff58)
add null check logic to ntrig_report_version()
before calling hid_to_usb_dev()
--- drivers/hid/hid-ntrig.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/hid-ntrig.c +3 -0
@@ -144,6 +144,9 @@ static void ntrig_report_version(structstruct usb_device *usb_dev =hid_to_usb_dev (hdev);unsigned char *data =kmalloc (8 ,GFP_KERNEL ); +if (!hid_is_usb (hdev)) +return ; +if (!data) goto err_free;
Greg Kroah-Hartman
maintainerPATCH 116/142 Revert "drm/amdgpu: fix incorrect vm flags to map bo"
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit ac4ed2da4c1305a1a002415058aa7deaf49ffe3e upstream.
This reverts commit b08425fa77ad2f305fe57a33dceb456be03b653f.
Revert this to align with 6.17 because the fixes tag was wrong on this commit.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c +2 -2
@@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_ } r =amdgpu_vm_bo_map (adev, *bo_va, csa_addr,0 , size, -AMDGPU_VM_PAGE_READABLE |AMDGPU_VM_PAGE_WRITEABLE | -AMDGPU_VM_PAGE_EXECUTABLE ); +AMDGPU_PTE_READABLE |AMDGPU_PTE_WRITEABLE | +AMDGPU_PTE_EXECUTABLE );if (r) {DRM_ERROR ("failed to do bo_map on static CSA, err=%d\n" , r);
Greg Kroah-Hartman
maintainerPATCH 117/142 arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit ceca927c86e6f72f72d45487a34368bc9509431d upstream.
Seen during KPTI initialization:
CFI failure at create_kpti_ng_temp_pgd+0x124/0xce8 (target: kpti_ng_pgd_alloc+0x0/0x14; expected type: 0xd61b88b6)
The call site is alloc_init_pud() at arch/arm64/mm/mmu.c:
pud_phys = pgtable_alloc(TABLE_PUD);
alloc_init_pud() has the prototype:
static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,
phys_addr_t phys, pgprot_t prot, phys_addr_t (*pgtable_alloc)(enum pgtable_type), int flags)
where the pgtable_alloc() prototype is declared.
The target (kpti_ng_pgd_alloc) is used in arch/arm64/kernel/cpufeature.c:
create_kpti_ng_temp_pgd(kpti_ng_temp_pgd, __pa(alloc), KPTI_NG_TEMP_VA,
PAGE_SIZE, PAGE_KERNEL, kpti_ng_pgd_alloc, 0);
which is an alias for __create_pgd_mapping_locked() with prototype:
extern __alias(__create_pgd_mapping_locked)
void create_kpti_ng_temp_pgd(pgd_t *pgdir, phys_addr_t phys,
unsigned long virt,
phys_addr_t size, pgprot_t prot, phys_addr_t (*pgtable_alloc)(enum pgtable_type), int flags);
__create_pgd_mapping_locked() passes the function pointer down:
__create_pgd_mapping_locked() -> alloc_init_p4d() -> alloc_init_pud()
But the target function (kpti_ng_pgd_alloc) has the wrong signature:
static phys_addr_t __init kpti_ng_pgd_alloc(int shift);
The "int" should be "enum pgtable_type".
To make "enum pgtable_type" available to cpufeature.c, move enum pgtable_type definition from arch/arm64/mm/mmu.c to arch/arm64/include/asm/mmu.h.
Adjust kpti_ng_pgd_alloc to use "enum pgtable_type" instead of "int". The function behavior remains identical (parameter is unused).
--- arch/arm64/include/asm/mmu.h | 7 +++++++ arch/arm64/kernel/cpufeature.c | 5 +++-- arch/arm64/mm/mmu.c | 7 ------- 3 files changed, 10 insertions(+), 9 deletions(-)
arch/arm64/include/asm/mmu.h +7 -0
@@ -17,6 +17,13 @@#include <linux/refcount.h> #include <asm/cpufeature.h> +enum pgtable_type { +TABLE_PTE , +TABLE_PMD , +TABLE_PUD , +TABLE_P4D , +}; + typedef struct { atomic64_t id; #ifdef CONFIG_COMPAT
arch/arm64/kernel/cpufeature.c +3 -2
@@ -84,6 +84,7 @@#include <asm/hwcap.h> #include <asm/insn.h> #include <asm/kvm_host.h> +#include <asm/mmu.h> #include <asm/mmu_context.h> #include <asm/mte.h> #include <asm/hypervisor.h>
@@ -1941,11 +1942,11 @@ static bool has_pmuv3(const struct arm64extern void create_kpti_ng_temp_pgd (pgd_t *pgdir,phys_addr_t phys,unsigned long virt,phys_addr_t size,pgprot_t prot, -phys_addr_t (*pgtable_alloc)(int ),int flags); +phys_addr_t (*pgtable_alloc)(enum pgtable_type ),int flags);static phys_addr_t __initdata kpti_ng_temp_alloc; -static phys_addr_t __init kpti_ng_pgd_alloc (int shift) +static phys_addr_t __init kpti_ng_pgd_alloc (enum pgtable_type type) { kpti_ng_temp_alloc -=PAGE_SIZE ;return kpti_ng_temp_alloc;
arch/arm64/mm/mmu.c +0 -7
@@ -46,13 +46,6 @@#define NO_CONT_MAPPINGS BIT(1)#define NO_EXEC_MAPPINGS BIT(2)/* assumes FEAT_HPDS is not used */ -enum pgtable_type { -TABLE_PTE , -TABLE_PMD , -TABLE_PUD , -TABLE_P4D , -}; -u64 kimage_voffset__ro_after_init ;EXPORT_SYMBOL (kimage_voffset);
Greg Kroah-Hartman
maintainerPATCH 118/142 blk-zoned: Fix a lockdep complaint about recursive locking
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 198f36f902ec7e99b645382505f74b87a4523ed9 upstream.
If preparing a write bio fails then blk_zone_wplug_bio_work() calls bio_endio() with zwplug->lock held. If a device mapper driver is stacked on top of the zoned block device then this results in nested locking of zwplug->lock. The resulting lockdep complaint is a false positive because this is nested locking and not recursive locking. Suppress this false positive by calling blk_zone_wplug_bio_io_error() without holding zwplug->lock. This is safe because no code in blk_zone_wplug_bio_io_error() depends on zwplug->lock being held. This patch suppresses the following lockdep complaint:
WARNING: possible recursive locking detected
--------------------------------------------
kworker/3:0H/46 is trying to acquire lock:ffffff882968b830 (&zwplug->lock){-...}-{2:2}, at: blk_zone_write_plug_bio_endio+0x64/0x1f0
but task is already holding lock:ffffff88315bc230 (&zwplug->lock){-...}-{2:2}, at: blk_zone_wplug_bio_work+0x8c/0x48c
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&zwplug->lock);
lock(&zwplug->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by kworker/3:0H/46:
#0: ffffff8809486758 ((wq_completion)sdd_zwplugs){+.+.}-{0:0}, at: process_one_work+0x1bc/0x65c #1: ffffffc085de3d70 ((work_completion)(&zwplug->bio_work)){+.+.}-{0:0}, at: process_one_work+0x1e4/0x65c #2: ffffff88315bc230 (&zwplug->lock){-...}-{2:2}, at: blk_zone_wplug_bio_work+0x8c/0x48c
stack backtrace: CPU: 3 UID: 0 PID: 46 Comm: kworker/3:0H Tainted: G W OE 6.12.38-android16-5-maybe-dirty-4k #1 8b362b6f76e3645a58cd27d86982bce10d150025 Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Spacecraft board based on MALIBU (DT) Workqueue: sdd_zwplugs blk_zone_wplug_bio_work Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0xa0 dump_stack+0x18/0x24 print_deadlock_bug+0x38c/0x398 __lock_acquire+0x13e8/0x2e1c lock_acquire+0x134/0x2b4 _raw_spin_lock_irqsave+0x5c/0x80 blk_zone_write_plug_bio_endio+0x64/0x1f0 bio_endio+0x9c/0x240 __dm_io_complete+0x214/0x260 clone_endio+0xe8/0x214 bio_endio+0x218/0x240 blk_zone_wplug_bio_work+0x204/0x48c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20
--- block/blk-zoned.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
block/blk-zoned.c +6 -5
@@ -1266,14 +1266,14 @@ static void blk_zone_wplug_bio_work(strustruct block_device *bdev;unsigned long flags;struct bio *bio; +bool prepared;/* * Submit the next plugged BIO. If we do not have any, clear * the plugged flag. */ -spin_lock_irqsave (&zwplug->lock, flags); - again: +spin_lock_irqsave (&zwplug->lock, flags); bio =bio_list_pop (&zwplug->bio_list);if (!bio) { zwplug->flags &= ~BLK_ZONE_WPLUG_PLUGGED ;
@@ -1281,13 +1281,14 @@ again: goto put_zwplug; } -if (!blk_zone_wplug_prepare_bio (zwplug, bio)) { + prepared =blk_zone_wplug_prepare_bio (zwplug, bio); +spin_unlock_irqrestore (&zwplug->lock, flags); + +if (!prepared) {blk_zone_wplug_bio_io_error (zwplug, bio); goto again; } -spin_unlock_irqrestore (&zwplug->lock, flags); - bdev = bio->bi_bdev;/*
Greg Kroah-Hartman
maintainerPATCH 119/142 dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shanker Donthineni <[email protected]>
commit 89a2d212bdb4bc29bed8e7077abe054b801137ea upstream.
When CONFIG_DMA_DIRECT_REMAP is enabled, atomic pool pages are remapped via dma_common_contiguous_remap() using the supplied pgprot. Currently, the mapping uses pgprot_dmacoherent(PAGE_KERNEL), which leaves the memory encrypted on systems with memory encryption enabled (e.g., ARM CCA Realms).
This can cause the DMA layer to fail or crash when accessing the memory, as the underlying physical pages are not configured as expected.
Fix this by requesting a decrypted mapping in the vmap() call:
pgprot_decrypted(pgprot_dmacoherent(PAGE_KERNEL))
This ensures that atomic pool memory is consistently mapped unencrypted.
--- kernel/dma/pool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/dma/pool.c +2 -2
@@ -102,8 +102,8 @@ static int atomic_pool_expand(struct gen#ifdef CONFIG_DMA_DIRECT_REMAP addr =dma_common_contiguous_remap (page, pool_size, -pgprot_dmacoherent (PAGE_KERNEL ), -__builtin_return_address (0 )); +pgprot_decrypted (pgprot_dmacoherent (PAGE_KERNEL )), +__builtin_return_address (0 ));if (!addr) goto free_page;#else
Greg Kroah-Hartman
maintainerPATCH 120/142 fs/smb: Fix inconsistent refcnt update
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <[email protected]>
commit ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e upstream.
A possible inconsistent update of refcount was identified in smb2_compound_op. Such inconsistent update could lead to possible resource leaks.
Why it is a possible bug:
1. In the comment section of the function, it clearly states that the reference to cfile should be dropped after calling this function.
2. Every control flow path would check and drop the reference to cfile, except the patched one.
3. Existing callers would not handle refcount update of cfile if -ENOMEM is returned.
To fix the bug, an extra goto label "out" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of vars, the cleanup logic between label "finished" and "out" can be safely ignored. According to the definition of function is_replayable_error, the error code of "-ENOMEM" is not recoverable. Therefore, the replay logic also gets ignored.
--- fs/smb/client/smb2inode.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/smb/client/smb2inode.c +5 -2
@@ -207,8 +207,10 @@ replay_again: server =cifs_pick_channel (ses); vars =kzalloc (sizeof (*vars),GFP_ATOMIC ); -if (vars ==NULL ) -return -ENOMEM ; +if (vars ==NULL ) { + rc = -ENOMEM ; + goto out; + } rqst = &vars->rqst[0 ]; rsp_iov = &vars->rsp_iov[0 ];
@@ -864,6 +866,7 @@ finished: smb2_should_replay(tcon, &retries, &cur_sleep)) goto replay_again; +out:if (cfile)cifsFileInfo_put (cfile);
Greg Kroah-Hartman
maintainerPATCH 121/142 net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit e81a7f65288c7e2cfb7e7890f648e099fd885ab3 upstream.
Add the following Telit Cinterion LE910C4-WWX new compositions:
0x1034: tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1034 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x1037: tty (diag) + tty (Telit custom) + tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 15 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1037 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x1038: tty (Telit custom) + tty (AT) + tty (AT) + rmnet
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1038 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/qmi_wwan.c +3 -0
@@ -1355,6 +1355,9 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1034, 2)}, /* Telit LE910C4-WWX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1037, 4)}, /* Telit LE910C4-WWX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1038, 3)}, /* Telit LE910C4-WWX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
Greg Kroah-Hartman
maintainerPATCH 122/142 smb3 client: fix return code mapping of remap_file_range
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <[email protected]>
commit 0e08fa789d39aa01923e3ba144bd808291895c3c upstream.
We were returning -EOPNOTSUPP for various remap_file_range cases but for some of these the copy_file_range_syscall() requires -EINVAL to be returned (e.g. where source and target file ranges overlap when source and target are the same file). This fixes xfstest generic/157 which was expecting EINVAL for that (and also e.g. for when the src offset is beyond end of file).
--- fs/smb/client/cifsfs.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/smb/client/cifsfs.c +14 -0
@@ -1358,6 +1358,20 @@ static loff_t cifs_remap_file_range(strutruncate_setsize (target_inode, new_size);fscache_resize_cookie (cifs_inode_cookie (target_inode), new_size); + }else if (rc == -EOPNOTSUPP ) { +/* +* copy_file_range syscall man page indicates EINVAL +* is returned e.g when "fd_in and fd_out refer to the +* same file and the source and target ranges overlap." +* Test generic/157 was what showed these cases where +* we need to remap EOPNOTSUPP to EINVAL +*/ +if (off >= src_inode->i_size) { + rc = -EINVAL ; + }else if (src_inode == target_inode) { +if (off + len > destoff) + rc = -EINVAL ; + } }if (rc ==0 && new_size > target_cifsi->netfs.zero_point) target_cifsi->netfs.zero_point = new_size;
Greg Kroah-Hartman
maintainerPATCH 123/142 xfs: do not propagate ENODATA disk errors into xattr code
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
commit ae668cd567a6a7622bc813ee0bb61c42bed61ba7 upstream.
ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found.
However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as "attribute not found" when in fact it's an IO (disk) error.
At worst, we may oops in xfs_attr_leaf_get() when we do:
error = xfs_attr_leaf_hasname(args, &bp);
if (error == -ENOATTR) {
xfs_trans_brelse(args->trans, bp);
return error;
}because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it.
As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO.
However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later.
(Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)
--- fs/xfs/libxfs/xfs_attr_remote.c | 7 +++++++ fs/xfs/libxfs/xfs_da_btree.c | 6 ++++++ 2 files changed, 13 insertions(+)
fs/xfs/libxfs/xfs_attr_remote.c +7 -0
@@ -435,6 +435,13 @@ xfs_attr_rmtval_get( 0, &bp, &xfs_attr3_rmt_buf_ops);if (xfs_metadata_is_sick (error))xfs_dirattr_mark_sick (args->dp,XFS_ATTR_FORK ); +/* +* ENODATA from disk implies a disk medium failure; +* ENODATA for xattrs means attribute not found, so +* disambiguate that here. +*/ +if (error == -ENODATA ) + error = -EIO ;if (error)return error;
fs/xfs/libxfs/xfs_da_btree.c +6 -0
@@ -2833,6 +2833,12 @@ xfs_da_read_buf( &bp, ops);if (xfs_metadata_is_sick (error))xfs_dirattr_mark_sick (dp, whichfork); +/* +* ENODATA from disk implies a disk medium failure; ENODATA for +* xattrs means attribute not found, so disambiguate that here. +*/ +if (error == -ENODATA && whichfork ==XFS_ATTR_FORK ) + error = -EIO ;if (error) goto out_free;
Greg Kroah-Hartman
maintainerPATCH 97/142 sctp: initialize more fields in sctp_v6_from_sk()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2e8750469242cad8f01f320131fd5a6f540dbb99 ]
syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior.
Clear sin6_scope_id and sin6_flowinfo.
BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable addr.i.i created at:
sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930
--- net/sctp/ipv6.c | 2 ++ 1 file changed, 2 insertions(+)
net/sctp/ipv6.c +2 -0
@@ -546,7 +546,9 @@ static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk) { addr->v6.sin6_family =AF_INET6 ; addr->v6.sin6_port =0 ; + addr->v6.sin6_flowinfo =0 ; addr->v6.sin6_addr = sk->sk_v6_rcv_saddr; + addr->v6.sin6_scope_id =0 ; }/* Initialize sk->sk_rcv_saddr from sctp_addr. */
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 124/142 drm/xe/vm: Clear the scratch_pt pointer on error
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <[email protected]>
commit 2b55ddf36229e0278c956215784ab1feeff510aa upstream.
Avoid triggering a dereference of an error pointer on cleanup in xe_vm_free_scratch() by clearing any scratch_pt error pointer.
--- drivers/gpu/drm/xe/xe_vm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/xe/xe_vm.c +6 -2
@@ -1582,8 +1582,12 @@ static int xe_vm_create_scratch(struct xfor (i =MAX_HUGEPTE_LEVEL ; i < vm->pt_root[id]->level; i++) { vm->scratch_pt[id][i] =xe_pt_create (vm, tile, i); -if (IS_ERR (vm->scratch_pt[id][i])) -return PTR_ERR (vm->scratch_pt[id][i]); +if (IS_ERR (vm->scratch_pt[id][i])) { +int err =PTR_ERR (vm->scratch_pt[id][i]); + + vm->scratch_pt[id][i] =NULL ; +return err; + }xe_pt_populate_empty (tile, vm, vm->scratch_pt[id][i]); }
Greg Kroah-Hartman
maintainerPATCH 125/142 drm/nouveau/disp: Always accept linear modifier
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Jones <[email protected]>
commit e2fe0c54fb7401e6ecd3c10348519ab9e23bd639 upstream.
On some chipsets, which block-linear modifiers are supported is format-specific. However, linear modifiers are always be supported. The prior modifier filtering logic was not accounting for the linear case.
--- drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/nouveau/dispnv50/wndw.c +4 -0
@@ -795,6 +795,10 @@ static bool nv50_plane_format_mod_supporstruct nouveau_drm *drm =nouveau_drm (plane->dev);uint8_t i; +/* All chipsets can display all formats in linear layout */ +if (modifier ==DRM_FORMAT_MOD_LINEAR ) +return true; +if (drm->client.device.info.chipset <0xc0 ) {const struct drm_format_info *info =drm_format_info (format);const uint8_t kind = (modifier >>12 ) &0xff ;
Greg Kroah-Hartman
maintainerPATCH 126/142 drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <[email protected]>
commit 66e82b6e0a28d4970383e1ee5d60f431001128cd upstream.
Function nvkm_gsp_fwsec_v2() sets 'ret' if the kmemdup() call fails, but it never uses or returns 'ret' after that point. We always need to release the firmware regardless, so do that and then check for error.
--- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/fwsec.c +3 -2
@@ -209,11 +209,12 @@ nvkm_gsp_fwsec_v2(struct nvkm_gsp *gsp, fw->boot_addr = bld->start_tag <<8 ; fw->boot_size = bld->code_size; fw->boot =kmemdup (bl->data + hdr->data_offset + bld->code_off, fw->boot_size,GFP_KERNEL ); -if (!fw->boot) - ret = -ENOMEM ;nvkm_firmware_put (bl); +if (!fw->boot) +return -ENOMEM ; +/* Patch in interface data. */ return nvkm_gsp_fwsec_patch (gsp, fw, desc->InterfaceOffset, init_cmd); }
Greg Kroah-Hartman
maintainerPATCH 127/142 drm/msm/dpu: Initialize crtc_state to NULL in dpu_plane_virtual_atomic_check()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit daab47925c06a04792ca720d8438abd37775e357 upstream.
After a recent change in clang to expose uninitialized warnings from const variables and pointers [1], there is a warning around crtc_state in dpu_plane_virtual_atomic_check():
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1145:6: error: variable 'crtc_state' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized]
1145 | if (plane_state->crtc)
| ^~~~~~~~~~~~~~~~~
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1149:58: note: uninitialized use occurs here
1149 | ret = dpu_plane_atomic_check_nosspp(plane, plane_state, crtc_state);
| ^~~~~~~~~~
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1145:2: note: remove the 'if' if its condition is always true
1145 | if (plane_state->crtc)
| ^~~~~~~~~~~~~~~~~~~~~~
1146 | crtc_state = drm_atomic_get_new_crtc_state(state,
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1139:35: note: initialize the variable 'crtc_state' to silence this warning
1139 | struct drm_crtc_state *crtc_state;
| ^
| = NULLInitialize crtc_state to NULL like other places in the driver do, so that it is consistently initialized.
--- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +1 -1
@@ -1136,7 +1136,7 @@ static int dpu_plane_virtual_atomic_checstruct drm_plane_state *old_plane_state =drm_atomic_get_old_plane_state (state, plane);struct dpu_plane_state *pstate =to_dpu_plane_state (plane_state); -struct drm_crtc_state *crtc_state; +struct drm_crtc_state *crtc_state =NULL ;int ret;if (IS_ERR (plane_state))
Greg Kroah-Hartman
maintainerPATCH 128/142 drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 1f403699c40f0806a707a9a6eed3b8904224021a upstream.
Using device_find_child() and of_find_device_by_node() to locate devices could cause an imbalance in the device's reference count. device_find_child() and of_find_device_by_node() both call get_device() to increment the reference count of the found device before returning the pointer. In mtk_drm_get_all_drm_priv(), these references are never released through put_device(), resulting in permanent reference count increments. Additionally, the for_each_child_of_node() iterator fails to release node references in all code paths. This leaks device node references when loop termination occurs before reaching MAX_CRTC. These reference count leaks may prevent device/node resources from being properly released during driver unbind operations.
As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +14 -7
@@ -388,19 +388,19 @@ static bool mtk_drm_get_all_drm_priv(str of_id =of_match_node (mtk_drm_of_ids, node);if (!of_id) -continue ; + goto next_put_node; pdev =of_find_device_by_node (node);if (!pdev) -continue ; + goto next_put_node; drm_dev =device_find_child (&pdev->dev,NULL , mtk_drm_match);if (!drm_dev) -continue ; + goto next_put_device_pdev_dev; temp_drm_priv =dev_get_drvdata (drm_dev);if (!temp_drm_priv) -continue ; + goto next_put_device_drm_dev;if (temp_drm_priv->data->main_len) all_drm_priv[CRTC_MAIN ] = temp_drm_priv;
@@ -412,10 +412,17 @@ static bool mtk_drm_get_all_drm_priv(strif (temp_drm_priv->mtk_drm_bound) cnt++; -if (cnt ==MAX_CRTC ) { -of_node_put (node); +next_put_device_drm_dev: +put_device (drm_dev); + +next_put_device_pdev_dev: +put_device (&pdev->dev); + +next_put_node: +of_node_put (node); + +if (cnt ==MAX_CRTC )break ; - } }if (drm_priv->data->mmsys_dev_num == cnt) {
Greg Kroah-Hartman
maintainerPATCH 98/142 l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9b8c88f875c04d4cb9111bd5dd9291c7e9691bf5 ]
pppol2tp_session_get_sock() is using RCU, it must be ready for sk_refcnt being zero.
Commit ee40fb2e1eb5 ("l2tp: protect sock pointer of
struct pppol2tp_session with RCU") was correct because it
had a call_rcu(..., pppol2tp_put_sk) which was later removed in blamed commit.
pppol2tp_recv() can use pppol2tp_session_get_sock() as well.
--- net/l2tp/l2tp_ppp.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-)
net/l2tp/l2tp_ppp.c +8 -17
@@ -129,22 +129,12 @@ static const struct ppp_channel_ops pppol2tp_chan_ops = {static const struct proto_ops pppol2tp_ops; -/* Retrieves the pppol2tp socket associated to a session. -* A reference is held on the returned socket, so this function must be paired -* with sock_put(). -*/ +/* Retrieves the pppol2tp socket associated to a session. */ static struct sock *pppol2tp_session_get_sock (struct l2tp_session *session) {struct pppol2tp_session *ps =l2tp_session_priv (session); -struct sock *sk; - -rcu_read_lock (); - sk =rcu_dereference (ps->sk); -if (sk) -sock_hold (sk); -rcu_read_unlock (); -return sk; +return rcu_dereference (ps->sk); }/* Helpers to obtain tunnel/session contexts from sockets.
@@ -206,14 +196,13 @@ static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,static void pppol2tp_recv (struct l2tp_session *session,struct sk_buff *skb,int data_len) { -struct pppol2tp_session *ps =l2tp_session_priv (session); -struct sock *sk =NULL ; +struct sock *sk;/* If the socket is bound, send it in to PPP's input queue. Otherwise * queue it on the session socket. */ rcu_read_lock (); - sk =rcu_dereference (ps->sk); + sk =pppol2tp_session_get_sock (session);if (!sk) goto no_sock;
@@ -510,13 +499,14 @@ static void pppol2tp_show(struct seq_file *m, void *arg)struct l2tp_session *session = arg;struct sock *sk; +rcu_read_lock (); sk =pppol2tp_session_get_sock (session);if (sk) {struct pppox_sock *po =pppox_sk (sk);seq_printf (m," interface %s\n" ,ppp_dev_name (&po->chan)); -sock_put (sk); } +rcu_read_unlock (); }static void pppol2tp_session_init (struct l2tp_session *session)
@@ -1530,6 +1520,7 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v) port =ntohs (inet->inet_sport); } +rcu_read_lock (); sk =pppol2tp_session_get_sock (session);if (sk) { state = sk->sk_state;
@@ -1565,8 +1556,8 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)struct pppox_sock *po =pppox_sk (sk);seq_printf (m," interface %s\n" ,ppp_dev_name (&po->chan)); -sock_put (sk); } +rcu_read_unlock (); }static int pppol2tp_seq_show (struct seq_file *m,void *v)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 99/142 fbnic: Move phylink resume out of service_task and into open/close
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <[email protected]>
[ Upstream commit 6ede14a2c6365e7e5d855643c7c8390b5268c467 ]
The fbnic driver was presenting with the following locking assert coming out of a PM resume:
[ 42.208116][ T164] RTNL: assertion failed at drivers/net/phy/phylink.c (2611) [ 42.208492][ T164] WARNING: CPU: 1 PID: 164 at drivers/net/phy/phylink.c:2611 phylink_resume+0x190/0x1e0 [ 42.208872][ T164] Modules linked in: [ 42.209140][ T164] CPU: 1 UID: 0 PID: 164 Comm: bash Not tainted 6.17.0-rc2-virtme #134 PREEMPT(full) [ 42.209496][ T164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 [ 42.209861][ T164] RIP: 0010:phylink_resume+0x190/0x1e0 [ 42.210057][ T164] Code: 83 e5 01 0f 85 b0 fe ff ff c6 05 1c cd 3e 02 01 90 ba 33 0a 00 00 48 c7 c6 20 3a 1d a5 48 c7 c7 e0 3e 1d a5 e8 21 b8 90 fe 90 <0f> 0b 90 90 e9 86 fe ff ff e8 42 ea 1f ff e9 e2 fe ff ff 48 89 ef [ 42.210708][ T164] RSP: 0018:ffffc90000affbd8 EFLAGS: 00010296 [ 42.210983][ T164] RAX: 0000000000000000 RBX: ffff8880078d8400 RCX: 0000000000000000 [ 42.211235][ T164] RDX: 0000000000000000 RSI: 1ffffffff4f10938 RDI: 0000000000000001 [ 42.211466][ T164] RBP: 0000000000000000 R08: ffffffffa2ae79ea R09: fffffbfff4b3eb84 [ 42.211707][ T164] R10: 0000000000000003 R11: 0000000000000000 R12: ffff888007ad8000 [ 42.211997][ T164] R13: 0000000000000002 R14: ffff888006a18800 R15: ffffffffa34c59e0 [ 42.212234][ T164] FS: 00007f0dc8e39740(0000) GS:ffff88808f51f000(0000) knlGS:0000000000000000 [ 42.212505][ T164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.212704][ T164] CR2: 00007f0dc8e9fe10 CR3: 000000000b56d003 CR4: 0000000000772ef0 [ 42.213227][ T164] PKRU: 55555554 [ 42.213366][ T164] Call Trace: [ 42.213483][ T164] <TASK> [ 42.213565][ T164] __fbnic_pm_attach.isra.0+0x8e/0xa0 [ 42.213725][ T164] pci_reset_function+0x116/0x1d0 [ 42.213895][ T164] reset_store+0xa0/0x100 [ 42.214025][ T164] ? pci_dev_reset_attr_is_visible+0x50/0x50 [ 42.214221][ T164] ? sysfs_file_kobj+0xc1/0x1e0 [ 42.214374][ T164] ? sysfs_kf_write+0x65/0x160 [ 42.214526][ T164] kernfs_fop_write_iter+0x2f8/0x4c0 [ 42.214677][ T164] ? kernfs_vma_page_mkwrite+0x1f0/0x1f0 [ 42.214836][ T164] new_sync_write+0x308/0x6f0 [ 42.214987][ T164] ? __lock_acquire+0x34c/0x740 [ 42.215135][ T164] ? new_sync_read+0x6f0/0x6f0 [ 42.215288][ T164] ? lock_acquire.part.0+0xbc/0x260 [ 42.215440][ T164] ? ksys_write+0xff/0x200 [ 42.215590][ T164] ? perf_trace_sched_switch+0x6d0/0x6d0 [ 42.215742][ T164] vfs_write+0x65e/0xbb0 [ 42.215876][ T164] ksys_write+0xff/0x200 [ 42.215994][ T164] ? __ia32_sys_read+0xc0/0xc0 [ 42.216141][ T164] ? do_user_addr_fault+0x269/0x9f0 [ 42.216292][ T164] ? rcu_is_watching+0x15/0xd0 [ 42.216442][ T164] do_syscall_64+0xbb/0x360 [ 42.216591][ T164] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 42.216784][ T164] RIP: 0033:0x7f0dc8ea9986
A bit of digging showed that we were invoking the phylink_resume as a part of the fbnic_up path when we were enabling the service task while not holding the RTNL lock. We should be enabling this sooner as a part of the ndo_open path and then just letting the service task come online later. This will help to enforce the correct locking and brings the phylink interface online at the same time as the network interface, instead of at a later time.
I tested this on QEMU to verify this was working by putting the system to sleep using "echo mem > /sys/power/state" to put the system to sleep in the guest and then using the command "system_wakeup" in the QEMU monitor.
--- drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 4 ++++ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 -- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c +4 -0
@@ -52,6 +52,8 @@ int __fbnic_open(struct fbnic_net *fbn)fbnic_bmc_rpc_init (fbd);fbnic_rss_reinit (fbd, fbn); +phylink_resume (fbn->phylink); +return 0 ; time_stop:fbnic_time_stop (fbn);
@@ -84,6 +86,8 @@ static int fbnic_stop(struct net_device *netdev) {struct fbnic_net *fbn =netdev_priv (netdev); +phylink_suspend (fbn->phylink,fbnic_bmc_present (fbn->fbd)); +fbnic_down (fbn);fbnic_pcs_free_irq (fbn->fbd);
drivers/net/ethernet/meta/fbnic/fbnic_pci.c +0 -2
@@ -118,14 +118,12 @@ static void fbnic_service_task_start(struct fbnic_net *fbn)struct fbnic_dev *fbd = fbn->fbd;schedule_delayed_work (&fbd->service_task,HZ ); -phylink_resume (fbn->phylink); }static void fbnic_service_task_stop (struct fbnic_net *fbn) {struct fbnic_dev *fbd = fbn->fbd; -phylink_suspend (fbn->phylink,fbnic_bmc_present (fbd));cancel_delayed_work (&fbd->service_task); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 100/142 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit a6358f8cf64850f3f27857b8ed8c1b08cfc4685c ]
Observed on kernel 6.6 (present on master as well):
BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0
If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename:
T1 T2
lookup_open
->lookup
simple_lookup
d_add
// invalid dentry is added to hash list
lookup_open
d_alloc_parallel
__d_lookup_rcu
__d_lookup_rcu_op_compare
hlist_bl_for_each_entry_rcu
// invalid dentry can be retrieved
->d_compare
efivarfs_d_compare
// oobFix it by checking 'guid' before cmp.
--- fs/efivarfs/super.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/efivarfs/super.c +4 -0
@@ -152,6 +152,10 @@ static int efivarfs_d_compare(const struct dentry *dentry, {int guid = len -EFI_VARIABLE_GUID_LEN ; +/* Parallel lookups may produce a temporary invalid filename */ +if (guid <=0 ) +return 1 ; +if (name->len != len)return 1 ;
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 101/142 net: macb: Disable clocks once
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Mandir <[email protected]>
[ Upstream commit dac978e51cce0c1f00a14c4a82f81d387f79b2d4 ]
When the driver is removed the clocks are disabled twice: once in macb_remove and a second time by runtime pm. Disable wakeup in remove so all the clocks are disabled and skip the second call to macb_clks_disable. Always suspend the device as we always set it active in probe.
--- drivers/net/ethernet/cadence/macb_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +2 -5
@@ -5396,14 +5396,11 @@ static void macb_remove(struct platform_device *pdev)mdiobus_unregister (bp->mii_bus);mdiobus_free (bp->mii_bus); +device_set_wakeup_enable (&bp->pdev->dev,0 );cancel_work_sync (&bp->hresp_err_bh_work);pm_runtime_disable (&pdev->dev);pm_runtime_dont_use_autosuspend (&pdev->dev); -if (!pm_runtime_suspended (&pdev->dev)) { -macb_clks_disable (bp->pclk, bp->hclk, bp->tx_clk, - bp->rx_clk, bp->tsu_clk); -pm_runtime_set_suspended (&pdev->dev); - } +pm_runtime_set_suspended (&pdev->dev);phylink_destroy (bp->phylink);free_netdev (dev); }
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 102/142 io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit 98b6fa62c84f2e129161e976a5b9b3cb4ccd117b ]
Since the buffers are mapped from userspace, it is prudent to use READ_ONCE() to read the value into a local variable, and use that for any other actions taken. Having a stable read of the buffer length avoids worrying about it changing after checking, or being read multiple times.
Similarly, the buffer may well change in between it being picked and being committed. Ensure the looping for incremental ring buffer commit stops if it hits a zero sized buffer, as no further progress can be made at that point.
--- io_uring/kbuf.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
io_uring/kbuf.c +13 -7
@@ -36,15 +36,19 @@ static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len) {while (len) {struct io_uring_buf *buf; -u32 this_len; +u32 buf_len, this_len; buf =io_ring_head_to_buf (bl->buf_ring, bl->head, bl->mask); - this_len =min_t (u32, len, buf->len); - buf->len -= this_len; -if (buf->len) { + buf_len =READ_ONCE (buf->len); + this_len =min_t (u32, len, buf_len); + buf_len -= this_len; +/* Stop looping for invalid buffer length of 0 */ +if (buf_len || !this_len) { buf->addr += this_len; + buf->len = buf_len;return false; } + buf->len =0 ; bl->head++; len -= this_len; }
@@ -159,6 +163,7 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len,__u16 tail, head = bl->head;struct io_uring_buf *buf;void __user *ret; +u32 buf_len; tail =smp_load_acquire (&br->tail);if (unlikely (tail == head))
@@ -168,8 +173,9 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len, req->flags |=REQ_F_BL_EMPTY ; buf =io_ring_head_to_buf (br, head, bl->mask); -if (*len ==0 || *len > buf->len) - *len = buf->len; + buf_len =READ_ONCE (buf->len); +if (*len ==0 || *len > buf_len) + *len = buf_len; req->flags |=REQ_F_BUFFER_RING |REQ_F_BUFFERS_COMMIT ; req->buf_list = bl; req->buf_index = buf->bid;
@@ -265,7 +271,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, req->buf_index = buf->bid; do { - u32 len = buf->len; + u32 len = READ_ONCE(buf->len); /* truncate end piece, if needed, for non partial buffers */ if (len > arg->max_len) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 103/142 drm/mediatek: mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis-Alexis Eyraud <[email protected]>
[ Upstream commit c34414883f773412964404d77cd2fea04c6f7d60 ]
In mtk_hdmi driver, a recent change replaced custom register access function calls by regmap ones, but two replacements by regmap_update_bits were done incorrectly, because original offset and mask parameters were inverted, so fix them.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +4 -4
@@ -182,8 +182,8 @@ static inline struct mtk_hdmi *hdmi_ctx_from_bridge(struct drm_bridge *b)static void mtk_hdmi_hw_vid_black (struct mtk_hdmi *hdmi,bool black) { -regmap_update_bits (hdmi->regs,VIDEO_SOURCE_SEL , -VIDEO_CFG_4 , black ?GEN_RGB :NORMAL_PATH ); +regmap_update_bits (hdmi->regs,VIDEO_CFG_4 , +VIDEO_SOURCE_SEL , black ?GEN_RGB :NORMAL_PATH ); }static void mtk_hdmi_hw_make_reg_writable (struct mtk_hdmi *hdmi,bool enable)
@@ -310,8 +310,8 @@ static void mtk_hdmi_hw_send_info_frame(struct mtk_hdmi *hdmi, u8 *buffer,static void mtk_hdmi_hw_send_aud_packet (struct mtk_hdmi *hdmi,bool enable) { -regmap_update_bits (hdmi->regs,AUDIO_PACKET_OFF , -GRL_SHIFT_R2 , enable ?0 :AUDIO_PACKET_OFF ); +regmap_update_bits (hdmi->regs,GRL_SHIFT_R2 , +AUDIO_PACKET_OFF , enable ?0 :AUDIO_PACKET_OFF ); }static void mtk_hdmi_hw_config_sys (struct mtk_hdmi *hdmi)
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 94/142 net: rose: split remove and free operations in rose_remove_neigh()
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takamitsu Iwai <[email protected]>
[ Upstream commit dcb34659028f856c423a29ef9b4e2571d203444d ]
The current rose_remove_neigh() performs two distinct operations:
1. Removes rose_neigh from rose_neigh_list
2. Frees the rose_neigh structure
Split these operations into separate functions to improve maintainability and prepare for upcoming refcount_t conversion. The timer cleanup remains in rose_remove_neigh() because free operations can be called from timer itself.
This patch introduce rose_neigh_put() to handle the freeing of rose_neigh structures and modify rose_remove_neigh() to handle removal only.
Stable-dep-of: d860d1faa6b2 ("net: rose: convert 'use' field to refcount_t")
--- include/net/rose.h | 8 ++++++++ net/rose/rose_route.c | 15 ++++++--------- 2 files changed, 14 insertions(+), 9 deletions(-)
include/net/rose.h +8 -0
@@ -151,6 +151,14 @@ struct rose_sock {#define rose_sk (sk) ((struct rose_sock *)(sk)) +static inline void rose_neigh_put (struct rose_neigh *rose_neigh) +{ +if (rose_neigh->ax25) +ax25_cb_put (rose_neigh->ax25); +kfree (rose_neigh->digipeat); +kfree (rose_neigh); +} +/* af_rose.c */ extern ax25_address rose_callsign;extern int sysctl_rose_restart_request_timeout;
net/rose/rose_route.c +6 -9
@@ -234,20 +234,12 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)if ((s = rose_neigh_list) == rose_neigh) { rose_neigh_list = rose_neigh->next; -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh);return ; }while (s !=NULL && s->next !=NULL ) {if (s->next == rose_neigh) { s->next = rose_neigh->next; -if (rose_neigh->ax25) -ax25_cb_put (rose_neigh->ax25); -kfree (rose_neigh->digipeat); -kfree (rose_neigh);return ; }
@@ -331,8 +323,10 @@ static int rose_del_node(struct rose_route_struct *rose_route,if (rose_node->neighbour[i] == rose_neigh) { rose_neigh->count--; -if (rose_neigh->count ==0 && rose_neigh->use ==0 ) +if (rose_neigh->count ==0 && rose_neigh->use ==0 ) {rose_remove_neigh (rose_neigh); +rose_neigh_put (rose_neigh); + } rose_node->count--;
@@ -513,6 +507,7 @@ void rose_rt_device_down(struct net_device *dev) }rose_remove_neigh (s); +rose_neigh_put (s); }spin_unlock_bh (&rose_neigh_list_lock);spin_unlock_bh (&rose_node_list_lock);
@@ -569,6 +564,7 @@ static int rose_clear_routes(void)if (s->use ==0 && !s->loopback) { s->count =0 ;rose_remove_neigh (s); +rose_neigh_put (s); } }
@@ -1301,6 +1297,7 @@ void __exit rose_rt_free(void) rose_neigh = rose_neigh->next;rose_remove_neigh (s); +rose_neigh_put (s); }while (rose_node !=NULL ) {
Signature · 1 line
2.50.1
Greg Kroah-Hartman
maintainerPATCH 130/142 drm/amdgpu/userq: fix error handling of invalid doorbell
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit c767d74a9cdd1042046d02319d16b85d9aa8a8aa upstream.
If the doorbell is invalid, be sure to set the r to an error state so the function returns an error.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +1 -0
@@ -426,6 +426,7 @@ amdgpu_userq_create(struct drm_file *filif (index == (uint64_t )-EINVAL ) {drm_file_err (uq_mgr->file,"Failed to get doorbell for queue\n" );kfree (queue); + r = -EINVAL ; goto unlock; }
Greg Kroah-Hartman
maintainerPATCH 139/142 Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
In reply to Greg Kroah-Hartman6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <[email protected]>
This reverts commit 944e732be9c3a33e64e9fb0f5451a37fc252ddfc which is commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f upstream.
The upstream commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f ("drm/dp:
Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS") the reverted commit backported causes a regression, on one eDP panel at least resulting in display flickering, described in detail at the Link:
below. The issue fixed by the upstream commit will need a different solution, revert the backport for now.
--- drivers/gpu/drm/display/drm_dp_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/display/drm_dp_helper.c +1 -1
@@ -725,7 +725,7 @@ ssize_t drm_dp_dpcd_read(struct drm_dp_a* monitor doesn't power down exactly after the throw away read. */ if (!aux->is_remote) { - ret =drm_dp_dpcd_probe (aux,DP_LANE0_1_STATUS ); + ret =drm_dp_dpcd_probe (aux,DP_DPCD_REV );if (ret <0 )return ret; }