* [PATCH 5.13 001/266] drm/mxsfb: Dont select DRM_KMS_FB_HELPER
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
@ 2021-07-15 18:35 ` Greg Kroah-Hartman
2021-07-15 18:35 ` [PATCH 5.13 002/266] drm/zte: " Greg Kroah-Hartman
` (268 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Zimmermann, Stefan Agner,
Daniel Vetter, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 13b29cc3a722c2c0bc9ab9f72f9047d55d08a2f9 ]
Selecting DRM_FBDEV_EMULATION will include the correct settings for
fbdev emulation. Drivers should not override this.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Acked-by: Stefan Agner <stefan@agner.ch>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210415110040.23525-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mxsfb/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig
index 0143d539f8f8..ee22cd25d3e3 100644
--- a/drivers/gpu/drm/mxsfb/Kconfig
+++ b/drivers/gpu/drm/mxsfb/Kconfig
@@ -10,7 +10,6 @@ config DRM_MXSFB
depends on COMMON_CLK
select DRM_MXS
select DRM_KMS_HELPER
- select DRM_KMS_FB_HELPER
select DRM_KMS_CMA_HELPER
select DRM_PANEL
select DRM_PANEL_BRIDGE
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 002/266] drm/zte: Dont select DRM_KMS_FB_HELPER
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
2021-07-15 18:35 ` [PATCH 5.13 001/266] drm/mxsfb: Dont select DRM_KMS_FB_HELPER Greg Kroah-Hartman
@ 2021-07-15 18:35 ` Greg Kroah-Hartman
2021-07-15 18:35 ` [PATCH 5.13 003/266] drm/ast: Fixed CVE for DP501 Greg Kroah-Hartman
` (267 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Zimmermann, Daniel Vetter,
Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit a50e74bec1d17e95275909660c6b43ffe11ebcf0 ]
Selecting DRM_FBDEV_EMULATION will include the correct settings for
fbdev emulation. Drivers should not override this.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210415110040.23525-4-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/zte/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/zte/Kconfig b/drivers/gpu/drm/zte/Kconfig
index 90ebaedc11fd..aa8594190b50 100644
--- a/drivers/gpu/drm/zte/Kconfig
+++ b/drivers/gpu/drm/zte/Kconfig
@@ -3,7 +3,6 @@ config DRM_ZTE
tristate "DRM Support for ZTE SoCs"
depends on DRM && ARCH_ZX
select DRM_KMS_CMA_HELPER
- select DRM_KMS_FB_HELPER
select DRM_KMS_HELPER
select SND_SOC_HDMI_CODEC if SND_SOC
select VIDEOMODE_HELPERS
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 003/266] drm/ast: Fixed CVE for DP501
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
2021-07-15 18:35 ` [PATCH 5.13 001/266] drm/mxsfb: Dont select DRM_KMS_FB_HELPER Greg Kroah-Hartman
2021-07-15 18:35 ` [PATCH 5.13 002/266] drm/zte: " Greg Kroah-Hartman
@ 2021-07-15 18:35 ` Greg Kroah-Hartman
2021-07-15 18:35 ` [PATCH 5.13 004/266] drm/amd/display: fix HDCP reset sequence on reinitialize Greg Kroah-Hartman
` (266 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, KuoHsiang Chou, kernel test robot,
Thomas Zimmermann, Sasha Levin
From: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
[ Upstream commit ba4e0339a6a33e2ba341703ce14ae8ca203cb2f1 ]
[Bug][DP501]
If ASPEED P2A (PCI to AHB) bridge is disabled and disallowed for
CVE_2019_6260 item3, and then the monitor's EDID is unable read through
Parade DP501.
The reason is the DP501's FW is mapped to BMC addressing space rather
than Host addressing space.
The resolution is that using "pci_iomap_range()" maps to DP501's FW that
stored on the end of FB (Frame Buffer).
In this case, FrameBuffer reserves the last 2MB used for the image of
DP501.
Signed-off-by: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210421085859.17761-1-kuohsiang_chou@aspeedtech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/ast/ast_dp501.c | 139 +++++++++++++++++++++++---------
drivers/gpu/drm/ast/ast_drv.h | 12 +++
drivers/gpu/drm/ast/ast_main.c | 11 ++-
3 files changed, 125 insertions(+), 37 deletions(-)
diff --git a/drivers/gpu/drm/ast/ast_dp501.c b/drivers/gpu/drm/ast/ast_dp501.c
index 88121c0e0d05..cd93c44f2662 100644
--- a/drivers/gpu/drm/ast/ast_dp501.c
+++ b/drivers/gpu/drm/ast/ast_dp501.c
@@ -189,6 +189,9 @@ bool ast_backup_fw(struct drm_device *dev, u8 *addr, u32 size)
u32 i, data;
u32 boot_address;
+ if (ast->config_mode != ast_use_p2a)
+ return false;
+
data = ast_mindwm(ast, 0x1e6e2100) & 0x01;
if (data) {
boot_address = get_fw_base(ast);
@@ -207,6 +210,9 @@ static bool ast_launch_m68k(struct drm_device *dev)
u8 *fw_addr = NULL;
u8 jreg;
+ if (ast->config_mode != ast_use_p2a)
+ return false;
+
data = ast_mindwm(ast, 0x1e6e2100) & 0x01;
if (!data) {
@@ -271,25 +277,55 @@ u8 ast_get_dp501_max_clk(struct drm_device *dev)
struct ast_private *ast = to_ast_private(dev);
u32 boot_address, offset, data;
u8 linkcap[4], linkrate, linklanes, maxclk = 0xff;
+ u32 *plinkcap;
- boot_address = get_fw_base(ast);
-
- /* validate FW version */
- offset = 0xf000;
- data = ast_mindwm(ast, boot_address + offset);
- if ((data & 0xf0) != 0x10) /* version: 1x */
- return maxclk;
-
- /* Read Link Capability */
- offset = 0xf014;
- *(u32 *)linkcap = ast_mindwm(ast, boot_address + offset);
- if (linkcap[2] == 0) {
- linkrate = linkcap[0];
- linklanes = linkcap[1];
- data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes);
- if (data > 0xff)
- data = 0xff;
- maxclk = (u8)data;
+ if (ast->config_mode == ast_use_p2a) {
+ boot_address = get_fw_base(ast);
+
+ /* validate FW version */
+ offset = AST_DP501_GBL_VERSION;
+ data = ast_mindwm(ast, boot_address + offset);
+ if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) /* version: 1x */
+ return maxclk;
+
+ /* Read Link Capability */
+ offset = AST_DP501_LINKRATE;
+ plinkcap = (u32 *)linkcap;
+ *plinkcap = ast_mindwm(ast, boot_address + offset);
+ if (linkcap[2] == 0) {
+ linkrate = linkcap[0];
+ linklanes = linkcap[1];
+ data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes);
+ if (data > 0xff)
+ data = 0xff;
+ maxclk = (u8)data;
+ }
+ } else {
+ if (!ast->dp501_fw_buf)
+ return AST_DP501_DEFAULT_DCLK; /* 1024x768 as default */
+
+ /* dummy read */
+ offset = 0x0000;
+ data = readl(ast->dp501_fw_buf + offset);
+
+ /* validate FW version */
+ offset = AST_DP501_GBL_VERSION;
+ data = readl(ast->dp501_fw_buf + offset);
+ if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1) /* version: 1x */
+ return maxclk;
+
+ /* Read Link Capability */
+ offset = AST_DP501_LINKRATE;
+ plinkcap = (u32 *)linkcap;
+ *plinkcap = readl(ast->dp501_fw_buf + offset);
+ if (linkcap[2] == 0) {
+ linkrate = linkcap[0];
+ linklanes = linkcap[1];
+ data = (linkrate == 0x0a) ? (90 * linklanes) : (54 * linklanes);
+ if (data > 0xff)
+ data = 0xff;
+ maxclk = (u8)data;
+ }
}
return maxclk;
}
@@ -298,26 +334,57 @@ bool ast_dp501_read_edid(struct drm_device *dev, u8 *ediddata)
{
struct ast_private *ast = to_ast_private(dev);
u32 i, boot_address, offset, data;
+ u32 *pEDIDidx;
- boot_address = get_fw_base(ast);
-
- /* validate FW version */
- offset = 0xf000;
- data = ast_mindwm(ast, boot_address + offset);
- if ((data & 0xf0) != 0x10)
- return false;
-
- /* validate PnP Monitor */
- offset = 0xf010;
- data = ast_mindwm(ast, boot_address + offset);
- if (!(data & 0x01))
- return false;
+ if (ast->config_mode == ast_use_p2a) {
+ boot_address = get_fw_base(ast);
- /* Read EDID */
- offset = 0xf020;
- for (i = 0; i < 128; i += 4) {
- data = ast_mindwm(ast, boot_address + offset + i);
- *(u32 *)(ediddata + i) = data;
+ /* validate FW version */
+ offset = AST_DP501_GBL_VERSION;
+ data = ast_mindwm(ast, boot_address + offset);
+ if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1)
+ return false;
+
+ /* validate PnP Monitor */
+ offset = AST_DP501_PNPMONITOR;
+ data = ast_mindwm(ast, boot_address + offset);
+ if (!(data & AST_DP501_PNP_CONNECTED))
+ return false;
+
+ /* Read EDID */
+ offset = AST_DP501_EDID_DATA;
+ for (i = 0; i < 128; i += 4) {
+ data = ast_mindwm(ast, boot_address + offset + i);
+ pEDIDidx = (u32 *)(ediddata + i);
+ *pEDIDidx = data;
+ }
+ } else {
+ if (!ast->dp501_fw_buf)
+ return false;
+
+ /* dummy read */
+ offset = 0x0000;
+ data = readl(ast->dp501_fw_buf + offset);
+
+ /* validate FW version */
+ offset = AST_DP501_GBL_VERSION;
+ data = readl(ast->dp501_fw_buf + offset);
+ if ((data & AST_DP501_FW_VERSION_MASK) != AST_DP501_FW_VERSION_1)
+ return false;
+
+ /* validate PnP Monitor */
+ offset = AST_DP501_PNPMONITOR;
+ data = readl(ast->dp501_fw_buf + offset);
+ if (!(data & AST_DP501_PNP_CONNECTED))
+ return false;
+
+ /* Read EDID */
+ offset = AST_DP501_EDID_DATA;
+ for (i = 0; i < 128; i += 4) {
+ data = readl(ast->dp501_fw_buf + offset + i);
+ pEDIDidx = (u32 *)(ediddata + i);
+ *pEDIDidx = data;
+ }
}
return true;
diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index e82ab8628770..911f9f414774 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -150,6 +150,7 @@ struct ast_private {
void __iomem *regs;
void __iomem *ioregs;
+ void __iomem *dp501_fw_buf;
enum ast_chip chip;
bool vga2_clone;
@@ -325,6 +326,17 @@ int ast_mode_config_init(struct ast_private *ast);
#define AST_MM_ALIGN_SHIFT 4
#define AST_MM_ALIGN_MASK ((1 << AST_MM_ALIGN_SHIFT) - 1)
+#define AST_DP501_FW_VERSION_MASK GENMASK(7, 4)
+#define AST_DP501_FW_VERSION_1 BIT(4)
+#define AST_DP501_PNP_CONNECTED BIT(1)
+
+#define AST_DP501_DEFAULT_DCLK 65
+
+#define AST_DP501_GBL_VERSION 0xf000
+#define AST_DP501_PNPMONITOR 0xf010
+#define AST_DP501_LINKRATE 0xf014
+#define AST_DP501_EDID_DATA 0xf020
+
int ast_mm_init(struct ast_private *ast);
/* ast post */
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index c29cc7f19863..189d783f6e2c 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -99,7 +99,7 @@ static void ast_detect_config_mode(struct drm_device *dev, u32 *scu_rev)
if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) {
/* Double check it's actually working */
data = ast_read32(ast, 0xf004);
- if (data != 0xFFFFFFFF) {
+ if ((data != 0xFFFFFFFF) && (data != 0x00)) {
/* P2A works, grab silicon revision */
ast->config_mode = ast_use_p2a;
@@ -411,6 +411,7 @@ struct ast_private *ast_device_create(const struct drm_driver *drv,
return ast;
dev = &ast->base;
+ dev->pdev = pdev;
pci_set_drvdata(pdev, dev);
ast->regs = pcim_iomap(pdev, 1, 0);
@@ -450,6 +451,14 @@ struct ast_private *ast_device_create(const struct drm_driver *drv,
if (ret)
return ERR_PTR(ret);
+ /* map reserved buffer */
+ ast->dp501_fw_buf = NULL;
+ if (dev->vram_mm->vram_size < pci_resource_len(dev->pdev, 0)) {
+ ast->dp501_fw_buf = pci_iomap_range(dev->pdev, 0, dev->vram_mm->vram_size, 0);
+ if (!ast->dp501_fw_buf)
+ drm_info(dev, "failed to map reserved buffer!\n");
+ }
+
ret = ast_mode_config_init(ast);
if (ret)
return ERR_PTR(ret);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 004/266] drm/amd/display: fix HDCP reset sequence on reinitialize
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2021-07-15 18:35 ` [PATCH 5.13 003/266] drm/ast: Fixed CVE for DP501 Greg Kroah-Hartman
@ 2021-07-15 18:35 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 005/266] drm/amd/display: Revert wait vblank on update dpp clock Greg Kroah-Hartman
` (265 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brandon Syu, Wenjing Liu, Wayne Lin,
Daniel Wheeler, Alex Deucher, Sasha Levin
From: Brandon Syu <Brandon.Syu@amd.com>
[ Upstream commit 99c248c41c2199bd34232ce8e729d18c4b343b64 ]
[why]
When setup is called after hdcp has already setup,
it would cause to disable HDCP flow won’t execute.
[how]
Don't clean up hdcp content to be 0.
Signed-off-by: Brandon Syu <Brandon.Syu@amd.com>
Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
Acked-by: Wayne Lin <waynelin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c
index 68a6481d7f8f..b963226e8af4 100644
--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c
+++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c
@@ -260,7 +260,6 @@ enum mod_hdcp_status mod_hdcp_setup(struct mod_hdcp *hdcp,
struct mod_hdcp_output output;
enum mod_hdcp_status status = MOD_HDCP_STATUS_SUCCESS;
- memset(hdcp, 0, sizeof(struct mod_hdcp));
memset(&output, 0, sizeof(output));
hdcp->config = *config;
HDCP_TOP_INTERFACE_TRACE(hdcp);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 005/266] drm/amd/display: Revert wait vblank on update dpp clock
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2021-07-15 18:35 ` [PATCH 5.13 004/266] drm/amd/display: fix HDCP reset sequence on reinitialize Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 006/266] drm/amd/display: Fix BSOD with NULL check Greg Kroah-Hartman
` (264 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lewis Huang, Eric Yang, Wayne Lin,
Daniel Wheeler, Alex Deucher, Sasha Levin
From: Lewis Huang <Lewis.Huang@amd.com>
[ Upstream commit d5433a9f692f57c814286f8af2746c567ef79fc8 ]
[Why]
This change only fix dpp clock switch to lower case.
New solution later can fix both case, which is "dc: skip
program clock when allow seamless boot"
[How]
This reverts commit "dc: wait vblank when stream enabled
and update dpp clock"
Signed-off-by: Lewis Huang <Lewis.Huang@amd.com>
Reviewed-by: Eric Yang <eric.yang2@amd.com>
Acked-by: Wayne Lin <waynelin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 10 +---------
drivers/gpu/drm/amd/display/dc/core/dc.c | 13 -------------
drivers/gpu/drm/amd/display/dc/dc.h | 1 -
3 files changed, 1 insertion(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
index a06e86853bb9..49d19fdd750b 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
@@ -128,7 +128,7 @@ void rn_update_clocks(struct clk_mgr *clk_mgr_base,
struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk;
struct dc *dc = clk_mgr_base->ctx->dc;
- int display_count, i;
+ int display_count;
bool update_dppclk = false;
bool update_dispclk = false;
bool dpp_clock_lowered = false;
@@ -210,14 +210,6 @@ void rn_update_clocks(struct clk_mgr *clk_mgr_base,
clk_mgr_base->clks.dppclk_khz,
safe_to_lower);
- for (i = 0; i < context->stream_count; i++) {
- if (context->streams[i]->signal == SIGNAL_TYPE_EDP &&
- context->streams[i]->apply_seamless_boot_optimization) {
- dc_wait_for_vblank(dc, context->streams[i]);
- break;
- }
- }
-
clk_mgr_base->clks.actual_dppclk_khz =
rn_vbios_smu_set_dppclk(clk_mgr, clk_mgr_base->clks.dppclk_khz);
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 4713f09bcbf1..e57df2f6f824 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -3219,19 +3219,6 @@ void dc_link_remove_remote_sink(struct dc_link *link, struct dc_sink *sink)
}
}
-void dc_wait_for_vblank(struct dc *dc, struct dc_stream_state *stream)
-{
- int i;
-
- for (i = 0; i < dc->res_pool->pipe_count; i++)
- if (dc->current_state->res_ctx.pipe_ctx[i].stream == stream) {
- struct timing_generator *tg =
- dc->current_state->res_ctx.pipe_ctx[i].stream_res.tg;
- tg->funcs->wait_for_state(tg, CRTC_STATE_VBLANK);
- break;
- }
-}
-
void get_clock_requirements_for_state(struct dc_state *state, struct AsicStateEx *info)
{
info->displayClock = (unsigned int)state->bw_ctx.bw.dcn.clk.dispclk_khz;
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index 100d434f7a03..65f801b50686 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -719,7 +719,6 @@ void dc_init_callbacks(struct dc *dc,
void dc_deinit_callbacks(struct dc *dc);
void dc_destroy(struct dc **dc);
-void dc_wait_for_vblank(struct dc *dc, struct dc_stream_state *stream);
/*******************************************************************************
* Surface Interfaces
******************************************************************************/
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 006/266] drm/amd/display: Fix BSOD with NULL check
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 005/266] drm/amd/display: Revert wait vblank on update dpp clock Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 007/266] drm/amd/amdgpu/sriov disable all ip hw status by default Greg Kroah-Hartman
` (263 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Park, Nicholas Kazlauskas,
Wayne Lin, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Chris Park <Chris.Park@amd.com>
[ Upstream commit b2d4b9f72fb14c1e6e4f0128964a84539a72d831 ]
[Why]
CLK mgr is null for server settings.
[How]
Guard the function with NULL check.
Signed-off-by: Chris Park <Chris.Park@amd.com>
Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
Acked-by: Wayne Lin <waynelin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index e57df2f6f824..a869702d77af 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -3274,7 +3274,7 @@ void dc_allow_idle_optimizations(struct dc *dc, bool allow)
if (dc->debug.disable_idle_power_optimizations)
return;
- if (dc->clk_mgr->funcs->is_smu_present)
+ if (dc->clk_mgr != NULL && dc->clk_mgr->funcs->is_smu_present)
if (!dc->clk_mgr->funcs->is_smu_present(dc->clk_mgr))
return;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 007/266] drm/amd/amdgpu/sriov disable all ip hw status by default
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 006/266] drm/amd/display: Fix BSOD with NULL check Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 008/266] drm/vc4: fix argument ordering in vc4_crtc_get_margins() Greg Kroah-Hartman
` (262 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jack Zhang, Alex Deucher,
Sasha Levin, Emily Deng
From: Jack Zhang <Jack.Zhang1@amd.com>
[ Upstream commit 95ea3dbc4e9548d35ab6fbf67675cef8c293e2f5 ]
Disable all ip's hw status to false before any hw_init.
Only set it to true until its hw_init is executed.
The old 5.9 branch has this change but somehow the 5.11 kernrel does
not have this fix.
Without this change, sriov tdr have gfx IB test fail.
Signed-off-by: Jack Zhang <Jack.Zhang1@amd.com>
Review-by: Emily Deng <Emily.Deng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 57ec108b5972..f008f001951b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2856,7 +2856,7 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev)
AMD_IP_BLOCK_TYPE_IH,
};
- for (i = 0; i < ARRAY_SIZE(ip_order); i++) {
+ for (i = 0; i < adev->num_ip_blocks; i++) {
int j;
struct amdgpu_ip_block *block;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 008/266] drm/vc4: fix argument ordering in vc4_crtc_get_margins()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 007/266] drm/amd/amdgpu/sriov disable all ip hw status by default Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 009/266] drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be true Greg Kroah-Hartman
` (261 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Dan Carpenter,
Maxime Ripard, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit e590c2b03a6143ba93ddad306bc9eaafa838c020 ]
Cppcheck complains that the declaration doesn't match the function
definition. Obviously "left" should come before "right". The caller
and the function implementation are done this way, it's just the
declaration which is wrong so this doesn't affect runtime.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/YH/720FD978TPhHp@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_drv.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index a7500716cf3f..5dceadc61600 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -825,7 +825,7 @@ void vc4_crtc_destroy_state(struct drm_crtc *crtc,
void vc4_crtc_reset(struct drm_crtc *crtc);
void vc4_crtc_handle_vblank(struct vc4_crtc *crtc);
void vc4_crtc_get_margins(struct drm_crtc_state *state,
- unsigned int *right, unsigned int *left,
+ unsigned int *left, unsigned int *right,
unsigned int *top, unsigned int *bottom);
/* vc4_debugfs.c */
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 009/266] drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be true
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 008/266] drm/vc4: fix argument ordering in vc4_crtc_get_margins() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 010/266] drm/imx: Add 8 pixel alignment fix Greg Kroah-Hartman
` (260 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrzej Hajda, Neil Armstrong,
Robert Foss, Laurent Pinchart, Jonas Karlman, Jernej Skrabec,
David Airlie, Daniel Vetter, Guido Günther, Robert Chiras,
NXP Linux Team, Liu Ying, Sasha Levin
From: Liu Ying <victor.liu@nxp.com>
[ Upstream commit 3afb2a28fa2404d11cce1956a003f2aaca4da421 ]
This patch replaces ->mode_fixup() with ->atomic_check() so that
a full modeset can be requested from there when crtc_state->active
is changed to be true(which implies only connector's DPMS is brought
out of "Off" status, though not necessarily). Bridge functions are
added or changed to accommodate the ->atomic_check() callback. That
full modeset is needed by the up-coming patch which gets MIPI DSI
controller and PHY ready in ->mode_set(), because it makes sure
->mode_set() and ->atomic_disable() are called in pairs.
Cc: Andrzej Hajda <a.hajda@samsung.com>
Cc: Neil Armstrong <narmstrong@baylibre.com>
Cc: Robert Foss <robert.foss@linaro.org>
Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
Cc: Jonas Karlman <jonas@kwiboo.se>
Cc: Jernej Skrabec <jernej.skrabec@siol.net>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Guido Günther <agx@sigxcpu.org>
Cc: Robert Chiras <robert.chiras@nxp.com>
Cc: NXP Linux Team <linux-imx@nxp.com>
Signed-off-by: Liu Ying <victor.liu@nxp.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1619170003-4817-2-git-send-email-victor.liu@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/nwl-dsi.c | 61 ++++++++++++++++++++------------
1 file changed, 39 insertions(+), 22 deletions(-)
diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c
index 66b67402f1ac..c65ca860712d 100644
--- a/drivers/gpu/drm/bridge/nwl-dsi.c
+++ b/drivers/gpu/drm/bridge/nwl-dsi.c
@@ -21,6 +21,7 @@
#include <linux/sys_soc.h>
#include <linux/time64.h>
+#include <drm/drm_atomic_state_helper.h>
#include <drm/drm_bridge.h>
#include <drm/drm_mipi_dsi.h>
#include <drm/drm_of.h>
@@ -742,7 +743,9 @@ static int nwl_dsi_disable(struct nwl_dsi *dsi)
return 0;
}
-static void nwl_dsi_bridge_disable(struct drm_bridge *bridge)
+static void
+nwl_dsi_bridge_atomic_disable(struct drm_bridge *bridge,
+ struct drm_bridge_state *old_bridge_state)
{
struct nwl_dsi *dsi = bridge_to_dsi(bridge);
int ret;
@@ -803,17 +806,6 @@ static int nwl_dsi_get_dphy_params(struct nwl_dsi *dsi,
return 0;
}
-static bool nwl_dsi_bridge_mode_fixup(struct drm_bridge *bridge,
- const struct drm_display_mode *mode,
- struct drm_display_mode *adjusted_mode)
-{
- /* At least LCDIF + NWL needs active high sync */
- adjusted_mode->flags |= (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC);
- adjusted_mode->flags &= ~(DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC);
-
- return true;
-}
-
static enum drm_mode_status
nwl_dsi_bridge_mode_valid(struct drm_bridge *bridge,
const struct drm_display_info *info,
@@ -831,6 +823,24 @@ nwl_dsi_bridge_mode_valid(struct drm_bridge *bridge,
return MODE_OK;
}
+static int nwl_dsi_bridge_atomic_check(struct drm_bridge *bridge,
+ struct drm_bridge_state *bridge_state,
+ struct drm_crtc_state *crtc_state,
+ struct drm_connector_state *conn_state)
+{
+ struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode;
+
+ /* At least LCDIF + NWL needs active high sync */
+ adjusted_mode->flags |= (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC);
+ adjusted_mode->flags &= ~(DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC);
+
+ /* Do a full modeset if crtc_state->active is changed to be true. */
+ if (crtc_state->active_changed && crtc_state->active)
+ crtc_state->mode_changed = true;
+
+ return 0;
+}
+
static void
nwl_dsi_bridge_mode_set(struct drm_bridge *bridge,
const struct drm_display_mode *mode,
@@ -862,7 +872,9 @@ nwl_dsi_bridge_mode_set(struct drm_bridge *bridge,
drm_mode_debug_printmodeline(adjusted_mode);
}
-static void nwl_dsi_bridge_pre_enable(struct drm_bridge *bridge)
+static void
+nwl_dsi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
+ struct drm_bridge_state *old_bridge_state)
{
struct nwl_dsi *dsi = bridge_to_dsi(bridge);
int ret;
@@ -897,7 +909,9 @@ static void nwl_dsi_bridge_pre_enable(struct drm_bridge *bridge)
}
}
-static void nwl_dsi_bridge_enable(struct drm_bridge *bridge)
+static void
+nwl_dsi_bridge_atomic_enable(struct drm_bridge *bridge,
+ struct drm_bridge_state *old_bridge_state)
{
struct nwl_dsi *dsi = bridge_to_dsi(bridge);
int ret;
@@ -942,14 +956,17 @@ static void nwl_dsi_bridge_detach(struct drm_bridge *bridge)
}
static const struct drm_bridge_funcs nwl_dsi_bridge_funcs = {
- .pre_enable = nwl_dsi_bridge_pre_enable,
- .enable = nwl_dsi_bridge_enable,
- .disable = nwl_dsi_bridge_disable,
- .mode_fixup = nwl_dsi_bridge_mode_fixup,
- .mode_set = nwl_dsi_bridge_mode_set,
- .mode_valid = nwl_dsi_bridge_mode_valid,
- .attach = nwl_dsi_bridge_attach,
- .detach = nwl_dsi_bridge_detach,
+ .atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
+ .atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
+ .atomic_reset = drm_atomic_helper_bridge_reset,
+ .atomic_check = nwl_dsi_bridge_atomic_check,
+ .atomic_pre_enable = nwl_dsi_bridge_atomic_pre_enable,
+ .atomic_enable = nwl_dsi_bridge_atomic_enable,
+ .atomic_disable = nwl_dsi_bridge_atomic_disable,
+ .mode_set = nwl_dsi_bridge_mode_set,
+ .mode_valid = nwl_dsi_bridge_mode_valid,
+ .attach = nwl_dsi_bridge_attach,
+ .detach = nwl_dsi_bridge_detach,
};
static int nwl_dsi_parse_dt(struct nwl_dsi *dsi)
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 010/266] drm/imx: Add 8 pixel alignment fix
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 009/266] drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be true Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 011/266] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() Greg Kroah-Hartman
` (259 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Sebastian Reichel,
Philipp Zabel, Sasha Levin
From: Sebastian Reichel <sebastian.reichel@collabora.com>
[ Upstream commit 94dfec48fca756cef90263a03e81f24dae24a5c6 ]
Some standard resolutions like 1366x768 do not work properly with
i.MX6 SoCs, since the horizontal resolution needs to be aligned
to 8 pixels (so 1360x768 or 1368x768 would work).
This patch allocates framebuffers allocated to 8 pixels. The extra
time required to send the extra pixels are removed from the blank
time. In order to expose the correct display size to userspace,
the stride is increased without increasing the width.
Without this patch systems with this display resolution hang
indefinitely during boot up.
Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20210428222953.235280-3-sebastian.reichel@collabora.com
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/imx/imx-drm-core.c | 19 ++++++++++++++++++-
drivers/gpu/drm/imx/imx-ldb.c | 5 +++++
drivers/gpu/drm/imx/ipuv3-crtc.c | 11 ++++++++++-
drivers/gpu/drm/imx/ipuv3-plane.c | 19 +++++++++++++++----
drivers/gpu/ipu-v3/ipu-dc.c | 5 +++++
drivers/gpu/ipu-v3/ipu-di.c | 7 +++++++
6 files changed, 60 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
index e6a88c8cbd69..8457b9788cda 100644
--- a/drivers/gpu/drm/imx/imx-drm-core.c
+++ b/drivers/gpu/drm/imx/imx-drm-core.c
@@ -145,9 +145,26 @@ static const struct drm_ioctl_desc imx_drm_ioctls[] = {
/* none so far */
};
+static int imx_drm_dumb_create(struct drm_file *file_priv,
+ struct drm_device *drm,
+ struct drm_mode_create_dumb *args)
+{
+ u32 width = args->width;
+ int ret;
+
+ args->width = ALIGN(width, 8);
+
+ ret = drm_gem_cma_dumb_create(file_priv, drm, args);
+ if (ret)
+ return ret;
+
+ args->width = width;
+ return ret;
+}
+
static const struct drm_driver imx_drm_driver = {
.driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_ATOMIC,
- DRM_GEM_CMA_DRIVER_OPS,
+ DRM_GEM_CMA_DRIVER_OPS_WITH_DUMB_CREATE(imx_drm_dumb_create),
.ioctls = imx_drm_ioctls,
.num_ioctls = ARRAY_SIZE(imx_drm_ioctls),
.fops = &imx_drm_driver_fops,
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index ffdc492c5bc5..53132ddf9587 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -274,6 +274,11 @@ imx_ldb_encoder_atomic_mode_set(struct drm_encoder *encoder,
"%s: mode exceeds 85 MHz pixel clock\n", __func__);
}
+ if (!IS_ALIGNED(mode->hdisplay, 8)) {
+ dev_warn(ldb->dev,
+ "%s: hdisplay does not align to 8 byte\n", __func__);
+ }
+
if (dual) {
serial_clk = 3500UL * mode->clock;
imx_ldb_set_clock(ldb, mux, 0, serial_clk, di_clk);
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index e6431a227feb..9c8829f945b2 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -305,10 +305,19 @@ static void ipu_crtc_mode_set_nofb(struct drm_crtc *crtc)
sig_cfg.vsync_pin = imx_crtc_state->di_vsync_pin;
drm_display_mode_to_videomode(mode, &sig_cfg.mode);
+ if (!IS_ALIGNED(sig_cfg.mode.hactive, 8)) {
+ unsigned int new_hactive = ALIGN(sig_cfg.mode.hactive, 8);
+
+ dev_warn(ipu_crtc->dev, "8-pixel align hactive %d -> %d\n",
+ sig_cfg.mode.hactive, new_hactive);
+
+ sig_cfg.mode.hfront_porch = new_hactive - sig_cfg.mode.hactive;
+ sig_cfg.mode.hactive = new_hactive;
+ }
ipu_dc_init_sync(ipu_crtc->dc, ipu_crtc->di,
mode->flags & DRM_MODE_FLAG_INTERLACE,
- imx_crtc_state->bus_format, mode->hdisplay);
+ imx_crtc_state->bus_format, sig_cfg.mode.hactive);
ipu_di_init_sync_panel(ipu_crtc->di, &sig_cfg);
}
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 233310712deb..886de0f80b4e 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -30,6 +30,11 @@ to_ipu_plane_state(struct drm_plane_state *p)
return container_of(p, struct ipu_plane_state, base);
}
+static unsigned int ipu_src_rect_width(const struct drm_plane_state *state)
+{
+ return ALIGN(drm_rect_width(&state->src) >> 16, 8);
+}
+
static inline struct ipu_plane *to_ipu_plane(struct drm_plane *p)
{
return container_of(p, struct ipu_plane, base);
@@ -441,6 +446,12 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
if (old_fb && fb->pitches[0] != old_fb->pitches[0])
crtc_state->mode_changed = true;
+ if (ALIGN(fb->width, 8) * fb->format->cpp[0] >
+ fb->pitches[0] + fb->offsets[0]) {
+ dev_warn(dev, "pitch is not big enough for 8 pixels alignment");
+ return -EINVAL;
+ }
+
switch (fb->format->format) {
case DRM_FORMAT_YUV420:
case DRM_FORMAT_YVU420:
@@ -616,7 +627,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
if (ipu_state->use_pre) {
axi_id = ipu_chan_assign_axi_id(ipu_plane->dma);
ipu_prg_channel_configure(ipu_plane->ipu_ch, axi_id,
- drm_rect_width(&new_state->src) >> 16,
+ ipu_src_rect_width(new_state),
drm_rect_height(&new_state->src) >> 16,
fb->pitches[0], fb->format->format,
fb->modifier, &eba);
@@ -649,9 +660,9 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
break;
}
- ipu_dmfc_config_wait4eot(ipu_plane->dmfc, drm_rect_width(dst));
+ ipu_dmfc_config_wait4eot(ipu_plane->dmfc, ALIGN(drm_rect_width(dst), 8));
- width = drm_rect_width(&new_state->src) >> 16;
+ width = ipu_src_rect_width(new_state);
height = drm_rect_height(&new_state->src) >> 16;
info = drm_format_info(fb->format->format);
ipu_calculate_bursts(width, info->cpp[0], fb->pitches[0],
@@ -716,7 +727,7 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
ipu_cpmem_zero(ipu_plane->alpha_ch);
ipu_cpmem_set_resolution(ipu_plane->alpha_ch,
- drm_rect_width(&new_state->src) >> 16,
+ ipu_src_rect_width(new_state),
drm_rect_height(&new_state->src) >> 16);
ipu_cpmem_set_format_passthrough(ipu_plane->alpha_ch, 8);
ipu_cpmem_set_high_priority(ipu_plane->alpha_ch);
diff --git a/drivers/gpu/ipu-v3/ipu-dc.c b/drivers/gpu/ipu-v3/ipu-dc.c
index 34b4075a6a8e..ca96b235491a 100644
--- a/drivers/gpu/ipu-v3/ipu-dc.c
+++ b/drivers/gpu/ipu-v3/ipu-dc.c
@@ -167,6 +167,11 @@ int ipu_dc_init_sync(struct ipu_dc *dc, struct ipu_di *di, bool interlaced,
dc->di = ipu_di_get_num(di);
+ if (!IS_ALIGNED(width, 8)) {
+ dev_warn(priv->dev,
+ "%s: hactive does not align to 8 byte\n", __func__);
+ }
+
map = ipu_bus_format_to_map(bus_format);
/*
diff --git a/drivers/gpu/ipu-v3/ipu-di.c b/drivers/gpu/ipu-v3/ipu-di.c
index e617f60afeea..666223c6bec4 100644
--- a/drivers/gpu/ipu-v3/ipu-di.c
+++ b/drivers/gpu/ipu-v3/ipu-di.c
@@ -506,6 +506,13 @@ int ipu_di_adjust_videomode(struct ipu_di *di, struct videomode *mode)
{
u32 diff;
+ if (!IS_ALIGNED(mode->hactive, 8) &&
+ mode->hfront_porch < ALIGN(mode->hactive, 8) - mode->hactive) {
+ dev_err(di->ipu->dev, "hactive %d is not aligned to 8 and front porch is too small to compensate\n",
+ mode->hactive);
+ return -EINVAL;
+ }
+
if (mode->vfront_porch >= 2)
return 0;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 011/266] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 010/266] drm/imx: Add 8 pixel alignment fix Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 012/266] drm/amdgpu: change the default timeout for kernel compute queues Greg Kroah-Hartman
` (258 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Andy Shevchenko,
Flavio Suligoi, David S. Miller, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 443ef39b499cc9c6635f83238101f1bb923e9326 ]
Sparse is not happy about handling of strict types in pch_ptp_match():
.../pch_gbe_main.c:158:33: warning: incorrect type in argument 2 (different base types)
.../pch_gbe_main.c:158:33: expected unsigned short [usertype] uid_hi
.../pch_gbe_main.c:158:33: got restricted __be16 [usertype]
.../pch_gbe_main.c:158:45: warning: incorrect type in argument 3 (different base types)
.../pch_gbe_main.c:158:45: expected unsigned int [usertype] uid_lo
.../pch_gbe_main.c:158:45: got restricted __be32 [usertype]
.../pch_gbe_main.c:158:56: warning: incorrect type in argument 4 (different base types)
.../pch_gbe_main.c:158:56: expected unsigned short [usertype] seqid
.../pch_gbe_main.c:158:56: got restricted __be16 [usertype]
Fix that by switching to use proper accessors to BE data.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Flavio Suligoi <f.suligoi@asem.it>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 19 ++++++-------------
1 file changed, 6 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 3dc29b282a88..45b9ba1ec760 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -108,7 +108,7 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid)
{
u8 *data = skb->data;
unsigned int offset;
- u16 *hi, *id;
+ u16 hi, id;
u32 lo;
if (ptp_classify_raw(skb) == PTP_CLASS_NONE)
@@ -119,14 +119,11 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid)
if (skb->len < offset + OFF_PTP_SEQUENCE_ID + sizeof(seqid))
return 0;
- hi = (u16 *)(data + offset + OFF_PTP_SOURCE_UUID);
- id = (u16 *)(data + offset + OFF_PTP_SEQUENCE_ID);
+ hi = get_unaligned_be16(data + offset + OFF_PTP_SOURCE_UUID + 0);
+ lo = get_unaligned_be32(data + offset + OFF_PTP_SOURCE_UUID + 2);
+ id = get_unaligned_be16(data + offset + OFF_PTP_SEQUENCE_ID);
- memcpy(&lo, &hi[1], sizeof(lo));
-
- return (uid_hi == *hi &&
- uid_lo == lo &&
- seqid == *id);
+ return (uid_hi == hi && uid_lo == lo && seqid == id);
}
static void
@@ -136,7 +133,6 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb)
struct pci_dev *pdev;
u64 ns;
u32 hi, lo, val;
- u16 uid, seq;
if (!adapter->hwts_rx_en)
return;
@@ -152,10 +148,7 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb)
lo = pch_src_uuid_lo_read(pdev);
hi = pch_src_uuid_hi_read(pdev);
- uid = hi & 0xffff;
- seq = (hi >> 16) & 0xffff;
-
- if (!pch_ptp_match(skb, htons(uid), htonl(lo), htons(seq)))
+ if (!pch_ptp_match(skb, hi, lo, hi >> 16))
goto out;
ns = pch_rx_snap_read(pdev);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 012/266] drm/amdgpu: change the default timeout for kernel compute queues
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 011/266] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 013/266] drm/amd/display: Fix clock table filling logic Greg Kroah-Hartman
` (257 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian König, Daniel Vetter,
Alex Deucher, Sasha Levin
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit 67387dfe0f6630f2d4f412ce77debec23a49db7a ]
Change to 60s. This matches what we already do in virtualization.
Infinite timeout can lead to deadlocks in the kernel.
Reviewed-by: Christian König <christian.koenig@amd.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 +++-----
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 ++--
2 files changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index f008f001951b..d83f2ee150b8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3181,8 +3181,8 @@ static int amdgpu_device_get_job_timeout_settings(struct amdgpu_device *adev)
int ret = 0;
/*
- * By default timeout for non compute jobs is 10000.
- * And there is no timeout enforced on compute jobs.
+ * By default timeout for non compute jobs is 10000
+ * and 60000 for compute jobs.
* In SR-IOV or passthrough mode, timeout for compute
* jobs are 60000 by default.
*/
@@ -3191,10 +3191,8 @@ static int amdgpu_device_get_job_timeout_settings(struct amdgpu_device *adev)
if (amdgpu_sriov_vf(adev))
adev->compute_timeout = amdgpu_sriov_is_pp_one_vf(adev) ?
msecs_to_jiffies(60000) : msecs_to_jiffies(10000);
- else if (amdgpu_passthrough(adev))
- adev->compute_timeout = msecs_to_jiffies(60000);
else
- adev->compute_timeout = MAX_SCHEDULE_TIMEOUT;
+ adev->compute_timeout = msecs_to_jiffies(60000);
if (strnlen(input, AMDGPU_MAX_TIMEOUT_PARAM_LENGTH)) {
while ((timeout_setting = strsep(&input, ",")) &&
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index f93883db2b46..57a055aa854d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -287,9 +287,9 @@ module_param_named(msi, amdgpu_msi, int, 0444);
* for SDMA and Video.
*
* By default(with no lockup_timeout settings), the timeout for all non-compute(GFX, SDMA and Video)
- * jobs is 10000. And there is no timeout enforced on compute jobs.
+ * jobs is 10000. The timeout for compute is 60000.
*/
-MODULE_PARM_DESC(lockup_timeout, "GPU lockup timeout in ms (default: for bare metal 10000 for non-compute jobs and infinity timeout for compute jobs; "
+MODULE_PARM_DESC(lockup_timeout, "GPU lockup timeout in ms (default: for bare metal 10000 for non-compute jobs and 60000 for compute jobs; "
"for passthrough or sriov, 10000 for all jobs."
" 0: keep default value. negative: infinity timeout), "
"format: for bare metal [Non-Compute] or [GFX,Compute,SDMA,Video]; "
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 013/266] drm/amd/display: Fix clock table filling logic
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 012/266] drm/amdgpu: change the default timeout for kernel compute queues Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 014/266] drm/amd/display: fix use_max_lb flag for 420 pixel formats Greg Kroah-Hartman
` (256 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilya Bakoulin, Dmytro Laktyushkin,
Stylon Wang, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Ilya Bakoulin <Ilya.Bakoulin@amd.com>
[ Upstream commit c31bef1cb1203b26f901a511a3246204cfaf8a57 ]
[Why]
Currently, the code that fills the clock table can miss filling
information about some of the higher voltage states advertised
by the SMU. This, in turn, may cause some of the higher pixel clock
modes (e.g. 8k60) to fail validation.
[How]
Fill the table with one entry per DCFCLK level instead of one entry
per FCLK level. This is needed because the maximum FCLK does not
necessarily need maximum voltage, whereas DCFCLK values from SMU
cover the full voltage range.
Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 80 ++++++++++++-------
.../drm/amd/display/dc/dcn21/dcn21_resource.c | 33 +++++---
2 files changed, 74 insertions(+), 39 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
index 49d19fdd750b..1f56ceab5922 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
@@ -834,46 +834,67 @@ static struct wm_table lpddr4_wm_table_rn = {
},
}
};
-static unsigned int find_socclk_for_voltage(struct dpm_clocks *clock_table, unsigned int voltage)
+
+static unsigned int find_max_fclk_for_voltage(struct dpm_clocks *clock_table,
+ unsigned int voltage)
{
int i;
+ uint32_t max_clk = 0;
- for (i = 0; i < PP_SMU_NUM_SOCCLK_DPM_LEVELS; i++) {
- if (clock_table->SocClocks[i].Vol == voltage)
- return clock_table->SocClocks[i].Freq;
+ for (i = 0; i < PP_SMU_NUM_FCLK_DPM_LEVELS; i++) {
+ if (clock_table->FClocks[i].Vol <= voltage) {
+ max_clk = clock_table->FClocks[i].Freq > max_clk ?
+ clock_table->FClocks[i].Freq : max_clk;
+ }
}
- ASSERT(0);
- return 0;
+ return max_clk;
}
-static unsigned int find_dcfclk_for_voltage(struct dpm_clocks *clock_table, unsigned int voltage)
+
+static unsigned int find_max_memclk_for_voltage(struct dpm_clocks *clock_table,
+ unsigned int voltage)
{
int i;
+ uint32_t max_clk = 0;
- for (i = 0; i < PP_SMU_NUM_DCFCLK_DPM_LEVELS; i++) {
- if (clock_table->DcfClocks[i].Vol == voltage)
- return clock_table->DcfClocks[i].Freq;
+ for (i = 0; i < PP_SMU_NUM_MEMCLK_DPM_LEVELS; i++) {
+ if (clock_table->MemClocks[i].Vol <= voltage) {
+ max_clk = clock_table->MemClocks[i].Freq > max_clk ?
+ clock_table->MemClocks[i].Freq : max_clk;
+ }
}
- ASSERT(0);
- return 0;
+ return max_clk;
+}
+
+static unsigned int find_max_socclk_for_voltage(struct dpm_clocks *clock_table,
+ unsigned int voltage)
+{
+ int i;
+ uint32_t max_clk = 0;
+
+ for (i = 0; i < PP_SMU_NUM_SOCCLK_DPM_LEVELS; i++) {
+ if (clock_table->SocClocks[i].Vol <= voltage) {
+ max_clk = clock_table->SocClocks[i].Freq > max_clk ?
+ clock_table->SocClocks[i].Freq : max_clk;
+ }
+ }
+
+ return max_clk;
}
static void rn_clk_mgr_helper_populate_bw_params(struct clk_bw_params *bw_params, struct dpm_clocks *clock_table, struct integrated_info *bios_info)
{
int i, j = 0;
+ unsigned int volt;
j = -1;
- ASSERT(PP_SMU_NUM_FCLK_DPM_LEVELS <= MAX_NUM_DPM_LVL);
-
- /* Find lowest DPM, FCLK is filled in reverse order*/
-
- for (i = PP_SMU_NUM_FCLK_DPM_LEVELS - 1; i >= 0; i--) {
- if (clock_table->FClocks[i].Freq != 0 && clock_table->FClocks[i].Vol != 0) {
+ /* Find max DPM */
+ for (i = 0; i < PP_SMU_NUM_DCFCLK_DPM_LEVELS; ++i) {
+ if (clock_table->DcfClocks[i].Freq != 0 &&
+ clock_table->DcfClocks[i].Vol != 0)
j = i;
- break;
- }
}
if (j == -1) {
@@ -884,13 +905,18 @@ static void rn_clk_mgr_helper_populate_bw_params(struct clk_bw_params *bw_params
bw_params->clk_table.num_entries = j + 1;
- for (i = 0; i < bw_params->clk_table.num_entries; i++, j--) {
- bw_params->clk_table.entries[i].fclk_mhz = clock_table->FClocks[j].Freq;
- bw_params->clk_table.entries[i].memclk_mhz = clock_table->MemClocks[j].Freq;
- bw_params->clk_table.entries[i].voltage = clock_table->FClocks[j].Vol;
- bw_params->clk_table.entries[i].dcfclk_mhz = find_dcfclk_for_voltage(clock_table, clock_table->FClocks[j].Vol);
- bw_params->clk_table.entries[i].socclk_mhz = find_socclk_for_voltage(clock_table,
- bw_params->clk_table.entries[i].voltage);
+ for (i = 0; i < bw_params->clk_table.num_entries; i++) {
+ volt = clock_table->DcfClocks[i].Vol;
+
+ bw_params->clk_table.entries[i].voltage = volt;
+ bw_params->clk_table.entries[i].dcfclk_mhz =
+ clock_table->DcfClocks[i].Freq;
+ bw_params->clk_table.entries[i].fclk_mhz =
+ find_max_fclk_for_voltage(clock_table, volt);
+ bw_params->clk_table.entries[i].memclk_mhz =
+ find_max_memclk_for_voltage(clock_table, volt);
+ bw_params->clk_table.entries[i].socclk_mhz =
+ find_max_socclk_for_voltage(clock_table, volt);
}
bw_params->vram_type = bios_info->memory_type;
diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
index 8e3f1d0b4cc3..38a2aa87f5f5 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
@@ -1575,10 +1575,12 @@ static struct _vcs_dpi_voltage_scaling_st construct_low_pstate_lvl(struct clk_li
low_pstate_lvl.phyclk_d18_mhz = dcn2_1_soc.clock_limits[high_voltage_lvl].phyclk_d18_mhz;
low_pstate_lvl.phyclk_mhz = dcn2_1_soc.clock_limits[high_voltage_lvl].phyclk_mhz;
- for (i = clk_table->num_entries; i > 1; i--)
- clk_table->entries[i] = clk_table->entries[i-1];
- clk_table->entries[1] = clk_table->entries[0];
- clk_table->num_entries++;
+ if (clk_table->num_entries < MAX_NUM_DPM_LVL) {
+ for (i = clk_table->num_entries; i > 1; i--)
+ clk_table->entries[i] = clk_table->entries[i-1];
+ clk_table->entries[1] = clk_table->entries[0];
+ clk_table->num_entries++;
+ }
return low_pstate_lvl;
}
@@ -1610,10 +1612,6 @@ static void update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param
}
}
- /* clk_table[1] is reserved for min DF PState. skip here to fill in later. */
- if (i == 1)
- k++;
-
clock_limits[k].state = k;
clock_limits[k].dcfclk_mhz = clk_table->entries[i].dcfclk_mhz;
clock_limits[k].fabricclk_mhz = clk_table->entries[i].fclk_mhz;
@@ -1630,14 +1628,25 @@ static void update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param
k++;
}
- for (i = 0; i < clk_table->num_entries + 1; i++)
- dcn2_1_soc.clock_limits[i] = clock_limits[i];
+
+ if (clk_table->num_entries >= MAX_NUM_DPM_LVL) {
+ for (i = 0; i < clk_table->num_entries + 1; i++)
+ dcn2_1_soc.clock_limits[i] = clock_limits[i];
+ } else {
+ dcn2_1_soc.clock_limits[0] = clock_limits[0];
+ for (i = 2; i < clk_table->num_entries + 1; i++) {
+ dcn2_1_soc.clock_limits[i] = clock_limits[i - 1];
+ dcn2_1_soc.clock_limits[i].state = i;
+ }
+ }
+
if (clk_table->num_entries) {
- dcn2_1_soc.num_states = clk_table->num_entries + 1;
/* fill in min DF PState */
dcn2_1_soc.clock_limits[1] = construct_low_pstate_lvl(clk_table, closest_clk_lvl);
+ dcn2_1_soc.num_states = clk_table->num_entries;
/* duplicate last level */
- dcn2_1_soc.clock_limits[dcn2_1_soc.num_states] = dcn2_1_soc.clock_limits[dcn2_1_soc.num_states - 1];
+ dcn2_1_soc.clock_limits[dcn2_1_soc.num_states] =
+ dcn2_1_soc.clock_limits[dcn2_1_soc.num_states - 1];
dcn2_1_soc.clock_limits[dcn2_1_soc.num_states].state = dcn2_1_soc.num_states;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 014/266] drm/amd/display: fix use_max_lb flag for 420 pixel formats
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 013/266] drm/amd/display: Fix clock table filling logic Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 015/266] clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe() Greg Kroah-Hartman
` (255 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmytro Laktyushkin, Aric Cyr,
Stylon Wang, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
[ Upstream commit 8809a7a4afe90ad9ffb42f72154d27e7c47551ae ]
Right now the flag simply selects memory config 0 when flag is true
however 420 modes benefit more from memory config 3.
Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
index efa86d5c6847..98ab4b776924 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
@@ -496,10 +496,13 @@ static enum lb_memory_config dpp1_dscl_find_lb_memory_config(struct dcn10_dpp *d
int vtaps_c = scl_data->taps.v_taps_c;
int ceil_vratio = dc_fixpt_ceil(scl_data->ratios.vert);
int ceil_vratio_c = dc_fixpt_ceil(scl_data->ratios.vert_c);
- enum lb_memory_config mem_cfg = LB_MEMORY_CONFIG_0;
- if (dpp->base.ctx->dc->debug.use_max_lb)
- return mem_cfg;
+ if (dpp->base.ctx->dc->debug.use_max_lb) {
+ if (scl_data->format == PIXEL_FORMAT_420BPP8
+ || scl_data->format == PIXEL_FORMAT_420BPP10)
+ return LB_MEMORY_CONFIG_3;
+ return LB_MEMORY_CONFIG_0;
+ }
dpp->base.caps->dscl_calc_lb_num_partitions(
scl_data, LB_MEMORY_CONFIG_1, &num_part_y, &num_part_c);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 015/266] clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 014/266] drm/amd/display: fix use_max_lb flag for 420 pixel formats Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 016/266] MIPS: Loongson64: Fix build error secondary_kexec_args undeclared under !SMP Greg Kroah-Hartman
` (254 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Geert Uytterhoeven, Sasha Levin
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit a20a40a8bbc2cf4b29d7248ea31e974e9103dd7f ]
The error handling paths after pm_runtime_get_sync() have no refcount
decrement, which leads to refcount leak.
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Link: https://lore.kernel.org/r/20210415073338.22287-1-dinghao.liu@zju.edu.cn
[geert: Remove now unused variable priv]
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/rcar-usb2-clock-sel.c | 24 ++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/drivers/clk/renesas/rcar-usb2-clock-sel.c b/drivers/clk/renesas/rcar-usb2-clock-sel.c
index 34a85dc95beb..9fb79bd79435 100644
--- a/drivers/clk/renesas/rcar-usb2-clock-sel.c
+++ b/drivers/clk/renesas/rcar-usb2-clock-sel.c
@@ -128,10 +128,8 @@ static int rcar_usb2_clock_sel_resume(struct device *dev)
static int rcar_usb2_clock_sel_remove(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
- struct usb2_clock_sel_priv *priv = platform_get_drvdata(pdev);
of_clk_del_provider(dev->of_node);
- clk_hw_unregister(&priv->hw);
pm_runtime_put(dev);
pm_runtime_disable(dev);
@@ -164,9 +162,6 @@ static int rcar_usb2_clock_sel_probe(struct platform_device *pdev)
if (IS_ERR(priv->rsts))
return PTR_ERR(priv->rsts);
- pm_runtime_enable(dev);
- pm_runtime_get_sync(dev);
-
clk = devm_clk_get(dev, "usb_extal");
if (!IS_ERR(clk) && !clk_prepare_enable(clk)) {
priv->extal = !!clk_get_rate(clk);
@@ -183,6 +178,8 @@ static int rcar_usb2_clock_sel_probe(struct platform_device *pdev)
return -ENOENT;
}
+ pm_runtime_enable(dev);
+ pm_runtime_get_sync(dev);
platform_set_drvdata(pdev, priv);
dev_set_drvdata(dev, priv);
@@ -190,11 +187,20 @@ static int rcar_usb2_clock_sel_probe(struct platform_device *pdev)
init.ops = &usb2_clock_sel_clock_ops;
priv->hw.init = &init;
- clk = clk_register(NULL, &priv->hw);
- if (IS_ERR(clk))
- return PTR_ERR(clk);
+ ret = devm_clk_hw_register(NULL, &priv->hw);
+ if (ret)
+ goto pm_put;
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_simple_get, &priv->hw);
+ if (ret)
+ goto pm_put;
+
+ return 0;
- return of_clk_add_hw_provider(np, of_clk_hw_simple_get, &priv->hw);
+pm_put:
+ pm_runtime_put(dev);
+ pm_runtime_disable(dev);
+ return ret;
}
static const struct dev_pm_ops rcar_usb2_clock_sel_pm_ops = {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 016/266] MIPS: Loongson64: Fix build error secondary_kexec_args undeclared under !SMP
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 015/266] clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 017/266] hugetlb: clear huge pte during flush function on mips platform Greg Kroah-Hartman
` (253 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Youling Tang,
Randy Dunlap, Thomas Bogendoerfer, Sasha Levin
From: Youling Tang <tangyouling@loongson.cn>
[ Upstream commit 6a73022ee3fdf7e60f2ba0a3a835dd421c05b5b5 ]
On the Loongson64 platform, if CONFIG_SMP is not set, the following build
error will occur:
arch/mips/loongson64/reset.c:133:2: error:'secondary_kexec_args' undeclared
Because the definition and declaration of secondary_kexec_args are in the
CONFIG_SMP, the secondary_kexec_args variable should be used in CONFIG_SMP.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Youling Tang <tangyouling@loongson.cn>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/loongson64/reset.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/mips/loongson64/reset.c b/arch/mips/loongson64/reset.c
index c97bfdc8c922..758d5d26aaaa 100644
--- a/arch/mips/loongson64/reset.c
+++ b/arch/mips/loongson64/reset.c
@@ -126,11 +126,12 @@ static void loongson_kexec_shutdown(void)
for_each_possible_cpu(cpu)
if (!cpu_online(cpu))
cpu_device_up(get_cpu_device(cpu));
+
+ secondary_kexec_args[0] = TO_UNCAC(0x3ff01000);
#endif
kexec_args[0] = kexec_argc;
kexec_args[1] = fw_arg1;
kexec_args[2] = fw_arg2;
- secondary_kexec_args[0] = TO_UNCAC(0x3ff01000);
memcpy((void *)fw_arg1, kexec_argv, KEXEC_ARGV_SIZE);
memcpy((void *)fw_arg2, kexec_envp, KEXEC_ENVP_SIZE);
}
@@ -141,7 +142,9 @@ static void loongson_crash_shutdown(struct pt_regs *regs)
kexec_args[0] = kdump_argc;
kexec_args[1] = fw_arg1;
kexec_args[2] = fw_arg2;
+#ifdef CONFIG_SMP
secondary_kexec_args[0] = TO_UNCAC(0x3ff01000);
+#endif
memcpy((void *)fw_arg1, kdump_argv, KEXEC_ARGV_SIZE);
memcpy((void *)fw_arg2, kexec_envp, KEXEC_ENVP_SIZE);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 017/266] hugetlb: clear huge pte during flush function on mips platform
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 016/266] MIPS: Loongson64: Fix build error secondary_kexec_args undeclared under !SMP Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 018/266] atm: iphase: fix possible use-after-free in ia_module_exit() Greg Kroah-Hartman
` (252 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bibo Mao, Thomas Bogendoerfer, Sasha Levin
From: Bibo Mao <maobibo@loongson.cn>
[ Upstream commit 33ae8f801ad8bec48e886d368739feb2816478f2 ]
If multiple threads are accessing the same huge page at the same
time, hugetlb_cow will be called if one thread write the COW huge
page. And function huge_ptep_clear_flush is called to notify other
threads to clear the huge pte tlb entry. The other threads clear
the huge pte tlb entry and reload it from page table, the reload
huge pte entry may be old.
This patch fixes this issue on mips platform, and it clears huge
pte entry before notifying other threads to flush current huge
page entry, it is similar with other architectures.
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/asm/hugetlb.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/mips/include/asm/hugetlb.h b/arch/mips/include/asm/hugetlb.h
index 10e3be870df7..c2144409c0c4 100644
--- a/arch/mips/include/asm/hugetlb.h
+++ b/arch/mips/include/asm/hugetlb.h
@@ -46,7 +46,13 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
unsigned long addr, pte_t *ptep)
{
- flush_tlb_page(vma, addr & huge_page_mask(hstate_vma(vma)));
+ /*
+ * clear the huge pte entry firstly, so that the other smp threads will
+ * not get old pte entry after finishing flush_tlb_page and before
+ * setting new huge pte entry
+ */
+ huge_ptep_get_and_clear(vma->vm_mm, addr, ptep);
+ flush_tlb_page(vma, addr);
}
#define __HAVE_ARCH_HUGE_PTE_NONE
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 018/266] atm: iphase: fix possible use-after-free in ia_module_exit()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 017/266] hugetlb: clear huge pte during flush function on mips platform Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 019/266] mISDN: fix possible use-after-free in HFC_cleanup() Greg Kroah-Hartman
` (251 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zou Wei, David S. Miller,
Sasha Levin
From: Zou Wei <zou_wei@huawei.com>
[ Upstream commit 1c72e6ab66b9598cac741ed397438a52065a8f1f ]
This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.
Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/atm/iphase.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 933e3ff2ee8d..3f2ebfb06afd 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -3279,7 +3279,7 @@ static void __exit ia_module_exit(void)
{
pci_unregister_driver(&ia_driver);
- del_timer(&ia_timer);
+ del_timer_sync(&ia_timer);
}
module_init(ia_module_init);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 019/266] mISDN: fix possible use-after-free in HFC_cleanup()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 018/266] atm: iphase: fix possible use-after-free in ia_module_exit() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 020/266] atm: nicstar: Fix possible use-after-free in nicstar_cleanup() Greg Kroah-Hartman
` (250 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zou Wei, David S. Miller,
Sasha Levin
From: Zou Wei <zou_wei@huawei.com>
[ Upstream commit 009fc857c5f6fda81f2f7dd851b2d54193a8e733 ]
This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.
Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/isdn/hardware/mISDN/hfcpci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index 56bd2e9db6ed..e501cb03f211 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -2342,7 +2342,7 @@ static void __exit
HFC_cleanup(void)
{
if (timer_pending(&hfc_tl))
- del_timer(&hfc_tl);
+ del_timer_sync(&hfc_tl);
pci_unregister_driver(&hfc_driver);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 020/266] atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 019/266] mISDN: fix possible use-after-free in HFC_cleanup() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 021/266] net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT Greg Kroah-Hartman
` (249 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zou Wei, David S. Miller,
Sasha Levin
From: Zou Wei <zou_wei@huawei.com>
[ Upstream commit 34e7434ba4e97f4b85c1423a59b2922ba7dff2ea ]
This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.
Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/atm/nicstar.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 5c7e4df159b9..b015c3e14336 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -299,7 +299,7 @@ static void __exit nicstar_cleanup(void)
{
XPRINTK("nicstar: nicstar_cleanup() called.\n");
- del_timer(&ns_timer);
+ del_timer_sync(&ns_timer);
pci_unregister_driver(&nicstar_driver);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 021/266] net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 020/266] atm: nicstar: Fix possible use-after-free in nicstar_cleanup() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 022/266] drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init() Greg Kroah-Hartman
` (248 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Juri Lelli,
Sebastian Andrzej Siewior, Thomas Gleixner, David S. Miller,
Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 8380c81d5c4fced6f4397795a5ae65758272bbfd ]
__napi_schedule_irqoff() is an optimized version of __napi_schedule()
which can be used where it is known that interrupts are disabled,
e.g. in interrupt-handlers, spin_lock_irq() sections or hrtimer
callbacks.
On PREEMPT_RT enabled kernels this assumptions is not true. Force-
threaded interrupt handlers and spinlocks are not disabling interrupts
and the NAPI hrtimer callback is forced into softirq context which runs
with interrupts enabled as well.
Chasing all usage sites of __napi_schedule_irqoff() is a whack-a-mole
game so make __napi_schedule_irqoff() invoke __napi_schedule() for
PREEMPT_RT kernels.
The callers of ____napi_schedule() in the networking core have been
audited and are correct on PREEMPT_RT kernels as well.
Reported-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/dev.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index ef8cf7619baf..50531a2d0b20 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6520,11 +6520,18 @@ EXPORT_SYMBOL(napi_schedule_prep);
* __napi_schedule_irqoff - schedule for receive
* @n: entry to schedule
*
- * Variant of __napi_schedule() assuming hard irqs are masked
+ * Variant of __napi_schedule() assuming hard irqs are masked.
+ *
+ * On PREEMPT_RT enabled kernels this maps to __napi_schedule()
+ * because the interrupt disabled assumption might not be true
+ * due to force-threaded interrupts and spinlock substitution.
*/
void __napi_schedule_irqoff(struct napi_struct *n)
{
- ____napi_schedule(this_cpu_ptr(&softnet_data), n);
+ if (!IS_ENABLED(CONFIG_PREEMPT_RT))
+ ____napi_schedule(this_cpu_ptr(&softnet_data), n);
+ else
+ __napi_schedule(n);
}
EXPORT_SYMBOL(__napi_schedule_irqoff);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 022/266] drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 021/266] net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 023/266] drm/panfrost: devfreq: Disable devfreq when num_supplies > 1 Greg Kroah-Hartman
` (247 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Li, Chun-Kuang Hu,
Sasha Levin
From: Wang Li <wangli74@huawei.com>
[ Upstream commit 69777e6ca396f0a7e1baff40fcad4a9d3d445b7a ]
pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in reference leak here.
Fix it by replacing it with pm_runtime_resume_and_get to keep usage
counter balanced.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Li <wangli74@huawei.com>
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index 40df2c823187..474efb844249 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -260,7 +260,7 @@ static int mtk_crtc_ddp_hw_init(struct mtk_drm_crtc *mtk_crtc)
drm_connector_list_iter_end(&conn_iter);
}
- ret = pm_runtime_get_sync(crtc->dev->dev);
+ ret = pm_runtime_resume_and_get(crtc->dev->dev);
if (ret < 0) {
DRM_ERROR("Failed to enable power domain: %d\n", ret);
return ret;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 023/266] drm/panfrost: devfreq: Disable devfreq when num_supplies > 1
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 022/266] drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 024/266] net: mdio: ipq8064: add regmap config to disable REGCACHE Greg Kroah-Hartman
` (246 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolas Boichat, Tomeu Vizoso,
Steven Price, Sasha Levin
From: Nicolas Boichat <drinkcat@chromium.org>
[ Upstream commit 09da3191827f2fd326205fb58881838e6ea36fb7 ]
GPUs with more than a single regulator (e.g. G72 on MT8183) will
require platform-specific handling for devfreq, for 2 reasons:
1. The opp core (drivers/opp/core.c:_generic_set_opp_regulator)
does not support multiple regulators, so we'll need custom
handlers.
2. Generally, platforms with 2 regulators have platform-specific
constraints on how the voltages should be set (e.g.
minimum/maximum voltage difference between them), so we
should not just create generic handlers that simply
change the voltages without taking care of those constraints.
Disable devfreq for now on those GPUs.
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210421132841.v13.3.I3af068abe30c9c85cabc4486385c52e56527a509@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panfrost/panfrost_devfreq.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/gpu/drm/panfrost/panfrost_devfreq.c b/drivers/gpu/drm/panfrost/panfrost_devfreq.c
index 47d27e54a34f..3644652f726f 100644
--- a/drivers/gpu/drm/panfrost/panfrost_devfreq.c
+++ b/drivers/gpu/drm/panfrost/panfrost_devfreq.c
@@ -92,6 +92,15 @@ int panfrost_devfreq_init(struct panfrost_device *pfdev)
struct thermal_cooling_device *cooling;
struct panfrost_devfreq *pfdevfreq = &pfdev->pfdevfreq;
+ if (pfdev->comp->num_supplies > 1) {
+ /*
+ * GPUs with more than 1 supply require platform-specific handling:
+ * continue without devfreq
+ */
+ DRM_DEV_INFO(dev, "More than 1 supply is not supported yet\n");
+ return 0;
+ }
+
ret = devm_pm_opp_set_regulators(dev, pfdev->comp->supply_names,
pfdev->comp->num_supplies);
if (ret) {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 024/266] net: mdio: ipq8064: add regmap config to disable REGCACHE
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 023/266] drm/panfrost: devfreq: Disable devfreq when num_supplies > 1 Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 025/266] drm/bridge: lt9611: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
` (245 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ansuel Smith, Florian Fainelli,
David S. Miller, Sasha Levin
From: Ansuel Smith <ansuelsmth@gmail.com>
[ Upstream commit b097bea10215315e8ee17f88b4c1bbb521b1878c ]
mdio drivers should not use REGCHACHE. Also disable locking since it's
handled by the mdio users and regmap is always accessed atomically.
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/mdio/mdio-ipq8064.c | 34 +++++++++++++++++++++++----------
1 file changed, 24 insertions(+), 10 deletions(-)
diff --git a/drivers/net/mdio/mdio-ipq8064.c b/drivers/net/mdio/mdio-ipq8064.c
index 8fe8f0119fc1..8de11f35ac1e 100644
--- a/drivers/net/mdio/mdio-ipq8064.c
+++ b/drivers/net/mdio/mdio-ipq8064.c
@@ -7,10 +7,9 @@
#include <linux/delay.h>
#include <linux/kernel.h>
-#include <linux/mfd/syscon.h>
#include <linux/module.h>
#include <linux/of_mdio.h>
-#include <linux/phy.h>
+#include <linux/of_address.h>
#include <linux/platform_device.h>
#include <linux/regmap.h>
@@ -96,14 +95,34 @@ ipq8064_mdio_write(struct mii_bus *bus, int phy_addr, int reg_offset, u16 data)
return ipq8064_mdio_wait_busy(priv);
}
+static const struct regmap_config ipq8064_mdio_regmap_config = {
+ .reg_bits = 32,
+ .reg_stride = 4,
+ .val_bits = 32,
+ .can_multi_write = false,
+ /* the mdio lock is used by any user of this mdio driver */
+ .disable_locking = true,
+
+ .cache_type = REGCACHE_NONE,
+};
+
static int
ipq8064_mdio_probe(struct platform_device *pdev)
{
struct device_node *np = pdev->dev.of_node;
struct ipq8064_mdio *priv;
+ struct resource res;
struct mii_bus *bus;
+ void __iomem *base;
int ret;
+ if (of_address_to_resource(np, 0, &res))
+ return -ENOMEM;
+
+ base = ioremap(res.start, resource_size(&res));
+ if (!base)
+ return -ENOMEM;
+
bus = devm_mdiobus_alloc_size(&pdev->dev, sizeof(*priv));
if (!bus)
return -ENOMEM;
@@ -115,15 +134,10 @@ ipq8064_mdio_probe(struct platform_device *pdev)
bus->parent = &pdev->dev;
priv = bus->priv;
- priv->base = device_node_to_regmap(np);
- if (IS_ERR(priv->base)) {
- if (priv->base == ERR_PTR(-EPROBE_DEFER))
- return -EPROBE_DEFER;
-
- dev_err(&pdev->dev, "error getting device regmap, error=%pe\n",
- priv->base);
+ priv->base = devm_regmap_init_mmio(&pdev->dev, base,
+ &ipq8064_mdio_regmap_config);
+ if (IS_ERR(priv->base))
return PTR_ERR(priv->base);
- }
ret = of_mdiobus_register(bus, np);
if (ret)
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 025/266] drm/bridge: lt9611: Add missing MODULE_DEVICE_TABLE
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 024/266] net: mdio: ipq8064: add regmap config to disable REGCACHE Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 026/266] reiserfs: add check for invalid 1st journal block Greg Kroah-Hartman
` (244 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zou Wei, Robert Foss,
Sasha Levin
From: Zou Wei <zou_wei@huawei.com>
[ Upstream commit 8d0b1fe81e18eb66a2d4406386760795fe0d77d9 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1620801955-19188-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/lontium-lt9611.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index e8eb8deb444b..29b1ce2140ab 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -1215,6 +1215,7 @@ static struct i2c_device_id lt9611_id[] = {
{ "lontium,lt9611", 0 },
{}
};
+MODULE_DEVICE_TABLE(i2c, lt9611_id);
static const struct of_device_id lt9611_match_table[] = {
{ .compatible = "lontium,lt9611" },
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 026/266] reiserfs: add check for invalid 1st journal block
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 025/266] drm/bridge: lt9611: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 027/266] drm/virtio: Fix double free on probe failure Greg Kroah-Hartman
` (243 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+0ba9909df31c6a36974d,
Pavel Skripkin, Jan Kara, Sasha Levin
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit a149127be52fa7eaf5b3681a0317a2bbb772d5a9 ]
syzbot reported divide error in reiserfs.
The problem was in incorrect journal 1st block.
Syzbot's reproducer manualy generated wrong superblock
with incorrect 1st block. In journal_init() wasn't
any checks about this particular case.
For example, if 1st journal block is before superblock
1st block, it can cause zeroing important superblock members
in do_journal_end().
Link: https://lore.kernel.org/r/20210517121545.29645-1-paskripkin@gmail.com
Reported-by: syzbot+0ba9909df31c6a36974d@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/reiserfs/journal.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 9edc8e2b154e..0834b101c316 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2758,6 +2758,20 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
goto free_and_return;
}
+ /*
+ * Sanity check to see if journal first block is correct.
+ * If journal first block is invalid it can cause
+ * zeroing important superblock members.
+ */
+ if (!SB_ONDISK_JOURNAL_DEVICE(sb) &&
+ SB_ONDISK_JOURNAL_1st_BLOCK(sb) < SB_JOURNAL_1st_RESERVED_BLOCK(sb)) {
+ reiserfs_warning(sb, "journal-1393",
+ "journal 1st super block is invalid: 1st reserved block %d, but actual 1st block is %d",
+ SB_JOURNAL_1st_RESERVED_BLOCK(sb),
+ SB_ONDISK_JOURNAL_1st_BLOCK(sb));
+ goto free_and_return;
+ }
+
if (journal_init_dev(sb, journal, j_dev_name) != 0) {
reiserfs_warning(sb, "sh-462",
"unable to initialize journal device");
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 027/266] drm/virtio: Fix double free on probe failure
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 026/266] reiserfs: add check for invalid 1st journal block Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 028/266] net: mdio: provide shim implementation of devm_of_mdiobus_register Greg Kroah-Hartman
` (242 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xie Yongji, Gerd Hoffmann, Sasha Levin
From: Xie Yongji <xieyongji@bytedance.com>
[ Upstream commit cec7f1774605a5ef47c134af62afe7c75c30b0ee ]
The virtio_gpu_init() will free vgdev and vgdev->vbufs on failure.
But such failure will be caught by virtio_gpu_probe() and then
virtio_gpu_release() will be called to do some cleanup which
will free vgdev and vgdev->vbufs again. So let's set dev->dev_private
to NULL to avoid double free.
Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210517084913.403-2-xieyongji@bytedance.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/virtio/virtgpu_kms.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index b375394193be..37a21a88d674 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -234,6 +234,7 @@ err_scanouts:
err_vbufs:
vgdev->vdev->config->del_vqs(vgdev->vdev);
err_vqs:
+ dev->dev_private = NULL;
kfree(vgdev);
return ret;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 028/266] net: mdio: provide shim implementation of devm_of_mdiobus_register
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 027/266] drm/virtio: Fix double free on probe failure Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 029/266] net/sched: cls_api: increase max_reclassify_loop Greg Kroah-Hartman
` (241 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Vladimir Oltean,
Andrew Lunn, Florian Fainelli, David S. Miller, Sasha Levin
From: Vladimir Oltean <olteanv@gmail.com>
[ Upstream commit 86544c3de6a2185409c5a3d02f674ea223a14217 ]
Similar to the way in which of_mdiobus_register() has a fallback to the
non-DT based mdiobus_register() when CONFIG_OF is not set, we can create
a shim for the device-managed devm_of_mdiobus_register() which calls
devm_mdiobus_register() and discards the struct device_node *.
In particular, this solves a build issue with the qca8k DSA driver which
uses devm_of_mdiobus_register and can be compiled without CONFIG_OF.
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/of_mdio.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index 2b05e7f7c238..da633d34ab86 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -72,6 +72,13 @@ static inline int of_mdiobus_register(struct mii_bus *mdio, struct device_node *
return mdiobus_register(mdio);
}
+static inline int devm_of_mdiobus_register(struct device *dev,
+ struct mii_bus *mdio,
+ struct device_node *np)
+{
+ return devm_mdiobus_register(dev, mdio);
+}
+
static inline struct mdio_device *of_mdio_find_device(struct device_node *np)
{
return NULL;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 029/266] net/sched: cls_api: increase max_reclassify_loop
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 028/266] net: mdio: provide shim implementation of devm_of_mdiobus_register Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 030/266] net: ethernet: ixp4xx: Fix return value check in ixp4xx_eth_probe() Greg Kroah-Hartman
` (240 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Davide Caratti, David S. Miller, Sasha Levin
From: Davide Caratti <dcaratti@redhat.com>
[ Upstream commit 05ff8435e50569a0a6b95e5ceaea43696e8827ab ]
modern userspace applications, like OVN, can configure the TC datapath to
"recirculate" packets several times. If more than 4 "recirculation" rules
are configured, packets can be dropped by __tcf_classify().
Changing the maximum number of reclassifications (from 4 to 16) should be
sufficient to prevent drops in most use cases, and guard against loops at
the same time.
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_api.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 279f9e2a2319..d73b5c5514a9 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1531,7 +1531,7 @@ static inline int __tcf_classify(struct sk_buff *skb,
u32 *last_executed_chain)
{
#ifdef CONFIG_NET_CLS_ACT
- const int max_reclassify_loop = 4;
+ const int max_reclassify_loop = 16;
const struct tcf_proto *first_tp;
int limit = 0;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 030/266] net: ethernet: ixp4xx: Fix return value check in ixp4xx_eth_probe()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 029/266] net/sched: cls_api: increase max_reclassify_loop Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 031/266] pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
` (239 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun,
David S. Miller, Sasha Levin
From: Wei Yongjun <weiyongjun1@huawei.com>
[ Upstream commit 20e76d3d044d936998617f8acd7e77bebd9ca703 ]
In case of error, the function mdiobus_get_phy() returns NULL
pointer not ERR_PTR(). The IS_ERR() test in the return value
check should be replaced with NULL test.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/xscale/ixp4xx_eth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index cb89323855d8..1ecceeb9700d 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -1531,8 +1531,8 @@ static int ixp4xx_eth_probe(struct platform_device *pdev)
phydev = of_phy_get_and_connect(ndev, np, ixp4xx_adjust_link);
} else {
phydev = mdiobus_get_phy(mdio_bus, plat->phy);
- if (IS_ERR(phydev)) {
- err = PTR_ERR(phydev);
+ if (!phydev) {
+ err = -ENODEV;
dev_err(dev, "could not connect phydev (%d)\n", err);
goto err_free_mem;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 031/266] pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 030/266] net: ethernet: ixp4xx: Fix return value check in ixp4xx_eth_probe() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 032/266] drm/scheduler: Fix hang when sched_entity released Greg Kroah-Hartman
` (238 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Bixuan Cui,
Linus Walleij, Sasha Levin
From: Bixuan Cui <cuibixuan@huawei.com>
[ Upstream commit d7f444499d6faf9a6ae3b27ec094109528d2b9a7 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Bixuan Cui <cuibixuan@huawei.com>
Link: https://lore.kernel.org/r/20210508031502.53637-1-cuibixuan@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-equilibrium.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pinctrl/pinctrl-equilibrium.c b/drivers/pinctrl/pinctrl-equilibrium.c
index a194d8089b6f..38cc20fa9d5a 100644
--- a/drivers/pinctrl/pinctrl-equilibrium.c
+++ b/drivers/pinctrl/pinctrl-equilibrium.c
@@ -939,6 +939,7 @@ static const struct of_device_id eqbr_pinctrl_dt_match[] = {
{ .compatible = "intel,lgm-io" },
{}
};
+MODULE_DEVICE_TABLE(of, eqbr_pinctrl_dt_match);
static struct platform_driver eqbr_pinctrl_driver = {
.probe = eqbr_pinctrl_probe,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 032/266] drm/scheduler: Fix hang when sched_entity released
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 031/266] pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 033/266] drm/sched: Avoid data corruptions Greg Kroah-Hartman
` (237 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Grodzovsky,
Christian König, Sasha Levin
From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
[ Upstream commit c61cdbdbffc169dc7f1e6fe94dfffaf574fe672a ]
Problem: If scheduler is already stopped by the time sched_entity
is released and entity's job_queue not empty I encountred
a hang in drm_sched_entity_flush. This is because drm_sched_entity_is_idle
never becomes false.
Fix: In drm_sched_fini detach all sched_entities from the
scheduler's run queues. This will satisfy drm_sched_entity_is_idle.
Also wakeup all those processes stuck in sched_entity flushing
as the scheduler main thread which wakes them up is stopped by now.
v2:
Reverse order of drm_sched_rq_remove_entity and marking
s_entity as stopped to prevent reinserion back to rq due
to race.
v3:
Drop drm_sched_rq_remove_entity, only modify entity->stopped
and check for it in drm_sched_entity_is_idle
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210512142648.666476-14-andrey.grodzovsky@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/scheduler/sched_entity.c | 3 ++-
drivers/gpu/drm/scheduler/sched_main.c | 24 ++++++++++++++++++++++++
2 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index f0790e9471d1..cb58f692dad9 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -116,7 +116,8 @@ static bool drm_sched_entity_is_idle(struct drm_sched_entity *entity)
rmb(); /* for list_empty to work without lock */
if (list_empty(&entity->list) ||
- spsc_queue_count(&entity->job_queue) == 0)
+ spsc_queue_count(&entity->job_queue) == 0 ||
+ entity->stopped)
return true;
return false;
diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 92d8de24d0a1..c105c807d7e5 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -888,9 +888,33 @@ EXPORT_SYMBOL(drm_sched_init);
*/
void drm_sched_fini(struct drm_gpu_scheduler *sched)
{
+ struct drm_sched_entity *s_entity;
+ int i;
+
if (sched->thread)
kthread_stop(sched->thread);
+ for (i = DRM_SCHED_PRIORITY_COUNT - 1; i >= DRM_SCHED_PRIORITY_MIN; i--) {
+ struct drm_sched_rq *rq = &sched->sched_rq[i];
+
+ if (!rq)
+ continue;
+
+ spin_lock(&rq->lock);
+ list_for_each_entry(s_entity, &rq->entities, list)
+ /*
+ * Prevents reinsertion and marks job_queue as idle,
+ * it will removed from rq in drm_sched_entity_fini
+ * eventually
+ */
+ s_entity->stopped = true;
+ spin_unlock(&rq->lock);
+
+ }
+
+ /* Wakeup everyone stuck in drm_sched_entity_flush for this scheduler */
+ wake_up_all(&sched->job_scheduled);
+
/* Confirm no work left behind accessing device structures */
cancel_delayed_work_sync(&sched->work_tdr);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 033/266] drm/sched: Avoid data corruptions
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 032/266] drm/scheduler: Fix hang when sched_entity released Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 034/266] udf: Fix NULL pointer dereference in udf_symlink function Greg Kroah-Hartman
` (236 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Grodzovsky,
Christian König, Sasha Levin
From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
[ Upstream commit 0b10ab80695d61422337ede6ff496552d8ace99d ]
Wait for all dependencies of a job to complete before
killing it to avoid data corruptions.
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210519141407.88444-1-andrey.grodzovsky@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/scheduler/sched_entity.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
index cb58f692dad9..86a4209d8c77 100644
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@@ -222,11 +222,16 @@ static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f,
static void drm_sched_entity_kill_jobs(struct drm_sched_entity *entity)
{
struct drm_sched_job *job;
+ struct dma_fence *f;
int r;
while ((job = to_drm_sched_job(spsc_queue_pop(&entity->job_queue)))) {
struct drm_sched_fence *s_fence = job->s_fence;
+ /* Wait for all dependencies to avoid data corruptions */
+ while ((f = job->sched->ops->dependency(job, entity)))
+ dma_fence_wait(f, false);
+
drm_sched_fence_scheduled(s_fence);
dma_fence_set_error(&s_fence->finished, -ESRCH);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 034/266] udf: Fix NULL pointer dereference in udf_symlink function
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 033/266] drm/sched: Avoid data corruptions Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 035/266] net: xilinx_emaclite: Do not print real IOMEM pointer Greg Kroah-Hartman
` (235 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arturo Giusti, Jan Kara, Sasha Levin
From: Arturo Giusti <koredump@protonmail.com>
[ Upstream commit fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43 ]
In function udf_symlink, epos.bh is assigned with the value returned
by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c
and returns the value of sb_getblk function that could be NULL.
Then, epos.bh is used without any check, causing a possible
NULL pointer dereference when sb_getblk fails.
This fix adds a check to validate the value of epos.bh.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=213083
Signed-off-by: Arturo Giusti <koredump@protonmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/namei.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index 3ae9f1e91984..7c7c9bbbfa57 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -934,6 +934,10 @@ static int udf_symlink(struct user_namespace *mnt_userns, struct inode *dir,
iinfo->i_location.partitionReferenceNum,
0);
epos.bh = udf_tgetblk(sb, block);
+ if (unlikely(!epos.bh)) {
+ err = -ENOMEM;
+ goto out_no_entry;
+ }
lock_buffer(epos.bh);
memset(epos.bh->b_data, 0x00, bsize);
set_buffer_uptodate(epos.bh);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 035/266] net: xilinx_emaclite: Do not print real IOMEM pointer
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 034/266] udf: Fix NULL pointer dereference in udf_symlink function Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 036/266] drm/amd/pm: fix return value in aldebaran_set_mp1_state() Greg Kroah-Hartman
` (234 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, YueHaibing, David S. Miller, Sasha Levin
From: YueHaibing <yuehaibing@huawei.com>
[ Upstream commit d0d62baa7f505bd4c59cd169692ff07ec49dde37 ]
Printing kernel pointers is discouraged because they might leak kernel
memory layout. This fixes smatch warning:
drivers/net/ethernet/xilinx/xilinx_emaclite.c:1191 xemaclite_of_probe() warn:
argument 4 to %08lX specifier is cast from pointer
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/xilinx/xilinx_emaclite.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index d9d58a7dabee..b06377fe7293 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1189,9 +1189,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
}
dev_info(dev,
- "Xilinx EmacLite at 0x%08lX mapped to 0x%08lX, irq=%d\n",
- (unsigned long __force)ndev->mem_start,
- (unsigned long __force)lp->base_addr, ndev->irq);
+ "Xilinx EmacLite at 0x%08lX mapped to 0x%p, irq=%d\n",
+ (unsigned long __force)ndev->mem_start, lp->base_addr, ndev->irq);
return 0;
error:
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 036/266] drm/amd/pm: fix return value in aldebaran_set_mp1_state()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 035/266] net: xilinx_emaclite: Do not print real IOMEM pointer Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 037/266] drm/vc4: Fix clock source for VEC PixelValve on BCM2711 Greg Kroah-Hartman
` (233 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Feifei Xu, Lijo Lazar, Alex Deucher,
Sasha Levin
From: Feifei Xu <Feifei.Xu@amd.com>
[ Upstream commit 5051cb794ac5d92154e186d87cdc12cba613f4f6 ]
For default cases,we should return 0. Otherwise resume will
abort because of the wrong return value.
Signed-off-by: Feifei Xu <Feifei.Xu@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
index dcbe3a72da09..16ad4683eb69 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
@@ -1779,10 +1779,8 @@ static int aldebaran_set_mp1_state(struct smu_context *smu,
case PP_MP1_STATE_UNLOAD:
return smu_cmn_set_mp1_state(smu, mp1_state);
default:
- return -EINVAL;
+ return 0;
}
-
- return 0;
}
static const struct pptable_funcs aldebaran_ppt_funcs = {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 037/266] drm/vc4: Fix clock source for VEC PixelValve on BCM2711
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 036/266] drm/amd/pm: fix return value in aldebaran_set_mp1_state() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 038/266] drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co() Greg Kroah-Hartman
` (232 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mateusz Kwiatkowski, Maxime Ripard,
Dave Stevenson, Sasha Levin
From: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
[ Upstream commit fc7a8abcee2225d6279ff785d33e24d70c738c6e ]
On the BCM2711 (Raspberry Pi 4), the VEC is actually connected to
output 2 of pixelvalve3.
NOTE: This contradicts the Broadcom docs, but has been empirically
tested and confirmed by Raspberry Pi firmware devs.
Signed-off-by: Mateusz Kwiatkowski <kfyatek+publicgit@gmail.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210520150344.273900-2-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_crtc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 1f36b67cd6ce..e0fd9b74baae 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -1035,7 +1035,7 @@ static const struct vc4_pv_data bcm2711_pv3_data = {
.fifo_depth = 64,
.pixels_per_clock = 1,
.encoder_types = {
- [0] = VC4_ENCODER_TYPE_VEC,
+ [PV_CONTROL_CLK_SELECT_VEC] = VC4_ENCODER_TYPE_VEC,
},
};
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 038/266] drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 037/266] drm/vc4: Fix clock source for VEC PixelValve on BCM2711 Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 039/266] e100: handle eeprom as little endian Greg Kroah-Hartman
` (231 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zou Wei, Maxime Ripard,
Sasha Levin
From: Zou Wei <zou_wei@huawei.com>
[ Upstream commit 5e4322a8b266bc9f5ee7ea4895f661c01dbd7cb3 ]
pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in reference leak here.
Fix it by replacing it with pm_runtime_resume_and_get to keep usage
counter balanced.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/1621840854-105978-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index e94730beb15b..23e7cfd987bb 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -745,7 +745,7 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder,
unsigned long pixel_rate, hsm_rate;
int ret;
- ret = pm_runtime_get_sync(&vc4_hdmi->pdev->dev);
+ ret = pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev);
if (ret < 0) {
DRM_ERROR("Failed to retain power domain: %d\n", ret);
return;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 039/266] e100: handle eeprom as little endian
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 038/266] drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 040/266] igb: handle vlan types with checker enabled Greg Kroah-Hartman
` (230 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jesse Brandeburg, Tony Nguyen, Sasha Levin
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
[ Upstream commit d4ef55288aa2e1b76033717242728ac98ddc4721 ]
Sparse tool was warning on some implicit conversions from
little endian data read from the EEPROM on the e100 cards.
Fix these by being explicit about the conversions using
le16_to_cpu().
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/e100.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index f8d78af76d7d..1b0958bd24f6 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1395,7 +1395,7 @@ static int e100_phy_check_without_mii(struct nic *nic)
u8 phy_type;
int without_mii;
- phy_type = (nic->eeprom[eeprom_phy_iface] >> 8) & 0x0f;
+ phy_type = (le16_to_cpu(nic->eeprom[eeprom_phy_iface]) >> 8) & 0x0f;
switch (phy_type) {
case NoSuchPhy: /* Non-MII PHY; UNTESTED! */
@@ -1515,7 +1515,7 @@ static int e100_phy_init(struct nic *nic)
mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr);
} else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) &&
(mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) &&
- (nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
+ (le16_to_cpu(nic->eeprom[eeprom_cnfg_mdix]) & eeprom_mdix_enabled))) {
/* enable/disable MDI/MDI-X auto-switching. */
mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG,
nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH);
@@ -2269,9 +2269,9 @@ static int e100_asf(struct nic *nic)
{
/* ASF can be enabled from eeprom */
return (nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) &&
- (nic->eeprom[eeprom_config_asf] & eeprom_asf) &&
- !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) &&
- ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE);
+ (le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_asf) &&
+ !(le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_gcl) &&
+ ((le16_to_cpu(nic->eeprom[eeprom_smbus_addr]) & 0xFF) != 0xFE);
}
static int e100_up(struct nic *nic)
@@ -2926,7 +2926,7 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
/* Wol magic packet can be enabled from eeprom */
if ((nic->mac >= mac_82558_D101_A4) &&
- (nic->eeprom[eeprom_id] & eeprom_id_wol)) {
+ (le16_to_cpu(nic->eeprom[eeprom_id]) & eeprom_id_wol)) {
nic->flags |= wol_magic;
device_set_wakeup_enable(&pdev->dev, true);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 040/266] igb: handle vlan types with checker enabled
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 039/266] e100: handle eeprom as little endian Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 041/266] igb: fix assignment on big endian machines Greg Kroah-Hartman
` (229 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jesse Brandeburg, Dave Switzer,
Tony Nguyen, Sasha Levin
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
[ Upstream commit c7cbfb028b95360403d579c47aaaeef1ff140964 ]
The sparse build (C=2) finds some issues with how the driver
dealt with the (very difficult) hardware that in some generations
uses little-endian, and in others uses big endian, for the VLAN
field. The code as written picks __le16 as a type and for some
hardware revisions we override it to __be16 as done in this
patch. This impacted the VF driver as well so fix it there too.
Also change the vlan_tci assignment to override the sparse
warning without changing functionality.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Dave Switzer <david.switzer@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 5 +++--
drivers/net/ethernet/intel/igbvf/netdev.c | 4 ++--
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index b2a042f825ff..b0232a8de343 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -2643,7 +2643,8 @@ static int igb_parse_cls_flower(struct igb_adapter *adapter,
}
input->filter.match_flags |= IGB_FILTER_FLAG_VLAN_TCI;
- input->filter.vlan_tci = match.key->vlan_priority;
+ input->filter.vlan_tci =
+ (__force __be16)match.key->vlan_priority;
}
}
@@ -8592,7 +8593,7 @@ static void igb_process_skb_fields(struct igb_ring *rx_ring,
if (igb_test_staterr(rx_desc, E1000_RXDEXT_STATERR_LB) &&
test_bit(IGB_RING_FLAG_RX_LB_VLAN_BSWAP, &rx_ring->flags))
- vid = be16_to_cpu(rx_desc->wb.upper.vlan);
+ vid = be16_to_cpu((__force __be16)rx_desc->wb.upper.vlan);
else
vid = le16_to_cpu(rx_desc->wb.upper.vlan);
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index fb3fbcb13331..630c1155f196 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -83,14 +83,14 @@ static int igbvf_desc_unused(struct igbvf_ring *ring)
static void igbvf_receive_skb(struct igbvf_adapter *adapter,
struct net_device *netdev,
struct sk_buff *skb,
- u32 status, u16 vlan)
+ u32 status, __le16 vlan)
{
u16 vid;
if (status & E1000_RXD_STAT_VP) {
if ((adapter->flags & IGBVF_FLAG_RX_LB_VLAN_BSWAP) &&
(status & E1000_RXDEXT_STATERR_LB))
- vid = be16_to_cpu(vlan) & E1000_RXD_SPC_VLAN_MASK;
+ vid = be16_to_cpu((__force __be16)vlan) & E1000_RXD_SPC_VLAN_MASK;
else
vid = le16_to_cpu(vlan) & E1000_RXD_SPC_VLAN_MASK;
if (test_bit(vid, adapter->active_vlans))
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 041/266] igb: fix assignment on big endian machines
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 040/266] igb: handle vlan types with checker enabled Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 042/266] drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer() Greg Kroah-Hartman
` (228 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jesse Brandeburg, Dave Switzer,
Tony Nguyen, Sasha Levin
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
[ Upstream commit b514958dd1a3bd57638b0e63b8e5152b1960e6aa ]
The igb driver was trying hard to be sparse correct, but somehow
ended up converting a variable into little endian order and then
tries to OR something with it.
A much plainer way of doing things is to leave all variables and
OR operations in CPU (non-endian) mode, and then convert to
little endian only once, which is what this change does.
This probably fixes a bug that might have been seen only on
big endian systems.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Dave Switzer <david.switzer@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index b0232a8de343..7b1885f9ce03 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -6276,12 +6276,12 @@ int igb_xmit_xdp_ring(struct igb_adapter *adapter,
cmd_type |= len | IGB_TXD_DCMD;
tx_desc->read.cmd_type_len = cpu_to_le32(cmd_type);
- olinfo_status = cpu_to_le32(len << E1000_ADVTXD_PAYLEN_SHIFT);
+ olinfo_status = len << E1000_ADVTXD_PAYLEN_SHIFT;
/* 82575 requires a unique index per ring */
if (test_bit(IGB_RING_FLAG_TX_CTX_IDX, &tx_ring->flags))
olinfo_status |= tx_ring->reg_idx << 4;
- tx_desc->read.olinfo_status = olinfo_status;
+ tx_desc->read.olinfo_status = cpu_to_le32(olinfo_status);
netdev_tx_sent_queue(txring_txq(tx_ring), tx_buffer->bytecount);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 042/266] drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 041/266] igb: fix assignment on big endian machines Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 043/266] clk: renesas: r8a77995: Add ZA2 clock Greg Kroah-Hartman
` (227 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zou Wei, Robert Foss,
Sasha Levin
From: Zou Wei <zou_wei@huawei.com>
[ Upstream commit 33f90f27e1c5ccd648d3e78a1c28be9ee8791cf1 ]
pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in reference leak here.
Fix it by replacing it with pm_runtime_resume_and_get to keep usage
counter balanced.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1621840862-106024-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/cdns-dsi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c
index 76373e31df92..b31281f76117 100644
--- a/drivers/gpu/drm/bridge/cdns-dsi.c
+++ b/drivers/gpu/drm/bridge/cdns-dsi.c
@@ -1028,7 +1028,7 @@ static ssize_t cdns_dsi_transfer(struct mipi_dsi_host *host,
struct mipi_dsi_packet packet;
int ret, i, tx_len, rx_len;
- ret = pm_runtime_get_sync(host->dev);
+ ret = pm_runtime_resume_and_get(host->dev);
if (ret < 0)
return ret;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 043/266] clk: renesas: r8a77995: Add ZA2 clock
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 042/266] drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer() Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 044/266] drm/amd/display: fix odm scaling Greg Kroah-Hartman
` (226 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kuninori Morimoto,
Geert Uytterhoeven, Sasha Levin
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit 790c06cc5df263cdaff748670cc65958c81b0951 ]
R-Car D3 ZA2 clock is from PLL0D3 or S0,
and it can be controlled by ZA2CKCR.
It is needed for R-Car Sound, but is not used so far.
Using default settings is very enough at this point.
This patch adds it by DEF_FIXED().
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87pmxclrmy.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/r8a77995-cpg-mssr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c
index 9cfd00cf4e69..81c0bc1e78af 100644
--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c
+++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c
@@ -75,6 +75,7 @@ static const struct cpg_core_clk r8a77995_core_clks[] __initconst = {
DEF_RATE(".oco", CLK_OCO, 8 * 1000 * 1000),
/* Core Clock Outputs */
+ DEF_FIXED("za2", R8A77995_CLK_ZA2, CLK_PLL0D3, 2, 1),
DEF_FIXED("z2", R8A77995_CLK_Z2, CLK_PLL0D3, 1, 1),
DEF_FIXED("ztr", R8A77995_CLK_ZTR, CLK_PLL1, 6, 1),
DEF_FIXED("zt", R8A77995_CLK_ZT, CLK_PLL1, 4, 1),
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 044/266] drm/amd/display: fix odm scaling
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 043/266] clk: renesas: r8a77995: Add ZA2 clock Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 045/266] drm/amdgpu/swsmu/aldebaran: fix check in is_dpm_running Greg Kroah-Hartman
` (225 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmytro Laktyushkin, Jun Lei,
Qingqing Zhuo, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
[ Upstream commit 6566cae7aef30da8833f1fa0eb854baf33b96676 ]
There are two issues with scaling calculations, odm recout
calculation and matching viewport to actual recout.
This change fixes both issues. Odm recout calculation via
special casing and viewport matching issue by reworking
the viewport calcualtion to use scaling ratios and recout
to derrive the required offset and size.
Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Reviewed-by: Jun Lei <Jun.Lei@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/dc/core/dc_resource.c | 568 +++++++-----------
drivers/gpu/drm/amd/display/dc/dc_types.h | 5 -
.../drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | 12 +-
.../drm/amd/display/dc/dcn20/dcn20_resource.c | 14 +-
.../amd/display/dc/dml/display_mode_structs.h | 2 +
.../drm/amd/display/dc/dml/display_mode_vba.c | 13 +
.../gpu/drm/amd/display/dc/inc/hw/transform.h | 4 -
7 files changed, 232 insertions(+), 386 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 8cb937c046aa..78278a10d899 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -695,124 +695,23 @@ static void calculate_split_count_and_index(struct pipe_ctx *pipe_ctx, int *spli
}
}
-static void calculate_viewport(struct pipe_ctx *pipe_ctx)
+/*
+ * This is a preliminary vp size calculation to allow us to check taps support.
+ * The result is completely overridden afterwards.
+ */
+static void calculate_viewport_size(struct pipe_ctx *pipe_ctx)
{
- const struct dc_plane_state *plane_state = pipe_ctx->plane_state;
- const struct dc_stream_state *stream = pipe_ctx->stream;
struct scaler_data *data = &pipe_ctx->plane_res.scl_data;
- struct rect surf_src = plane_state->src_rect;
- struct rect clip, dest;
- int vpc_div = (data->format == PIXEL_FORMAT_420BPP8
- || data->format == PIXEL_FORMAT_420BPP10) ? 2 : 1;
- int split_count = 0;
- int split_idx = 0;
- bool orthogonal_rotation, flip_y_start, flip_x_start;
-
- calculate_split_count_and_index(pipe_ctx, &split_count, &split_idx);
- if (stream->view_format == VIEW_3D_FORMAT_SIDE_BY_SIDE ||
- stream->view_format == VIEW_3D_FORMAT_TOP_AND_BOTTOM) {
- split_count = 0;
- split_idx = 0;
- }
-
- /* The actual clip is an intersection between stream
- * source and surface clip
- */
- dest = plane_state->dst_rect;
- clip.x = stream->src.x > plane_state->clip_rect.x ?
- stream->src.x : plane_state->clip_rect.x;
-
- clip.width = stream->src.x + stream->src.width <
- plane_state->clip_rect.x + plane_state->clip_rect.width ?
- stream->src.x + stream->src.width - clip.x :
- plane_state->clip_rect.x + plane_state->clip_rect.width - clip.x ;
-
- clip.y = stream->src.y > plane_state->clip_rect.y ?
- stream->src.y : plane_state->clip_rect.y;
-
- clip.height = stream->src.y + stream->src.height <
- plane_state->clip_rect.y + plane_state->clip_rect.height ?
- stream->src.y + stream->src.height - clip.y :
- plane_state->clip_rect.y + plane_state->clip_rect.height - clip.y ;
-
- /*
- * Need to calculate how scan origin is shifted in vp space
- * to correctly rotate clip and dst
- */
- get_vp_scan_direction(
- plane_state->rotation,
- plane_state->horizontal_mirror,
- &orthogonal_rotation,
- &flip_y_start,
- &flip_x_start);
-
- if (orthogonal_rotation) {
- swap(clip.x, clip.y);
- swap(clip.width, clip.height);
- swap(dest.x, dest.y);
- swap(dest.width, dest.height);
- }
- if (flip_x_start) {
- clip.x = dest.x + dest.width - clip.x - clip.width;
- dest.x = 0;
- }
- if (flip_y_start) {
- clip.y = dest.y + dest.height - clip.y - clip.height;
- dest.y = 0;
- }
-
- /* offset = surf_src.ofs + (clip.ofs - surface->dst_rect.ofs) * scl_ratio
- * num_pixels = clip.num_pix * scl_ratio
- */
- data->viewport.x = surf_src.x + (clip.x - dest.x) * surf_src.width / dest.width;
- data->viewport.width = clip.width * surf_src.width / dest.width;
-
- data->viewport.y = surf_src.y + (clip.y - dest.y) * surf_src.height / dest.height;
- data->viewport.height = clip.height * surf_src.height / dest.height;
-
- /* Handle split */
- if (split_count) {
- /* extra pixels in the division remainder need to go to pipes after
- * the extra pixel index minus one(epimo) defined here as:
- */
- int epimo = 0;
-
- if (orthogonal_rotation) {
- if (flip_y_start)
- split_idx = split_count - split_idx;
-
- epimo = split_count - data->viewport.height % (split_count + 1);
-
- data->viewport.y += (data->viewport.height / (split_count + 1)) * split_idx;
- if (split_idx > epimo)
- data->viewport.y += split_idx - epimo - 1;
- data->viewport.height = data->viewport.height / (split_count + 1) + (split_idx > epimo ? 1 : 0);
- } else {
- if (flip_x_start)
- split_idx = split_count - split_idx;
-
- epimo = split_count - data->viewport.width % (split_count + 1);
-
- data->viewport.x += (data->viewport.width / (split_count + 1)) * split_idx;
- if (split_idx > epimo)
- data->viewport.x += split_idx - epimo - 1;
- data->viewport.width = data->viewport.width / (split_count + 1) + (split_idx > epimo ? 1 : 0);
- }
+ data->viewport.width = dc_fixpt_ceil(dc_fixpt_mul_int(data->ratios.horz, data->recout.width));
+ data->viewport.height = dc_fixpt_ceil(dc_fixpt_mul_int(data->ratios.vert, data->recout.height));
+ data->viewport_c.width = dc_fixpt_ceil(dc_fixpt_mul_int(data->ratios.horz_c, data->recout.width));
+ data->viewport_c.height = dc_fixpt_ceil(dc_fixpt_mul_int(data->ratios.vert_c, data->recout.height));
+ if (pipe_ctx->plane_state->rotation == ROTATION_ANGLE_90 ||
+ pipe_ctx->plane_state->rotation == ROTATION_ANGLE_270) {
+ swap(data->viewport.width, data->viewport.height);
+ swap(data->viewport_c.width, data->viewport_c.height);
}
-
- /* Round down, compensate in init */
- data->viewport_c.x = data->viewport.x / vpc_div;
- data->viewport_c.y = data->viewport.y / vpc_div;
- data->inits.h_c = (data->viewport.x % vpc_div) != 0 ? dc_fixpt_half : dc_fixpt_zero;
- data->inits.v_c = (data->viewport.y % vpc_div) != 0 ? dc_fixpt_half : dc_fixpt_zero;
-
- /* Round up, assume original video size always even dimensions */
- data->viewport_c.width = (data->viewport.width + vpc_div - 1) / vpc_div;
- data->viewport_c.height = (data->viewport.height + vpc_div - 1) / vpc_div;
-
- data->viewport_unadjusted = data->viewport;
- data->viewport_c_unadjusted = data->viewport_c;
}
static void calculate_recout(struct pipe_ctx *pipe_ctx)
@@ -821,26 +720,21 @@ static void calculate_recout(struct pipe_ctx *pipe_ctx)
const struct dc_stream_state *stream = pipe_ctx->stream;
struct scaler_data *data = &pipe_ctx->plane_res.scl_data;
struct rect surf_clip = plane_state->clip_rect;
- bool pri_split_tb = pipe_ctx->bottom_pipe &&
- pipe_ctx->bottom_pipe->plane_state == pipe_ctx->plane_state &&
- stream->view_format == VIEW_3D_FORMAT_TOP_AND_BOTTOM;
- bool sec_split_tb = pipe_ctx->top_pipe &&
- pipe_ctx->top_pipe->plane_state == pipe_ctx->plane_state &&
- stream->view_format == VIEW_3D_FORMAT_TOP_AND_BOTTOM;
- int split_count = 0;
- int split_idx = 0;
+ bool split_tb = stream->view_format == VIEW_3D_FORMAT_TOP_AND_BOTTOM;
+ int split_count, split_idx;
calculate_split_count_and_index(pipe_ctx, &split_count, &split_idx);
+ if (stream->view_format == VIEW_3D_FORMAT_SIDE_BY_SIDE)
+ split_idx = 0;
/*
* Only the leftmost ODM pipe should be offset by a nonzero distance
*/
- if (!pipe_ctx->prev_odm_pipe) {
+ if (!pipe_ctx->prev_odm_pipe || split_idx == split_count) {
data->recout.x = stream->dst.x;
if (stream->src.x < surf_clip.x)
data->recout.x += (surf_clip.x - stream->src.x) * stream->dst.width
/ stream->src.width;
-
} else
data->recout.x = 0;
@@ -861,26 +755,31 @@ static void calculate_recout(struct pipe_ctx *pipe_ctx)
if (data->recout.height + data->recout.y > stream->dst.y + stream->dst.height)
data->recout.height = stream->dst.y + stream->dst.height - data->recout.y;
- /* Handle h & v split, handle rotation using viewport */
- if (sec_split_tb) {
- data->recout.y += data->recout.height / 2;
- /* Floor primary pipe, ceil 2ndary pipe */
- data->recout.height = (data->recout.height + 1) / 2;
- } else if (pri_split_tb)
+ /* Handle h & v split */
+ if (split_tb) {
+ ASSERT(data->recout.height % 2 == 0);
data->recout.height /= 2;
- else if (split_count) {
- /* extra pixels in the division remainder need to go to pipes after
- * the extra pixel index minus one(epimo) defined here as:
- */
- int epimo = split_count - data->recout.width % (split_count + 1);
-
- /*no recout offset due to odm */
+ } else if (split_count) {
if (!pipe_ctx->next_odm_pipe && !pipe_ctx->prev_odm_pipe) {
+ /* extra pixels in the division remainder need to go to pipes after
+ * the extra pixel index minus one(epimo) defined here as:
+ */
+ int epimo = split_count - data->recout.width % (split_count + 1);
+
data->recout.x += (data->recout.width / (split_count + 1)) * split_idx;
if (split_idx > epimo)
data->recout.x += split_idx - epimo - 1;
+ ASSERT(stream->view_format != VIEW_3D_FORMAT_SIDE_BY_SIDE || data->recout.width % 2 == 0);
+ data->recout.width = data->recout.width / (split_count + 1) + (split_idx > epimo ? 1 : 0);
+ } else {
+ /* odm */
+ if (split_idx == split_count) {
+ /* rightmost pipe is the remainder recout */
+ data->recout.width -= data->h_active * split_count - data->recout.x;
+ data->recout.x = 0;
+ } else
+ data->recout.width = data->h_active - data->recout.x;
}
- data->recout.width = data->recout.width / (split_count + 1) + (split_idx > epimo ? 1 : 0);
}
}
@@ -934,9 +833,15 @@ static void calculate_scaling_ratios(struct pipe_ctx *pipe_ctx)
pipe_ctx->plane_res.scl_data.ratios.vert_c, 19);
}
-static inline void adjust_vp_and_init_for_seamless_clip(
+
+/*
+ * We completely calculate vp offset, size and inits here based entirely on scaling
+ * ratios and recout for pixel perfect pipe combine.
+ */
+static void calculate_init_and_vp(
bool flip_scan_dir,
- int recout_skip,
+ int recout_offset_within_recout_full,
+ int recout_size,
int src_size,
int taps,
struct fixed31_32 ratio,
@@ -944,91 +849,87 @@ static inline void adjust_vp_and_init_for_seamless_clip(
int *vp_offset,
int *vp_size)
{
- if (!flip_scan_dir) {
- /* Adjust for viewport end clip-off */
- if ((*vp_offset + *vp_size) < src_size) {
- int vp_clip = src_size - *vp_size - *vp_offset;
- int int_part = dc_fixpt_floor(dc_fixpt_sub(*init, ratio));
-
- int_part = int_part > 0 ? int_part : 0;
- *vp_size += int_part < vp_clip ? int_part : vp_clip;
- }
-
- /* Adjust for non-0 viewport offset */
- if (*vp_offset) {
- int int_part;
-
- *init = dc_fixpt_add(*init, dc_fixpt_mul_int(ratio, recout_skip));
- int_part = dc_fixpt_floor(*init) - *vp_offset;
- if (int_part < taps) {
- int int_adj = *vp_offset >= (taps - int_part) ?
- (taps - int_part) : *vp_offset;
- *vp_offset -= int_adj;
- *vp_size += int_adj;
- int_part += int_adj;
- } else if (int_part > taps) {
- *vp_offset += int_part - taps;
- *vp_size -= int_part - taps;
- int_part = taps;
- }
- init->value &= 0xffffffff;
- *init = dc_fixpt_add_int(*init, int_part);
- }
- } else {
- /* Adjust for non-0 viewport offset */
- if (*vp_offset) {
- int int_part = dc_fixpt_floor(dc_fixpt_sub(*init, ratio));
-
- int_part = int_part > 0 ? int_part : 0;
- *vp_size += int_part < *vp_offset ? int_part : *vp_offset;
- *vp_offset -= int_part < *vp_offset ? int_part : *vp_offset;
- }
+ struct fixed31_32 temp;
+ int int_part;
- /* Adjust for viewport end clip-off */
- if ((*vp_offset + *vp_size) < src_size) {
- int int_part;
- int end_offset = src_size - *vp_offset - *vp_size;
-
- /*
- * this is init if vp had no offset, keep in mind this is from the
- * right side of vp due to scan direction
- */
- *init = dc_fixpt_add(*init, dc_fixpt_mul_int(ratio, recout_skip));
- /*
- * this is the difference between first pixel of viewport available to read
- * and init position, takning into account scan direction
- */
- int_part = dc_fixpt_floor(*init) - end_offset;
- if (int_part < taps) {
- int int_adj = end_offset >= (taps - int_part) ?
- (taps - int_part) : end_offset;
- *vp_size += int_adj;
- int_part += int_adj;
- } else if (int_part > taps) {
- *vp_size += int_part - taps;
- int_part = taps;
- }
- init->value &= 0xffffffff;
- *init = dc_fixpt_add_int(*init, int_part);
- }
+ /*
+ * First of the taps starts sampling pixel number <init_int_part> corresponding to recout
+ * pixel 1. Next recout pixel samples int part of <init + scaling ratio> and so on.
+ * All following calculations are based on this logic.
+ *
+ * Init calculated according to formula:
+ * init = (scaling_ratio + number_of_taps + 1) / 2
+ * init_bot = init + scaling_ratio
+ * to get pixel perfect combine add the fraction from calculating vp offset
+ */
+ temp = dc_fixpt_mul_int(ratio, recout_offset_within_recout_full);
+ *vp_offset = dc_fixpt_floor(temp);
+ temp.value &= 0xffffffff;
+ *init = dc_fixpt_truncate(dc_fixpt_add(dc_fixpt_div_int(
+ dc_fixpt_add_int(ratio, taps + 1), 2), temp), 19);
+ /*
+ * If viewport has non 0 offset and there are more taps than covered by init then
+ * we should decrease the offset and increase init so we are never sampling
+ * outside of viewport.
+ */
+ int_part = dc_fixpt_floor(*init);
+ if (int_part < taps) {
+ int_part = taps - int_part;
+ if (int_part > *vp_offset)
+ int_part = *vp_offset;
+ *vp_offset -= int_part;
+ *init = dc_fixpt_add_int(*init, int_part);
}
+ /*
+ * If taps are sampling outside of viewport at end of recout and there are more pixels
+ * available in the surface we should increase the viewport size, regardless set vp to
+ * only what is used.
+ */
+ temp = dc_fixpt_add(*init, dc_fixpt_mul_int(ratio, recout_size - 1));
+ *vp_size = dc_fixpt_floor(temp);
+ if (*vp_size + *vp_offset > src_size)
+ *vp_size = src_size - *vp_offset;
+
+ /* We did all the math assuming we are scanning same direction as display does,
+ * however mirror/rotation changes how vp scans vs how it is offset. If scan direction
+ * is flipped we simply need to calculate offset from the other side of plane.
+ * Note that outside of viewport all scaling hardware works in recout space.
+ */
+ if (flip_scan_dir)
+ *vp_offset = src_size - *vp_offset - *vp_size;
}
-static void calculate_inits_and_adj_vp(struct pipe_ctx *pipe_ctx)
+static void calculate_inits_and_viewports(struct pipe_ctx *pipe_ctx)
{
const struct dc_plane_state *plane_state = pipe_ctx->plane_state;
const struct dc_stream_state *stream = pipe_ctx->stream;
- struct pipe_ctx *odm_pipe = pipe_ctx;
struct scaler_data *data = &pipe_ctx->plane_res.scl_data;
- struct rect src = pipe_ctx->plane_state->src_rect;
- int recout_skip_h, recout_skip_v, surf_size_h, surf_size_v;
+ struct rect src = plane_state->src_rect;
int vpc_div = (data->format == PIXEL_FORMAT_420BPP8
- || data->format == PIXEL_FORMAT_420BPP10) ? 2 : 1;
+ || data->format == PIXEL_FORMAT_420BPP10) ? 2 : 1;
+ int split_count, split_idx, ro_lb, ro_tb, recout_full_x, recout_full_y;
bool orthogonal_rotation, flip_vert_scan_dir, flip_horz_scan_dir;
- int odm_idx = 0;
+ calculate_split_count_and_index(pipe_ctx, &split_count, &split_idx);
/*
- * Need to calculate the scan direction for viewport to make adjustments
+ * recout full is what the recout would have been if we didnt clip
+ * the source plane at all. We only care about left(ro_lb) and top(ro_tb)
+ * offsets of recout within recout full because those are the directions
+ * we scan from and therefore the only ones that affect inits.
+ */
+ recout_full_x = stream->dst.x + (plane_state->dst_rect.x - stream->src.x)
+ * stream->dst.width / stream->src.width;
+ recout_full_y = stream->dst.y + (plane_state->dst_rect.y - stream->src.y)
+ * stream->dst.height / stream->src.height;
+ if (pipe_ctx->prev_odm_pipe && split_idx)
+ ro_lb = data->h_active * split_idx - recout_full_x;
+ else
+ ro_lb = data->recout.x - recout_full_x;
+ ro_tb = data->recout.y - recout_full_y;
+ ASSERT(ro_lb >= 0 && ro_tb >= 0);
+
+ /*
+ * Work in recout rotation since that requires less transformations
*/
get_vp_scan_direction(
plane_state->rotation,
@@ -1037,145 +938,62 @@ static void calculate_inits_and_adj_vp(struct pipe_ctx *pipe_ctx)
&flip_vert_scan_dir,
&flip_horz_scan_dir);
- /* Calculate src rect rotation adjusted to recout space */
- surf_size_h = src.x + src.width;
- surf_size_v = src.y + src.height;
- if (flip_horz_scan_dir)
- src.x = 0;
- if (flip_vert_scan_dir)
- src.y = 0;
if (orthogonal_rotation) {
- swap(src.x, src.y);
swap(src.width, src.height);
+ swap(flip_vert_scan_dir, flip_horz_scan_dir);
}
- /*modified recout_skip_h calculation due to odm having no recout offset*/
- while (odm_pipe->prev_odm_pipe) {
- odm_idx++;
- odm_pipe = odm_pipe->prev_odm_pipe;
- }
- /*odm_pipe is the leftmost pipe in the ODM group*/
- recout_skip_h = odm_idx * data->recout.width;
-
- /* Recout matching initial vp offset = recout_offset - (stream dst offset +
- * ((surf dst offset - stream src offset) * 1/ stream scaling ratio)
- * - (surf surf_src offset * 1/ full scl ratio))
- */
- recout_skip_h += odm_pipe->plane_res.scl_data.recout.x
- - (stream->dst.x + (plane_state->dst_rect.x - stream->src.x)
- * stream->dst.width / stream->src.width -
- src.x * plane_state->dst_rect.width / src.width
- * stream->dst.width / stream->src.width);
-
-
- recout_skip_v = data->recout.y - (stream->dst.y + (plane_state->dst_rect.y - stream->src.y)
- * stream->dst.height / stream->src.height -
- src.y * plane_state->dst_rect.height / src.height
- * stream->dst.height / stream->src.height);
- if (orthogonal_rotation)
- swap(recout_skip_h, recout_skip_v);
- /*
- * Init calculated according to formula:
- * init = (scaling_ratio + number_of_taps + 1) / 2
- * init_bot = init + scaling_ratio
- * init_c = init + truncated_vp_c_offset(from calculate viewport)
- */
- data->inits.h = dc_fixpt_truncate(dc_fixpt_div_int(
- dc_fixpt_add_int(data->ratios.horz, data->taps.h_taps + 1), 2), 19);
-
- data->inits.h_c = dc_fixpt_truncate(dc_fixpt_add(data->inits.h_c, dc_fixpt_div_int(
- dc_fixpt_add_int(data->ratios.horz_c, data->taps.h_taps_c + 1), 2)), 19);
-
- data->inits.v = dc_fixpt_truncate(dc_fixpt_div_int(
- dc_fixpt_add_int(data->ratios.vert, data->taps.v_taps + 1), 2), 19);
-
- data->inits.v_c = dc_fixpt_truncate(dc_fixpt_add(data->inits.v_c, dc_fixpt_div_int(
- dc_fixpt_add_int(data->ratios.vert_c, data->taps.v_taps_c + 1), 2)), 19);
-
- /*
- * Taps, inits and scaling ratios are in recout space need to rotate
- * to viewport rotation before adjustment
- */
- adjust_vp_and_init_for_seamless_clip(
+ calculate_init_and_vp(
flip_horz_scan_dir,
- recout_skip_h,
- surf_size_h,
- orthogonal_rotation ? data->taps.v_taps : data->taps.h_taps,
- orthogonal_rotation ? data->ratios.vert : data->ratios.horz,
- orthogonal_rotation ? &data->inits.v : &data->inits.h,
+ ro_lb,
+ data->recout.width,
+ src.width,
+ data->taps.h_taps,
+ data->ratios.horz,
+ &data->inits.h,
&data->viewport.x,
&data->viewport.width);
- adjust_vp_and_init_for_seamless_clip(
+ calculate_init_and_vp(
flip_horz_scan_dir,
- recout_skip_h,
- surf_size_h / vpc_div,
- orthogonal_rotation ? data->taps.v_taps_c : data->taps.h_taps_c,
- orthogonal_rotation ? data->ratios.vert_c : data->ratios.horz_c,
- orthogonal_rotation ? &data->inits.v_c : &data->inits.h_c,
+ ro_lb,
+ data->recout.width,
+ src.width / vpc_div,
+ data->taps.h_taps_c,
+ data->ratios.horz_c,
+ &data->inits.h_c,
&data->viewport_c.x,
&data->viewport_c.width);
- adjust_vp_and_init_for_seamless_clip(
+ calculate_init_and_vp(
flip_vert_scan_dir,
- recout_skip_v,
- surf_size_v,
- orthogonal_rotation ? data->taps.h_taps : data->taps.v_taps,
- orthogonal_rotation ? data->ratios.horz : data->ratios.vert,
- orthogonal_rotation ? &data->inits.h : &data->inits.v,
+ ro_tb,
+ data->recout.height,
+ src.height,
+ data->taps.v_taps,
+ data->ratios.vert,
+ &data->inits.v,
&data->viewport.y,
&data->viewport.height);
- adjust_vp_and_init_for_seamless_clip(
+ calculate_init_and_vp(
flip_vert_scan_dir,
- recout_skip_v,
- surf_size_v / vpc_div,
- orthogonal_rotation ? data->taps.h_taps_c : data->taps.v_taps_c,
- orthogonal_rotation ? data->ratios.horz_c : data->ratios.vert_c,
- orthogonal_rotation ? &data->inits.h_c : &data->inits.v_c,
+ ro_tb,
+ data->recout.height,
+ src.height / vpc_div,
+ data->taps.v_taps_c,
+ data->ratios.vert_c,
+ &data->inits.v_c,
&data->viewport_c.y,
&data->viewport_c.height);
-
- /* Interlaced inits based on final vert inits */
- data->inits.v_bot = dc_fixpt_add(data->inits.v, data->ratios.vert);
- data->inits.v_c_bot = dc_fixpt_add(data->inits.v_c, data->ratios.vert_c);
-
-}
-
-/*
- * When handling 270 rotation in mixed SLS mode, we have
- * stream->timing.h_border_left that is non zero. If we are doing
- * pipe-splitting, this h_border_left value gets added to recout.x and when it
- * calls calculate_inits_and_adj_vp() and
- * adjust_vp_and_init_for_seamless_clip(), it can cause viewport.height for a
- * pipe to be incorrect.
- *
- * To fix this, instead of using stream->timing.h_border_left, we can use
- * stream->dst.x to represent the border instead. So we will set h_border_left
- * to 0 and shift the appropriate amount in stream->dst.x. We will then
- * perform all calculations in resource_build_scaling_params() based on this
- * and then restore the h_border_left and stream->dst.x to their original
- * values.
- *
- * shift_border_left_to_dst() will shift the amount of h_border_left to
- * stream->dst.x and set h_border_left to 0. restore_border_left_from_dst()
- * will restore h_border_left and stream->dst.x back to their original values
- * We also need to make sure pipe_ctx->plane_res.scl_data.h_active uses the
- * original h_border_left value in its calculation.
- */
-static int shift_border_left_to_dst(struct pipe_ctx *pipe_ctx)
-{
- int store_h_border_left = pipe_ctx->stream->timing.h_border_left;
-
- if (store_h_border_left) {
- pipe_ctx->stream->timing.h_border_left = 0;
- pipe_ctx->stream->dst.x += store_h_border_left;
+ if (orthogonal_rotation) {
+ swap(data->viewport.x, data->viewport.y);
+ swap(data->viewport.width, data->viewport.height);
+ swap(data->viewport_c.x, data->viewport_c.y);
+ swap(data->viewport_c.width, data->viewport_c.height);
}
- return store_h_border_left;
-}
-
-static void restore_border_left_from_dst(struct pipe_ctx *pipe_ctx,
- int store_h_border_left)
-{
- pipe_ctx->stream->dst.x -= store_h_border_left;
- pipe_ctx->stream->timing.h_border_left = store_h_border_left;
+ data->viewport.x += src.x;
+ data->viewport.y += src.y;
+ ASSERT(src.x % vpc_div == 0 && src.y % vpc_div == 0);
+ data->viewport_c.x += src.x / vpc_div;
+ data->viewport_c.y += src.y / vpc_div;
}
bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)
@@ -1183,48 +1001,42 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)
const struct dc_plane_state *plane_state = pipe_ctx->plane_state;
struct dc_crtc_timing *timing = &pipe_ctx->stream->timing;
bool res = false;
- int store_h_border_left = shift_border_left_to_dst(pipe_ctx);
DC_LOGGER_INIT(pipe_ctx->stream->ctx->logger);
- /* Important: scaling ratio calculation requires pixel format,
- * lb depth calculation requires recout and taps require scaling ratios.
- * Inits require viewport, taps, ratios and recout of split pipe
- */
+
pipe_ctx->plane_res.scl_data.format = convert_pixel_format_to_dalsurface(
pipe_ctx->plane_state->format);
- calculate_scaling_ratios(pipe_ctx);
-
- calculate_viewport(pipe_ctx);
+ /* Timing borders are part of vactive that we are also supposed to skip in addition
+ * to any stream dst offset. Since dm logic assumes dst is in addressable
+ * space we need to add the the left and top borders to dst offsets temporarily.
+ * TODO: fix in DM, stream dst is supposed to be in vactive
+ */
+ pipe_ctx->stream->dst.x += timing->h_border_left;
+ pipe_ctx->stream->dst.y += timing->v_border_top;
- if (pipe_ctx->plane_res.scl_data.viewport.height < MIN_VIEWPORT_SIZE ||
- pipe_ctx->plane_res.scl_data.viewport.width < MIN_VIEWPORT_SIZE) {
- if (store_h_border_left) {
- restore_border_left_from_dst(pipe_ctx,
- store_h_border_left);
- }
- return false;
- }
+ /* Calculate H and V active size */
+ pipe_ctx->plane_res.scl_data.h_active = timing->h_addressable +
+ timing->h_border_left + timing->h_border_right;
+ pipe_ctx->plane_res.scl_data.v_active = timing->v_addressable +
+ timing->v_border_top + timing->v_border_bottom;
+ if (pipe_ctx->next_odm_pipe || pipe_ctx->prev_odm_pipe)
+ pipe_ctx->plane_res.scl_data.h_active /= get_num_odm_splits(pipe_ctx) + 1;
+ /* depends on h_active */
calculate_recout(pipe_ctx);
+ /* depends on pixel format */
+ calculate_scaling_ratios(pipe_ctx);
+ /* depends on scaling ratios and recout, does not calculate offset yet */
+ calculate_viewport_size(pipe_ctx);
- /**
+ /*
+ * LB calculations depend on vp size, h/v_active and scaling ratios
* Setting line buffer pixel depth to 24bpp yields banding
* on certain displays, such as the Sharp 4k
*/
pipe_ctx->plane_res.scl_data.lb_params.depth = LB_PIXEL_DEPTH_30BPP;
pipe_ctx->plane_res.scl_data.lb_params.alpha_en = plane_state->per_pixel_alpha;
- pipe_ctx->plane_res.scl_data.recout.x += timing->h_border_left;
- pipe_ctx->plane_res.scl_data.recout.y += timing->v_border_top;
-
- pipe_ctx->plane_res.scl_data.h_active = timing->h_addressable +
- store_h_border_left + timing->h_border_right;
- pipe_ctx->plane_res.scl_data.v_active = timing->v_addressable +
- timing->v_border_top + timing->v_border_bottom;
- if (pipe_ctx->next_odm_pipe || pipe_ctx->prev_odm_pipe)
- pipe_ctx->plane_res.scl_data.h_active /= get_num_odm_splits(pipe_ctx) + 1;
-
- /* Taps calculations */
if (pipe_ctx->plane_res.xfm != NULL)
res = pipe_ctx->plane_res.xfm->funcs->transform_get_optimal_number_of_taps(
pipe_ctx->plane_res.xfm, &pipe_ctx->plane_res.scl_data, &plane_state->scaling_quality);
@@ -1251,9 +1063,31 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)
&plane_state->scaling_quality);
}
+ /*
+ * Depends on recout, scaling ratios, h_active and taps
+ * May need to re-check lb size after this in some obscure scenario
+ */
if (res)
- /* May need to re-check lb size after this in some obscure scenario */
- calculate_inits_and_adj_vp(pipe_ctx);
+ calculate_inits_and_viewports(pipe_ctx);
+
+ /*
+ * Handle side by side and top bottom 3d recout offsets after vp calculation
+ * since 3d is special and needs to calculate vp as if there is no recout offset
+ * This may break with rotation, good thing we aren't mixing hw rotation and 3d
+ */
+ if (pipe_ctx->top_pipe && pipe_ctx->top_pipe->plane_state == plane_state) {
+ ASSERT(plane_state->rotation == ROTATION_ANGLE_0 ||
+ (pipe_ctx->stream->view_format != VIEW_3D_FORMAT_TOP_AND_BOTTOM &&
+ pipe_ctx->stream->view_format != VIEW_3D_FORMAT_SIDE_BY_SIDE));
+ if (pipe_ctx->stream->view_format == VIEW_3D_FORMAT_TOP_AND_BOTTOM)
+ pipe_ctx->plane_res.scl_data.recout.y += pipe_ctx->plane_res.scl_data.recout.height;
+ else if (pipe_ctx->stream->view_format == VIEW_3D_FORMAT_SIDE_BY_SIDE)
+ pipe_ctx->plane_res.scl_data.recout.x += pipe_ctx->plane_res.scl_data.recout.width;
+ }
+
+ if (pipe_ctx->plane_res.scl_data.viewport.height < MIN_VIEWPORT_SIZE ||
+ pipe_ctx->plane_res.scl_data.viewport.width < MIN_VIEWPORT_SIZE)
+ res = false;
DC_LOG_SCALER("%s pipe %d:\nViewport: height:%d width:%d x:%d y:%d Recout: height:%d width:%d x:%d y:%d HACTIVE:%d VACTIVE:%d\n"
"src_rect: height:%d width:%d x:%d y:%d dst_rect: height:%d width:%d x:%d y:%d clip_rect: height:%d width:%d x:%d y:%d\n",
@@ -1282,8 +1116,8 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx)
plane_state->clip_rect.x,
plane_state->clip_rect.y);
- if (store_h_border_left)
- restore_border_left_from_dst(pipe_ctx, store_h_border_left);
+ pipe_ctx->stream->dst.x -= timing->h_border_left;
+ pipe_ctx->stream->dst.y -= timing->v_border_top;
return res;
}
diff --git a/drivers/gpu/drm/amd/display/dc/dc_types.h b/drivers/gpu/drm/amd/display/dc/dc_types.h
index 432754eaf10b..a6f21f9de6e4 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_types.h
@@ -271,11 +271,6 @@ struct dc_edid_caps {
struct dc_panel_patch panel_patch;
};
-struct view {
- uint32_t width;
- uint32_t height;
-};
-
struct dc_mode_flags {
/* note: part of refresh rate flag*/
uint32_t INTERLACE :1;
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
index 98ab4b776924..a33f522a2648 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
@@ -631,8 +631,10 @@ static void dpp1_dscl_set_manual_ratio_init(
SCL_V_INIT_INT, init_int);
if (REG(SCL_VERT_FILTER_INIT_BOT)) {
- init_frac = dc_fixpt_u0d19(data->inits.v_bot) << 5;
- init_int = dc_fixpt_floor(data->inits.v_bot);
+ struct fixed31_32 bot = dc_fixpt_add(data->inits.v, data->ratios.vert);
+
+ init_frac = dc_fixpt_u0d19(bot) << 5;
+ init_int = dc_fixpt_floor(bot);
REG_SET_2(SCL_VERT_FILTER_INIT_BOT, 0,
SCL_V_INIT_FRAC_BOT, init_frac,
SCL_V_INIT_INT_BOT, init_int);
@@ -645,8 +647,10 @@ static void dpp1_dscl_set_manual_ratio_init(
SCL_V_INIT_INT_C, init_int);
if (REG(SCL_VERT_FILTER_INIT_BOT_C)) {
- init_frac = dc_fixpt_u0d19(data->inits.v_c_bot) << 5;
- init_int = dc_fixpt_floor(data->inits.v_c_bot);
+ struct fixed31_32 bot = dc_fixpt_add(data->inits.v_c, data->ratios.vert_c);
+
+ init_frac = dc_fixpt_u0d19(bot) << 5;
+ init_int = dc_fixpt_floor(bot);
REG_SET_2(SCL_VERT_FILTER_INIT_BOT_C, 0,
SCL_V_INIT_FRAC_BOT_C, init_frac,
SCL_V_INIT_INT_BOT_C, init_int);
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index 8357aa3c41d5..d7d70b9bb387 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -2289,12 +2289,14 @@ int dcn20_populate_dml_pipes_from_context(
pipes[pipe_cnt].pipe.src.source_scan = pln->rotation == ROTATION_ANGLE_90
|| pln->rotation == ROTATION_ANGLE_270 ? dm_vert : dm_horz;
- pipes[pipe_cnt].pipe.src.viewport_y_y = scl->viewport_unadjusted.y;
- pipes[pipe_cnt].pipe.src.viewport_y_c = scl->viewport_c_unadjusted.y;
- pipes[pipe_cnt].pipe.src.viewport_width = scl->viewport_unadjusted.width;
- pipes[pipe_cnt].pipe.src.viewport_width_c = scl->viewport_c_unadjusted.width;
- pipes[pipe_cnt].pipe.src.viewport_height = scl->viewport_unadjusted.height;
- pipes[pipe_cnt].pipe.src.viewport_height_c = scl->viewport_c_unadjusted.height;
+ pipes[pipe_cnt].pipe.src.viewport_y_y = scl->viewport.y;
+ pipes[pipe_cnt].pipe.src.viewport_y_c = scl->viewport_c.y;
+ pipes[pipe_cnt].pipe.src.viewport_width = scl->viewport.width;
+ pipes[pipe_cnt].pipe.src.viewport_width_c = scl->viewport_c.width;
+ pipes[pipe_cnt].pipe.src.viewport_height = scl->viewport.height;
+ pipes[pipe_cnt].pipe.src.viewport_height_c = scl->viewport_c.height;
+ pipes[pipe_cnt].pipe.src.viewport_width_max = pln->src_rect.width;
+ pipes[pipe_cnt].pipe.src.viewport_height_max = pln->src_rect.height;
pipes[pipe_cnt].pipe.src.surface_width_y = pln->plane_size.surface_size.width;
pipes[pipe_cnt].pipe.src.surface_height_y = pln->plane_size.surface_size.height;
pipes[pipe_cnt].pipe.src.surface_width_c = pln->plane_size.chroma_size.width;
diff --git a/drivers/gpu/drm/amd/display/dc/dml/display_mode_structs.h b/drivers/gpu/drm/amd/display/dc/dml/display_mode_structs.h
index 2ece3690bfa3..a0f0c54c863b 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_structs.h
+++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_structs.h
@@ -253,6 +253,8 @@ struct _vcs_dpi_display_pipe_source_params_st {
unsigned int viewport_y_c;
unsigned int viewport_width_c;
unsigned int viewport_height_c;
+ unsigned int viewport_width_max;
+ unsigned int viewport_height_max;
unsigned int data_pitch;
unsigned int data_pitch_c;
unsigned int meta_pitch;
diff --git a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
index 2a967458065b..8e5c9d22b364 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
@@ -630,6 +630,19 @@ static void fetch_pipe_params(struct display_mode_lib *mode_lib)
}
}
}
+ if (src->viewport_width_max) {
+ int hdiv_c = src->source_format >= dm_420_8 && src->source_format <= dm_422_10 ? 2 : 1;
+ int vdiv_c = src->source_format >= dm_420_8 && src->source_format <= dm_420_12 ? 2 : 1;
+
+ if (mode_lib->vba.ViewportWidth[mode_lib->vba.NumberOfActivePlanes] > src->viewport_width_max)
+ mode_lib->vba.ViewportWidth[mode_lib->vba.NumberOfActivePlanes] = src->viewport_width_max;
+ if (mode_lib->vba.ViewportHeight[mode_lib->vba.NumberOfActivePlanes] > src->viewport_height_max)
+ mode_lib->vba.ViewportHeight[mode_lib->vba.NumberOfActivePlanes] = src->viewport_height_max;
+ if (mode_lib->vba.ViewportWidthChroma[mode_lib->vba.NumberOfActivePlanes] > src->viewport_width_max / hdiv_c)
+ mode_lib->vba.ViewportWidthChroma[mode_lib->vba.NumberOfActivePlanes] = src->viewport_width_max / hdiv_c;
+ if (mode_lib->vba.ViewportHeightChroma[mode_lib->vba.NumberOfActivePlanes] > src->viewport_height_max / vdiv_c)
+ mode_lib->vba.ViewportHeightChroma[mode_lib->vba.NumberOfActivePlanes] = src->viewport_height_max / vdiv_c;
+ }
if (pipes[k].pipe.src.immediate_flip) {
mode_lib->vba.ImmediateFlipSupport = true;
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/transform.h b/drivers/gpu/drm/amd/display/dc/inc/hw/transform.h
index 2947d1b15512..2a0db2b03047 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/transform.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/transform.h
@@ -162,9 +162,7 @@ struct scl_inits {
struct fixed31_32 h;
struct fixed31_32 h_c;
struct fixed31_32 v;
- struct fixed31_32 v_bot;
struct fixed31_32 v_c;
- struct fixed31_32 v_c_bot;
};
struct scaler_data {
@@ -173,8 +171,6 @@ struct scaler_data {
struct scaling_taps taps;
struct rect viewport;
struct rect viewport_c;
- struct rect viewport_unadjusted;
- struct rect viewport_c_unadjusted;
struct rect recout;
struct scaling_ratios ratios;
struct scl_inits inits;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 045/266] drm/amdgpu/swsmu/aldebaran: fix check in is_dpm_running
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 044/266] drm/amd/display: fix odm scaling Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 046/266] net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet Greg Kroah-Hartman
` (224 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lijo Lazar, Alex Deucher, Lee Jones,
Sasha Levin
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit dd1d82c04e111b5a864638ede8965db2fe6d8653 ]
If smu_cmn_get_enabled_mask() fails, return false to be
consistent with other asics.
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Lee Jones <lee.jones@linaro.org>
Reviewed-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
index 16ad4683eb69..0d2f61f56f45 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
@@ -1290,10 +1290,13 @@ static int aldebaran_usr_edit_dpm_table(struct smu_context *smu, enum PP_OD_DPM_
static bool aldebaran_is_dpm_running(struct smu_context *smu)
{
- int ret = 0;
+ int ret;
uint32_t feature_mask[2];
unsigned long feature_enabled;
+
ret = smu_cmn_get_enabled_mask(smu, feature_mask, 2);
+ if (ret)
+ return false;
feature_enabled = (unsigned long)((uint64_t)feature_mask[0] |
((uint64_t)feature_mask[1] << 32));
return !!(feature_enabled & SMC_DPM_FEATURE);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 046/266] net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 045/266] drm/amdgpu/swsmu/aldebaran: fix check in is_dpm_running Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 047/266] net/mlx5: Fix lag port remapping logic Greg Kroah-Hartman
` (223 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Huy Nguyen, Raed Salem,
Saeed Mahameed, Sasha Levin
From: Huy Nguyen <huyn@nvidia.com>
[ Upstream commit c07274ab1ab2c38fb128e32643c22c89cb319384 ]
rep_tc copy REG_C1 to REG_B. IPsec crypto utilizes the whole REG_B
register with BIT31 as IPsec marker. rep_tc_update_skb drops
IPsec because it thought REG_B contains bad value.
In previous patch, BIT 31 of REG_C1 is reserved for IPsec.
Skip the rep_tc_update_skb if BIT31 of REG_B is set.
Signed-off-by: Huy Nguyen <huyn@nvidia.com>
Signed-off-by: Raed Salem <raeds@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index f90894eea9e0..5346271974f5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1310,7 +1310,8 @@ static void mlx5e_handle_rx_cqe_rep(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe)
if (rep->vlan && skb_vlan_tag_present(skb))
skb_vlan_pop(skb);
- if (!mlx5e_rep_tc_update_skb(cqe, skb, &tc_priv)) {
+ if (unlikely(!mlx5_ipsec_is_rx_flow(cqe) &&
+ !mlx5e_rep_tc_update_skb(cqe, skb, &tc_priv))) {
dev_kfree_skb_any(skb);
goto free_wqe;
}
@@ -1367,7 +1368,8 @@ static void mlx5e_handle_rx_cqe_mpwrq_rep(struct mlx5e_rq *rq, struct mlx5_cqe64
mlx5e_complete_rx_cqe(rq, cqe, cqe_bcnt, skb);
- if (!mlx5e_rep_tc_update_skb(cqe, skb, &tc_priv)) {
+ if (unlikely(!mlx5_ipsec_is_rx_flow(cqe) &&
+ !mlx5e_rep_tc_update_skb(cqe, skb, &tc_priv))) {
dev_kfree_skb_any(skb);
goto mpwrq_cqe_out;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 047/266] net/mlx5: Fix lag port remapping logic
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 046/266] net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 048/266] drm: rockchip: add missing registers for RK3188 Greg Kroah-Hartman
` (222 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eli Cohen, Saeed Mahameed, Sasha Levin
From: Eli Cohen <elic@nvidia.com>
[ Upstream commit 8613641063617c1dfc731b403b3ee4935ef15f87 ]
Fix the logic so that if both ports netdevices are enabled or disabled,
use the trivial mapping without swapping.
If only one of the netdevice's tx is enabled, use it to remap traffic to
that port.
Signed-off-by: Eli Cohen <elic@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/lag.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index b8748390335f..9ce144ef8326 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -118,17 +118,24 @@ static bool __mlx5_lag_is_sriov(struct mlx5_lag *ldev)
static void mlx5_infer_tx_affinity_mapping(struct lag_tracker *tracker,
u8 *port1, u8 *port2)
{
+ bool p1en;
+ bool p2en;
+
+ p1en = tracker->netdev_state[MLX5_LAG_P1].tx_enabled &&
+ tracker->netdev_state[MLX5_LAG_P1].link_up;
+
+ p2en = tracker->netdev_state[MLX5_LAG_P2].tx_enabled &&
+ tracker->netdev_state[MLX5_LAG_P2].link_up;
+
*port1 = 1;
*port2 = 2;
- if (!tracker->netdev_state[MLX5_LAG_P1].tx_enabled ||
- !tracker->netdev_state[MLX5_LAG_P1].link_up) {
- *port1 = 2;
+ if ((!p1en && !p2en) || (p1en && p2en))
return;
- }
- if (!tracker->netdev_state[MLX5_LAG_P2].tx_enabled ||
- !tracker->netdev_state[MLX5_LAG_P2].link_up)
+ if (p1en)
*port2 = 1;
+ else
+ *port1 = 2;
}
void mlx5_modify_lag(struct mlx5_lag *ldev,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 048/266] drm: rockchip: add missing registers for RK3188
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 047/266] net/mlx5: Fix lag port remapping logic Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 049/266] drm: rockchip: add missing registers for RK3066 Greg Kroah-Hartman
` (221 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Bee, Heiko Stuebner, Sasha Levin
From: Alex Bee <knaerzche@gmail.com>
[ Upstream commit ab64b448a175b8a5a4bd323b8f74758c2574482c ]
Add dither_up, dsp_lut_en and data_blank registers to enable their
respective functionality for RK3188's VOP.
While at that also fix .dsp_blank register which is (only) set with
BIT24 (same as RK3066)
Signed-off-by: Alex Bee <knaerzche@gmail.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210528130554.72191-3-knaerzche@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
index 80053d91a301..b8dcee64a1f7 100644
--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
@@ -505,7 +505,10 @@ static const struct vop_common rk3188_common = {
.dither_down_sel = VOP_REG(RK3188_DSP_CTRL0, 0x1, 27),
.dither_down_en = VOP_REG(RK3188_DSP_CTRL0, 0x1, 11),
.dither_down_mode = VOP_REG(RK3188_DSP_CTRL0, 0x1, 10),
- .dsp_blank = VOP_REG(RK3188_DSP_CTRL1, 0x3, 24),
+ .dsp_blank = VOP_REG(RK3188_DSP_CTRL1, 0x1, 24),
+ .dither_up = VOP_REG(RK3188_DSP_CTRL0, 0x1, 9),
+ .dsp_lut_en = VOP_REG(RK3188_SYS_CTRL, 0x1, 28),
+ .data_blank = VOP_REG(RK3188_DSP_CTRL1, 0x1, 25),
};
static const struct vop_win_data rk3188_vop_win_data[] = {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 049/266] drm: rockchip: add missing registers for RK3066
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 048/266] drm: rockchip: add missing registers for RK3188 Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 050/266] net: stmmac: the XPCS obscures a potential "PHY not found" error Greg Kroah-Hartman
` (220 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Bee, Heiko Stuebner, Sasha Levin
From: Alex Bee <knaerzche@gmail.com>
[ Upstream commit 742203cd56d150eb7884eb45abb7d9dbc2bdbf04 ]
Add dither_up, dsp_lut_en and data_blank registers to enable their
respective functionality for RK3066's VOP.
While at that also fix .rb_swap and .format registers for all windows,
which have to be set though RK3066_SYS_CTRL1 register.
Also remove .scl from win1: Scaling is only supported on the primary
plane.
Signed-off-by: Alex Bee <knaerzche@gmail.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210528130554.72191-4-knaerzche@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
index b8dcee64a1f7..a6fe03c3748a 100644
--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
@@ -349,8 +349,8 @@ static const struct vop_win_phy rk3066_win0_data = {
.nformats = ARRAY_SIZE(formats_win_full),
.format_modifiers = format_modifiers_win_full,
.enable = VOP_REG(RK3066_SYS_CTRL1, 0x1, 0),
- .format = VOP_REG(RK3066_SYS_CTRL0, 0x7, 4),
- .rb_swap = VOP_REG(RK3066_SYS_CTRL0, 0x1, 19),
+ .format = VOP_REG(RK3066_SYS_CTRL1, 0x7, 4),
+ .rb_swap = VOP_REG(RK3066_SYS_CTRL1, 0x1, 19),
.act_info = VOP_REG(RK3066_WIN0_ACT_INFO, 0x1fff1fff, 0),
.dsp_info = VOP_REG(RK3066_WIN0_DSP_INFO, 0x0fff0fff, 0),
.dsp_st = VOP_REG(RK3066_WIN0_DSP_ST, 0x1fff1fff, 0),
@@ -361,13 +361,12 @@ static const struct vop_win_phy rk3066_win0_data = {
};
static const struct vop_win_phy rk3066_win1_data = {
- .scl = &rk3066_win_scl,
.data_formats = formats_win_full,
.nformats = ARRAY_SIZE(formats_win_full),
.format_modifiers = format_modifiers_win_full,
.enable = VOP_REG(RK3066_SYS_CTRL1, 0x1, 1),
- .format = VOP_REG(RK3066_SYS_CTRL0, 0x7, 7),
- .rb_swap = VOP_REG(RK3066_SYS_CTRL0, 0x1, 23),
+ .format = VOP_REG(RK3066_SYS_CTRL1, 0x7, 7),
+ .rb_swap = VOP_REG(RK3066_SYS_CTRL1, 0x1, 23),
.act_info = VOP_REG(RK3066_WIN1_ACT_INFO, 0x1fff1fff, 0),
.dsp_info = VOP_REG(RK3066_WIN1_DSP_INFO, 0x0fff0fff, 0),
.dsp_st = VOP_REG(RK3066_WIN1_DSP_ST, 0x1fff1fff, 0),
@@ -382,8 +381,8 @@ static const struct vop_win_phy rk3066_win2_data = {
.nformats = ARRAY_SIZE(formats_win_lite),
.format_modifiers = format_modifiers_win_lite,
.enable = VOP_REG(RK3066_SYS_CTRL1, 0x1, 2),
- .format = VOP_REG(RK3066_SYS_CTRL0, 0x7, 10),
- .rb_swap = VOP_REG(RK3066_SYS_CTRL0, 0x1, 27),
+ .format = VOP_REG(RK3066_SYS_CTRL1, 0x7, 10),
+ .rb_swap = VOP_REG(RK3066_SYS_CTRL1, 0x1, 27),
.dsp_info = VOP_REG(RK3066_WIN2_DSP_INFO, 0x0fff0fff, 0),
.dsp_st = VOP_REG(RK3066_WIN2_DSP_ST, 0x1fff1fff, 0),
.yrgb_mst = VOP_REG(RK3066_WIN2_MST, 0xffffffff, 0),
@@ -408,6 +407,9 @@ static const struct vop_common rk3066_common = {
.dither_down_en = VOP_REG(RK3066_DSP_CTRL0, 0x1, 11),
.dither_down_mode = VOP_REG(RK3066_DSP_CTRL0, 0x1, 10),
.dsp_blank = VOP_REG(RK3066_DSP_CTRL1, 0x1, 24),
+ .dither_up = VOP_REG(RK3066_DSP_CTRL0, 0x1, 9),
+ .dsp_lut_en = VOP_REG(RK3066_SYS_CTRL1, 0x1, 31),
+ .data_blank = VOP_REG(RK3066_DSP_CTRL1, 0x1, 25),
};
static const struct vop_win_data rk3066_vop_win_data[] = {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 050/266] net: stmmac: the XPCS obscures a potential "PHY not found" error
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 049/266] drm: rockchip: add missing registers for RK3066 Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 051/266] RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH Greg Kroah-Hartman
` (219 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Jakub Kicinski, Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 4751d2aa321f2828d8c5d2f7ce4ed18a01e47f46 ]
stmmac_mdio_register() has logic to search for PHYs on the MDIO bus and
assign them IRQ lines, as well as to set priv->plat->phy_addr.
If no PHY is found, the "found" variable remains set to 0 and the
function errors out.
After the introduction of commit f213bbe8a9d6 ("net: stmmac: Integrate
it with DesignWare XPCS"), the "found" variable was immediately reused
for searching for a PCS on the same MDIO bus.
This can result in 2 types of potential problems (none of them seems to
be seen on the only Intel system that sets has_xpcs = true, otherwise it
would have been reported):
1. If a PCS is found but a PHY is not, then the code happily exits with
no error. One might say "yes, but this is not possible, because
of_mdiobus_register will probe a PHY for all MDIO addresses,
including for the XPCS, so if an XPCS exists, then a PHY certainly
exists too". Well, that is not true, see intel_mgbe_common_data():
/* Ensure mdio bus scan skips intel serdes and pcs-xpcs */
plat->mdio_bus_data->phy_mask = 1 << INTEL_MGBE_ADHOC_ADDR;
plat->mdio_bus_data->phy_mask |= 1 << INTEL_MGBE_XPCS_ADDR;
2. A PHY is found but an MDIO device with the XPCS PHY ID isn't, and in
that case, the error message will be "No PHY found". Confusing.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/20210527155959.3270478-1-olteanv@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/stmicro/stmmac/stmmac_mdio.c | 21 +++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index b750074f8f9c..e293bf1ce9f3 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -503,6 +503,12 @@ int stmmac_mdio_register(struct net_device *ndev)
found = 1;
}
+ if (!found && !mdio_node) {
+ dev_warn(dev, "No PHY found\n");
+ err = -ENODEV;
+ goto no_phy_found;
+ }
+
/* Try to probe the XPCS by scanning all addresses. */
if (priv->hw->xpcs) {
struct mdio_xpcs_args *xpcs = &priv->hw->xpcs_args;
@@ -511,6 +517,7 @@ int stmmac_mdio_register(struct net_device *ndev)
xpcs->bus = new_bus;
+ found = 0;
for (addr = 0; addr < max_addr; addr++) {
xpcs->addr = addr;
@@ -520,13 +527,12 @@ int stmmac_mdio_register(struct net_device *ndev)
break;
}
}
- }
- if (!found && !mdio_node) {
- dev_warn(dev, "No PHY found\n");
- mdiobus_unregister(new_bus);
- mdiobus_free(new_bus);
- return -ENODEV;
+ if (!found && !mdio_node) {
+ dev_warn(dev, "No XPCS found\n");
+ err = -ENODEV;
+ goto no_xpcs_found;
+ }
}
bus_register_done:
@@ -534,6 +540,9 @@ bus_register_done:
return 0;
+no_xpcs_found:
+no_phy_found:
+ mdiobus_unregister(new_bus);
bus_register_fail:
mdiobus_free(new_bus);
return err;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 051/266] RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 050/266] net: stmmac: the XPCS obscures a potential "PHY not found" error Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 052/266] drm/tegra: hub: Fix YUV support Greg Kroah-Hartman
` (218 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gioh Kim, Jack Wang,
kernel test robot, Jason Gunthorpe, Sasha Levin
From: Gioh Kim <gi-oh.kim@cloud.ionos.com>
[ Upstream commit 3a98ea7041b7d18ac356da64823c2ba2f8391b3e ]
Max IB immediate data size is 2^28 (MAX_IMM_PAYL_BITS)
and the minimum chunk size is 4096 (2^12).
Therefore the maximum sess_queue_depth is 65536 (2^16).
Link: https://lore.kernel.org/r/20210528113018.52290-6-jinpu.wang@ionos.com
Signed-off-by: Gioh Kim <gi-oh.kim@ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/rtrs/rtrs-pri.h | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-pri.h b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
index 86e65cf30cab..d957bbf1ddd3 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+++ b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
@@ -47,12 +47,15 @@ enum {
MAX_PATHS_NUM = 128,
/*
- * With the size of struct rtrs_permit allocated on the client, 4K
- * is the maximum number of rtrs_permits we can allocate. This number is
- * also used on the client to allocate the IU for the user connection
- * to receive the RDMA addresses from the server.
+ * Max IB immediate data size is 2^28 (MAX_IMM_PAYL_BITS)
+ * and the minimum chunk size is 4096 (2^12).
+ * So the maximum sess_queue_depth is 65536 (2^16) in theory.
+ * But mempool_create, create_qp and ib_post_send fail with
+ * "cannot allocate memory" error if sess_queue_depth is too big.
+ * Therefore the pratical max value of sess_queue_depth is
+ * somewhere between 1 and 65536 and it depends on the system.
*/
- MAX_SESS_QUEUE_DEPTH = 4096,
+ MAX_SESS_QUEUE_DEPTH = 65536,
RTRS_HB_INTERVAL_MS = 5000,
RTRS_HB_MISSED_MAX = 5,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 052/266] drm/tegra: hub: Fix YUV support
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 051/266] RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 053/266] clk: tegra: Fix refcounting of gate clocks Greg Kroah-Hartman
` (217 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thierry Reding, Sasha Levin
From: Thierry Reding <treding@nvidia.com>
[ Upstream commit e16efff4e5f490ce34a8c60d9ae7297dca5eb616 ]
The driver currently exposes several YUV formats but fails to properly
program all the registers needed to display such formats. Add the right
programming sequences so that overlay windows can be used to accelerate
color format conversions in multimedia playback use-cases.
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/dc.c | 2 +-
drivers/gpu/drm/tegra/dc.h | 7 +++++
drivers/gpu/drm/tegra/hub.c | 52 +++++++++++++++++++++++++++++++----
drivers/gpu/drm/tegra/plane.c | 23 ++++++++++++++--
drivers/gpu/drm/tegra/plane.h | 3 +-
5 files changed, 78 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index f9120dc24682..c5ea88a686d1 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -348,7 +348,7 @@ static void tegra_dc_setup_window(struct tegra_plane *plane,
* For YUV planar modes, the number of bytes per pixel takes into
* account only the luma component and therefore is 1.
*/
- yuv = tegra_plane_format_is_yuv(window->format, &planar);
+ yuv = tegra_plane_format_is_yuv(window->format, &planar, NULL);
if (!yuv)
bpp = window->bits_per_pixel / 8;
else
diff --git a/drivers/gpu/drm/tegra/dc.h b/drivers/gpu/drm/tegra/dc.h
index 29f19c3c6149..455c3fdef8dc 100644
--- a/drivers/gpu/drm/tegra/dc.h
+++ b/drivers/gpu/drm/tegra/dc.h
@@ -696,6 +696,9 @@ int tegra_dc_rgb_exit(struct tegra_dc *dc);
#define DC_WINBUF_START_ADDR_HI 0x80d
+#define DC_WINBUF_START_ADDR_HI_U 0x80f
+#define DC_WINBUF_START_ADDR_HI_V 0x811
+
#define DC_WINBUF_CDE_CONTROL 0x82f
#define ENABLE_SURFACE (1 << 0)
@@ -720,6 +723,10 @@ int tegra_dc_rgb_exit(struct tegra_dc *dc);
#define DC_WIN_PLANAR_STORAGE 0x709
#define PITCH(x) (((x) >> 6) & 0x1fff)
+#define DC_WIN_PLANAR_STORAGE_UV 0x70a
+#define PITCH_U(x) ((((x) >> 6) & 0x1fff) << 0)
+#define PITCH_V(x) ((((x) >> 6) & 0x1fff) << 16)
+
#define DC_WIN_SET_PARAMS 0x70d
#define CLAMP_BEFORE_BLEND (1 << 15)
#define DEGAMMA_NONE (0 << 13)
diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c
index bfae8a02f55b..94e1ccfb6235 100644
--- a/drivers/gpu/drm/tegra/hub.c
+++ b/drivers/gpu/drm/tegra/hub.c
@@ -454,7 +454,9 @@ static void tegra_shared_plane_atomic_update(struct drm_plane *plane,
unsigned int zpos = new_state->normalized_zpos;
struct drm_framebuffer *fb = new_state->fb;
struct tegra_plane *p = to_tegra_plane(plane);
- dma_addr_t base;
+ dma_addr_t base, addr_flag = 0;
+ unsigned int bpc;
+ bool yuv, planar;
u32 value;
int err;
@@ -473,6 +475,8 @@ static void tegra_shared_plane_atomic_update(struct drm_plane *plane,
return;
}
+ yuv = tegra_plane_format_is_yuv(tegra_plane_state->format, &planar, &bpc);
+
tegra_dc_assign_shared_plane(dc, p);
tegra_plane_writel(p, VCOUNTER, DC_WIN_CORE_ACT_CONTROL);
@@ -501,8 +505,6 @@ static void tegra_shared_plane_atomic_update(struct drm_plane *plane,
/* disable compression */
tegra_plane_writel(p, 0, DC_WINBUF_CDE_CONTROL);
- base = tegra_plane_state->iova[0] + fb->offsets[0];
-
#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
/*
* Physical address bit 39 in Tegra194 is used as a switch for special
@@ -510,9 +512,12 @@ static void tegra_shared_plane_atomic_update(struct drm_plane *plane,
* dGPU sector layout.
*/
if (tegra_plane_state->tiling.sector_layout == TEGRA_BO_SECTOR_LAYOUT_GPU)
- base |= BIT_ULL(39);
+ addr_flag = BIT_ULL(39);
#endif
+ base = tegra_plane_state->iova[0] + fb->offsets[0];
+ base |= addr_flag;
+
tegra_plane_writel(p, tegra_plane_state->format, DC_WIN_COLOR_DEPTH);
tegra_plane_writel(p, 0, DC_WIN_PRECOMP_WGRP_PARAMS);
@@ -535,7 +540,44 @@ static void tegra_shared_plane_atomic_update(struct drm_plane *plane,
value = PITCH(fb->pitches[0]);
tegra_plane_writel(p, value, DC_WIN_PLANAR_STORAGE);
- value = CLAMP_BEFORE_BLEND | DEGAMMA_SRGB | INPUT_RANGE_FULL;
+ if (yuv && planar) {
+ base = tegra_plane_state->iova[1] + fb->offsets[1];
+ base |= addr_flag;
+
+ tegra_plane_writel(p, upper_32_bits(base), DC_WINBUF_START_ADDR_HI_U);
+ tegra_plane_writel(p, lower_32_bits(base), DC_WINBUF_START_ADDR_U);
+
+ base = tegra_plane_state->iova[2] + fb->offsets[2];
+ base |= addr_flag;
+
+ tegra_plane_writel(p, upper_32_bits(base), DC_WINBUF_START_ADDR_HI_V);
+ tegra_plane_writel(p, lower_32_bits(base), DC_WINBUF_START_ADDR_V);
+
+ value = PITCH_U(fb->pitches[2]) | PITCH_V(fb->pitches[2]);
+ tegra_plane_writel(p, value, DC_WIN_PLANAR_STORAGE_UV);
+ } else {
+ tegra_plane_writel(p, 0, DC_WINBUF_START_ADDR_U);
+ tegra_plane_writel(p, 0, DC_WINBUF_START_ADDR_HI_U);
+ tegra_plane_writel(p, 0, DC_WINBUF_START_ADDR_V);
+ tegra_plane_writel(p, 0, DC_WINBUF_START_ADDR_HI_V);
+ tegra_plane_writel(p, 0, DC_WIN_PLANAR_STORAGE_UV);
+ }
+
+ value = CLAMP_BEFORE_BLEND | INPUT_RANGE_FULL;
+
+ if (yuv) {
+ if (bpc < 12)
+ value |= DEGAMMA_YUV8_10;
+ else
+ value |= DEGAMMA_YUV12;
+
+ /* XXX parameterize */
+ value |= COLOR_SPACE_YUV_2020;
+ } else {
+ if (!tegra_plane_format_is_indexed(tegra_plane_state->format))
+ value |= DEGAMMA_SRGB;
+ }
+
tegra_plane_writel(p, value, DC_WIN_SET_PARAMS);
value = OFFSET_X(new_state->src_y >> 16) |
diff --git a/drivers/gpu/drm/tegra/plane.c b/drivers/gpu/drm/tegra/plane.c
index 2e11b4b1f702..2e65b4075ce6 100644
--- a/drivers/gpu/drm/tegra/plane.c
+++ b/drivers/gpu/drm/tegra/plane.c
@@ -375,7 +375,20 @@ int tegra_plane_format(u32 fourcc, u32 *format, u32 *swap)
return 0;
}
-bool tegra_plane_format_is_yuv(unsigned int format, bool *planar)
+bool tegra_plane_format_is_indexed(unsigned int format)
+{
+ switch (format) {
+ case WIN_COLOR_DEPTH_P1:
+ case WIN_COLOR_DEPTH_P2:
+ case WIN_COLOR_DEPTH_P4:
+ case WIN_COLOR_DEPTH_P8:
+ return true;
+ }
+
+ return false;
+}
+
+bool tegra_plane_format_is_yuv(unsigned int format, bool *planar, unsigned int *bpc)
{
switch (format) {
case WIN_COLOR_DEPTH_YCbCr422:
@@ -383,6 +396,9 @@ bool tegra_plane_format_is_yuv(unsigned int format, bool *planar)
if (planar)
*planar = false;
+ if (bpc)
+ *bpc = 8;
+
return true;
case WIN_COLOR_DEPTH_YCbCr420P:
@@ -396,6 +412,9 @@ bool tegra_plane_format_is_yuv(unsigned int format, bool *planar)
if (planar)
*planar = true;
+ if (bpc)
+ *bpc = 8;
+
return true;
}
@@ -421,7 +440,7 @@ static bool __drm_format_has_alpha(u32 format)
static int tegra_plane_format_get_alpha(unsigned int opaque,
unsigned int *alpha)
{
- if (tegra_plane_format_is_yuv(opaque, NULL)) {
+ if (tegra_plane_format_is_yuv(opaque, NULL, NULL)) {
*alpha = opaque;
return 0;
}
diff --git a/drivers/gpu/drm/tegra/plane.h b/drivers/gpu/drm/tegra/plane.h
index c691dd79b27b..1785c1559c0c 100644
--- a/drivers/gpu/drm/tegra/plane.h
+++ b/drivers/gpu/drm/tegra/plane.h
@@ -74,7 +74,8 @@ int tegra_plane_state_add(struct tegra_plane *plane,
struct drm_plane_state *state);
int tegra_plane_format(u32 fourcc, u32 *format, u32 *swap);
-bool tegra_plane_format_is_yuv(unsigned int format, bool *planar);
+bool tegra_plane_format_is_indexed(unsigned int format);
+bool tegra_plane_format_is_yuv(unsigned int format, bool *planar, unsigned int *bpc);
int tegra_plane_setup_legacy_state(struct tegra_plane *tegra,
struct tegra_plane_state *state);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 053/266] clk: tegra: Fix refcounting of gate clocks
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 052/266] drm/tegra: hub: Fix YUV support Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 054/266] clk: tegra: Ensure that PLLU configuration is applied properly Greg Kroah-Hartman
` (216 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thierry Reding, Dmitry Osipenko, Sasha Levin
From: Dmitry Osipenko <digetx@gmail.com>
[ Upstream commit c592c8a28f5821e880ac6675781cd8a151b0737c ]
The refcounting of the gate clocks has a bug causing the enable_refcnt
to underflow when unused clocks are disabled. This happens because clk
provider erroneously bumps the refcount if clock is enabled at a boot
time, which it shouldn't be doing, and it does this only for the gate
clocks, while peripheral clocks are using the same gate ops and the
peripheral clocks are missing the initial bump. Hence the refcount of
the peripheral clocks is 0 when unused clocks are disabled and then the
counter is decremented further by the gate ops, causing the integer
underflow.
Fix this problem by removing the erroneous bump and by implementing the
disable_unused() callback, which disables the unused gates properly.
The visible effect of the bug is such that the unused clocks are never
gated if a loaded kernel module grabs the unused clocks and starts to use
them. In practice this shouldn't cause any real problems for the drivers
and boards supported by the kernel today.
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-periph-gate.c | 72 +++++++++++++++++++----------
drivers/clk/tegra/clk-periph.c | 11 +++++
2 files changed, 58 insertions(+), 25 deletions(-)
diff --git a/drivers/clk/tegra/clk-periph-gate.c b/drivers/clk/tegra/clk-periph-gate.c
index 4b31beefc9fc..dc3f92678407 100644
--- a/drivers/clk/tegra/clk-periph-gate.c
+++ b/drivers/clk/tegra/clk-periph-gate.c
@@ -48,18 +48,9 @@ static int clk_periph_is_enabled(struct clk_hw *hw)
return state;
}
-static int clk_periph_enable(struct clk_hw *hw)
+static void clk_periph_enable_locked(struct clk_hw *hw)
{
struct tegra_clk_periph_gate *gate = to_clk_periph_gate(hw);
- unsigned long flags = 0;
-
- spin_lock_irqsave(&periph_ref_lock, flags);
-
- gate->enable_refcnt[gate->clk_num]++;
- if (gate->enable_refcnt[gate->clk_num] > 1) {
- spin_unlock_irqrestore(&periph_ref_lock, flags);
- return 0;
- }
write_enb_set(periph_clk_to_bit(gate), gate);
udelay(2);
@@ -78,6 +69,32 @@ static int clk_periph_enable(struct clk_hw *hw)
udelay(1);
writel_relaxed(0, gate->clk_base + LVL2_CLK_GATE_OVRE);
}
+}
+
+static void clk_periph_disable_locked(struct clk_hw *hw)
+{
+ struct tegra_clk_periph_gate *gate = to_clk_periph_gate(hw);
+
+ /*
+ * If peripheral is in the APB bus then read the APB bus to
+ * flush the write operation in apb bus. This will avoid the
+ * peripheral access after disabling clock
+ */
+ if (gate->flags & TEGRA_PERIPH_ON_APB)
+ tegra_read_chipid();
+
+ write_enb_clr(periph_clk_to_bit(gate), gate);
+}
+
+static int clk_periph_enable(struct clk_hw *hw)
+{
+ struct tegra_clk_periph_gate *gate = to_clk_periph_gate(hw);
+ unsigned long flags = 0;
+
+ spin_lock_irqsave(&periph_ref_lock, flags);
+
+ if (!gate->enable_refcnt[gate->clk_num]++)
+ clk_periph_enable_locked(hw);
spin_unlock_irqrestore(&periph_ref_lock, flags);
@@ -91,21 +108,28 @@ static void clk_periph_disable(struct clk_hw *hw)
spin_lock_irqsave(&periph_ref_lock, flags);
- gate->enable_refcnt[gate->clk_num]--;
- if (gate->enable_refcnt[gate->clk_num] > 0) {
- spin_unlock_irqrestore(&periph_ref_lock, flags);
- return;
- }
+ WARN_ON(!gate->enable_refcnt[gate->clk_num]);
+
+ if (--gate->enable_refcnt[gate->clk_num] == 0)
+ clk_periph_disable_locked(hw);
+
+ spin_unlock_irqrestore(&periph_ref_lock, flags);
+}
+
+static void clk_periph_disable_unused(struct clk_hw *hw)
+{
+ struct tegra_clk_periph_gate *gate = to_clk_periph_gate(hw);
+ unsigned long flags = 0;
+
+ spin_lock_irqsave(&periph_ref_lock, flags);
/*
- * If peripheral is in the APB bus then read the APB bus to
- * flush the write operation in apb bus. This will avoid the
- * peripheral access after disabling clock
+ * Some clocks are duplicated and some of them are marked as critical,
+ * like fuse and fuse_burn for example, thus the enable_refcnt will
+ * be non-zero here if the "unused" duplicate is disabled by CCF.
*/
- if (gate->flags & TEGRA_PERIPH_ON_APB)
- tegra_read_chipid();
-
- write_enb_clr(periph_clk_to_bit(gate), gate);
+ if (!gate->enable_refcnt[gate->clk_num])
+ clk_periph_disable_locked(hw);
spin_unlock_irqrestore(&periph_ref_lock, flags);
}
@@ -114,6 +138,7 @@ const struct clk_ops tegra_clk_periph_gate_ops = {
.is_enabled = clk_periph_is_enabled,
.enable = clk_periph_enable,
.disable = clk_periph_disable,
+ .disable_unused = clk_periph_disable_unused,
};
struct clk *tegra_clk_register_periph_gate(const char *name,
@@ -148,9 +173,6 @@ struct clk *tegra_clk_register_periph_gate(const char *name,
gate->enable_refcnt = enable_refcnt;
gate->regs = pregs;
- if (read_enb(gate) & periph_clk_to_bit(gate))
- enable_refcnt[clk_num]++;
-
/* Data in .init is copied by clk_register(), so stack variable OK */
gate->hw.init = &init;
diff --git a/drivers/clk/tegra/clk-periph.c b/drivers/clk/tegra/clk-periph.c
index 67620c7ecd9e..79ca3aa072b7 100644
--- a/drivers/clk/tegra/clk-periph.c
+++ b/drivers/clk/tegra/clk-periph.c
@@ -100,6 +100,15 @@ static void clk_periph_disable(struct clk_hw *hw)
gate_ops->disable(gate_hw);
}
+static void clk_periph_disable_unused(struct clk_hw *hw)
+{
+ struct tegra_clk_periph *periph = to_clk_periph(hw);
+ const struct clk_ops *gate_ops = periph->gate_ops;
+ struct clk_hw *gate_hw = &periph->gate.hw;
+
+ gate_ops->disable_unused(gate_hw);
+}
+
static void clk_periph_restore_context(struct clk_hw *hw)
{
struct tegra_clk_periph *periph = to_clk_periph(hw);
@@ -126,6 +135,7 @@ const struct clk_ops tegra_clk_periph_ops = {
.is_enabled = clk_periph_is_enabled,
.enable = clk_periph_enable,
.disable = clk_periph_disable,
+ .disable_unused = clk_periph_disable_unused,
.restore_context = clk_periph_restore_context,
};
@@ -135,6 +145,7 @@ static const struct clk_ops tegra_clk_periph_nodiv_ops = {
.is_enabled = clk_periph_is_enabled,
.enable = clk_periph_enable,
.disable = clk_periph_disable,
+ .disable_unused = clk_periph_disable_unused,
.restore_context = clk_periph_restore_context,
};
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 054/266] clk: tegra: Ensure that PLLU configuration is applied properly
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 053/266] clk: tegra: Fix refcounting of gate clocks Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 055/266] drm: bridge: cdns-mhdp8546: Fix PM reference leak in Greg Kroah-Hartman
` (215 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thierry Reding, Dmitry Osipenko, Sasha Levin
From: Dmitry Osipenko <digetx@gmail.com>
[ Upstream commit a7196048cd5168096c2c4f44a3939d7a6dcd06b9 ]
The PLLU (USB) consists of the PLL configuration itself and configuration
of the PLLU outputs. The PLLU programming is inconsistent on T30 vs T114,
where T114 immediately bails out if PLLU is enabled and T30 re-enables
a potentially already enabled PLL (left after bootloader) and then fully
reprograms it, which could be unsafe to do. The correct way should be to
skip enabling of the PLL if it's already enabled and then apply
configuration to the outputs. This patch doesn't fix any known problems,
it's a minor improvement.
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-pll.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
index 0193cebe8c5a..823a567f2adc 100644
--- a/drivers/clk/tegra/clk-pll.c
+++ b/drivers/clk/tegra/clk-pll.c
@@ -1131,7 +1131,8 @@ static int clk_pllu_enable(struct clk_hw *hw)
if (pll->lock)
spin_lock_irqsave(pll->lock, flags);
- _clk_pll_enable(hw);
+ if (!clk_pll_is_enabled(hw))
+ _clk_pll_enable(hw);
ret = clk_pll_wait_for_lock(pll);
if (ret < 0)
@@ -1748,15 +1749,13 @@ static int clk_pllu_tegra114_enable(struct clk_hw *hw)
return -EINVAL;
}
- if (clk_pll_is_enabled(hw))
- return 0;
-
input_rate = clk_hw_get_rate(__clk_get_hw(osc));
if (pll->lock)
spin_lock_irqsave(pll->lock, flags);
- _clk_pll_enable(hw);
+ if (!clk_pll_is_enabled(hw))
+ _clk_pll_enable(hw);
ret = clk_pll_wait_for_lock(pll);
if (ret < 0)
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 055/266] drm: bridge: cdns-mhdp8546: Fix PM reference leak in
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 054/266] clk: tegra: Ensure that PLLU configuration is applied properly Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 056/266] virtio-net: Add validation for used length Greg Kroah-Hartman
` (214 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yu Kuai, Robert Foss,
Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit f674555ee5444c8987dfea0922f1cf6bf0c12847 ]
pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in reference leak here.
Fix it by replacing it with pm_runtime_resume_and_get to keep usage
counter balanced.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210531135622.3348252-1-yukuai3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
index 989a05bc8197..ddcd5b6ad37a 100644
--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
@@ -2369,9 +2369,9 @@ static int cdns_mhdp_probe(struct platform_device *pdev)
clk_prepare_enable(clk);
pm_runtime_enable(dev);
- ret = pm_runtime_get_sync(dev);
+ ret = pm_runtime_resume_and_get(dev);
if (ret < 0) {
- dev_err(dev, "pm_runtime_get_sync failed\n");
+ dev_err(dev, "pm_runtime_resume_and_get failed\n");
pm_runtime_disable(dev);
goto clk_disable;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 056/266] virtio-net: Add validation for used length
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 055/266] drm: bridge: cdns-mhdp8546: Fix PM reference leak in Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 057/266] ipv6: use prandom_u32() for ID generation Greg Kroah-Hartman
` (213 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xie Yongji, Jason Wang,
Jakub Kicinski, Sasha Levin
From: Xie Yongji <xieyongji@bytedance.com>
[ Upstream commit ad993a95c508417acdeb15244109e009e50d8758 ]
This adds validation for used length (might come
from an untrusted device) to avoid data corruption
or loss.
Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20210531135852.113-1-xieyongji@bytedance.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 78a01c71a17c..252f6718d730 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -721,6 +721,12 @@ static struct sk_buff *receive_small(struct net_device *dev,
len -= vi->hdr_len;
stats->bytes += len;
+ if (unlikely(len > GOOD_PACKET_LEN)) {
+ pr_debug("%s: rx error: len %u exceeds max size %d\n",
+ dev->name, len, GOOD_PACKET_LEN);
+ dev->stats.rx_length_errors++;
+ goto err_len;
+ }
rcu_read_lock();
xdp_prog = rcu_dereference(rq->xdp_prog);
if (xdp_prog) {
@@ -824,6 +830,7 @@ err:
err_xdp:
rcu_read_unlock();
stats->xdp_drops++;
+err_len:
stats->drops++;
put_page(page);
xdp_xmit:
@@ -877,6 +884,12 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
head_skb = NULL;
stats->bytes += len - vi->hdr_len;
+ if (unlikely(len > truesize)) {
+ pr_debug("%s: rx error: len %u exceeds truesize %lu\n",
+ dev->name, len, (unsigned long)ctx);
+ dev->stats.rx_length_errors++;
+ goto err_skb;
+ }
rcu_read_lock();
xdp_prog = rcu_dereference(rq->xdp_prog);
if (xdp_prog) {
@@ -1004,13 +1017,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
}
rcu_read_unlock();
- if (unlikely(len > truesize)) {
- pr_debug("%s: rx error: len %u exceeds truesize %lu\n",
- dev->name, len, (unsigned long)ctx);
- dev->stats.rx_length_errors++;
- goto err_skb;
- }
-
head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog,
metasize, headroom);
curr_skb = head_skb;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 057/266] ipv6: use prandom_u32() for ID generation
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 056/266] virtio-net: Add validation for used length Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 058/266] MIPS: cpu-probe: Fix FPU detection on Ingenic JZ4760(B) Greg Kroah-Hartman
` (212 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Amit Klein, Willy Tarreau,
Eric Dumazet, Jakub Kicinski, Sasha Levin
From: Willy Tarreau <w@1wt.eu>
[ Upstream commit 62f20e068ccc50d6ab66fdb72ba90da2b9418c99 ]
This is a complement to commit aa6dd211e4b1 ("inet: use bigger hash
table for IP ID generation"), but focusing on some specific aspects
of IPv6.
Contary to IPv4, IPv6 only uses packet IDs with fragments, and with a
minimum MTU of 1280, it's much less easy to force a remote peer to
produce many fragments to explore its ID sequence. In addition packet
IDs are 32-bit in IPv6, which further complicates their analysis. On
the other hand, it is often easier to choose among plenty of possible
source addresses and partially work around the bigger hash table the
commit above permits, which leaves IPv6 partially exposed to some
possibilities of remote analysis at the risk of weakening some
protocols like DNS if some IDs can be predicted with a good enough
probability.
Given the wide range of permitted IDs, the risk of collision is extremely
low so there's no need to rely on the positive increment algorithm that
is shared with the IPv4 code via ip_idents_reserve(). We have a fast
PRNG, so let's simply call prandom_u32() and be done with it.
Performance measurements at 10 Gbps couldn't show any difference with
the previous code, even when using a single core, because due to the
large fragments, we're limited to only ~930 kpps at 10 Gbps and the cost
of the random generation is completely offset by other operations and by
the network transfer time. In addition, this change removes the need to
update a shared entry in the idents table so it may even end up being
slightly faster on large scale systems where this matters.
The risk of at least one collision here is about 1/80 million among
10 IDs, 1/850k among 100 IDs, and still only 1/8.5k among 1000 IDs,
which remains very low compared to IPv4 where all IDs are reused
every 4 to 80ms on a 10 Gbps flow depending on packet sizes.
Reported-by: Amit Klein <aksecurity@gmail.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20210529110746.6796-1-w@1wt.eu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/output_core.c | 28 +++++-----------------------
1 file changed, 5 insertions(+), 23 deletions(-)
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index af36acc1a644..2880dc7d9a49 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -15,29 +15,11 @@ static u32 __ipv6_select_ident(struct net *net,
const struct in6_addr *dst,
const struct in6_addr *src)
{
- const struct {
- struct in6_addr dst;
- struct in6_addr src;
- } __aligned(SIPHASH_ALIGNMENT) combined = {
- .dst = *dst,
- .src = *src,
- };
- u32 hash, id;
-
- /* Note the following code is not safe, but this is okay. */
- if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key)))
- get_random_bytes(&net->ipv4.ip_id_key,
- sizeof(net->ipv4.ip_id_key));
-
- hash = siphash(&combined, sizeof(combined), &net->ipv4.ip_id_key);
-
- /* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve,
- * set the hight order instead thus minimizing possible future
- * collisions.
- */
- id = ip_idents_reserve(hash, 1);
- if (unlikely(!id))
- id = 1 << 31;
+ u32 id;
+
+ do {
+ id = prandom_u32();
+ } while (!id);
return id;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 058/266] MIPS: cpu-probe: Fix FPU detection on Ingenic JZ4760(B)
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 057/266] ipv6: use prandom_u32() for ID generation Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 059/266] MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER Greg Kroah-Hartman
` (211 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Thomas Bogendoerfer,
Sasha Levin
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit fc52f92a653215fbd6bc522ac5311857b335e589 ]
Ingenic JZ4760 and JZ4760B do have a FPU, but the config registers don't
report it. Force the FPU detection in case the processor ID match the
JZ4760(B) one.
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/cpu-probe.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 0ef240adefb5..630fcb4cb30e 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -1840,6 +1840,11 @@ static inline void cpu_probe_ingenic(struct cpuinfo_mips *c, unsigned int cpu)
*/
case PRID_COMP_INGENIC_D0:
c->isa_level &= ~MIPS_CPU_ISA_M32R2;
+
+ /* FPU is not properly detected on JZ4760(B). */
+ if (c->processor_id == 0x2ed0024f)
+ c->options |= MIPS_CPU_FPU;
+
fallthrough;
/*
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 059/266] MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 058/266] MIPS: cpu-probe: Fix FPU detection on Ingenic JZ4760(B) Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 060/266] drm/amdgpu: fix metadata_size for ubo ioctl queries Greg Kroah-Hartman
` (210 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Thomas Bogendoerfer,
Sasha Levin
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit eb3849370ae32b571e1f9a63ba52c61adeaf88f7 ]
The clock driving the XBurst CPUs in Ingenic SoCs is integer divided
from the main PLL. As such, it is possible to control the frequency of
the CPU, either by changing the divider, or by changing the rate of the
main PLL.
The XBurst CPUs also lack the CP0 timer; the TCU, a separate piece of
hardware in the SoC, provides this functionality.
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/Kconfig | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index ed51970c08e7..344e6c622efd 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -428,6 +428,8 @@ config MACH_INGENIC_SOC
select MIPS_GENERIC
select MACH_INGENIC
select SYS_SUPPORTS_ZBOOT_UART16550
+ select CPU_SUPPORTS_CPUFREQ
+ select MIPS_EXTERNAL_TIMER
config LANTIQ
bool "Lantiq based platforms"
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 060/266] drm/amdgpu: fix metadata_size for ubo ioctl queries
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 059/266] MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 061/266] drm/amdgpu: fix sdma firmware version error in sriov Greg Kroah-Hartman
` (209 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shiwu Zhang, Nirmoy Das,
Alex Deucher, Sasha Levin
From: Shiwu Zhang <shiwu.zhang@amd.com>
[ Upstream commit eba98523724be7ad3539f2c975de1527e0c99dd6 ]
Although the kfd_ioctl_get_dmabuf_info() still fail it will indicate
the caller right metadat_size useful for the same kfd ioctl next time.
Signed-off-by: Shiwu Zhang <shiwu.zhang@amd.com>
Reviewed-by: Nirmoy Das <nirmoy.das@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index f9434bc2f9b2..db00de33caa3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -1246,6 +1246,9 @@ int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer,
BUG_ON(bo->tbo.type == ttm_bo_type_kernel);
ubo = to_amdgpu_bo_user(bo);
+ if (metadata_size)
+ *metadata_size = ubo->metadata_size;
+
if (buffer) {
if (buffer_size < ubo->metadata_size)
return -EINVAL;
@@ -1254,8 +1257,6 @@ int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer,
memcpy(buffer, ubo->metadata, ubo->metadata_size);
}
- if (metadata_size)
- *metadata_size = ubo->metadata_size;
if (flags)
*flags = ubo->metadata_flags;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 061/266] drm/amdgpu: fix sdma firmware version error in sriov
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 060/266] drm/amdgpu: fix metadata_size for ubo ioctl queries Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 062/266] drm/amd/display: Avoid HDCP over-read and corruption Greg Kroah-Hartman
` (208 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kevin Wang, Stanley.Yang,
Alex Deucher, Sasha Levin
From: Kevin Wang <kevin1.wang@amd.com>
[ Upstream commit 2b8f731849800e3948763ccaff31cceac526789b ]
Re-adjust the function return order to avoid empty sdma version in the
sriov environment. (read amdgpu_firmware_info)
Signed-off-by: Kevin Wang <kevin1.wang@amd.com>
Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
index 240596b25fe4..9ab23947a151 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
@@ -145,9 +145,6 @@ static int sdma_v5_2_init_microcode(struct amdgpu_device *adev)
struct amdgpu_firmware_info *info = NULL;
const struct common_firmware_header *header = NULL;
- if (amdgpu_sriov_vf(adev) && (adev->asic_type == CHIP_SIENNA_CICHLID))
- return 0;
-
DRM_DEBUG("\n");
switch (adev->asic_type) {
@@ -182,6 +179,9 @@ static int sdma_v5_2_init_microcode(struct amdgpu_device *adev)
(void *)&adev->sdma.instance[0],
sizeof(struct amdgpu_sdma_instance));
+ if (amdgpu_sriov_vf(adev) && (adev->asic_type == CHIP_SIENNA_CICHLID))
+ return 0;
+
DRM_DEBUG("psp_load == '%s'\n",
adev->firmware.load_type == AMDGPU_FW_LOAD_PSP ? "true" : "false");
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 062/266] drm/amd/display: Avoid HDCP over-read and corruption
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 061/266] drm/amdgpu: fix sdma firmware version error in sriov Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 063/266] drm/amdgpu: remove unsafe optimization to drop preamble ib Greg Kroah-Hartman
` (207 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kees Cook, Alex Deucher, Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit 06888d571b513cbfc0b41949948def6cb81021b2 ]
Instead of reading the desired 5 bytes of the actual target field,
the code was reading 8. This could result in a corrupted value if the
trailing 3 bytes were non-zero, so instead use an appropriately sized
and zero-initialized bounce buffer, and read only 5 bytes before casting
to u64.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
index 2cbd931363bd..6d26d9c63ab2 100644
--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
+++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
@@ -29,8 +29,10 @@ static inline enum mod_hdcp_status validate_bksv(struct mod_hdcp *hdcp)
{
uint64_t n = 0;
uint8_t count = 0;
+ u8 bksv[sizeof(n)] = { };
- memcpy(&n, hdcp->auth.msg.hdcp1.bksv, sizeof(uint64_t));
+ memcpy(bksv, hdcp->auth.msg.hdcp1.bksv, sizeof(hdcp->auth.msg.hdcp1.bksv));
+ n = *(uint64_t *)bksv;
while (n) {
count++;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 063/266] drm/amdgpu: remove unsafe optimization to drop preamble ib
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 062/266] drm/amd/display: Avoid HDCP over-read and corruption Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:36 ` [PATCH 5.13 064/266] clk: tegra: tegra124-emc: Fix clock imbalance in emc_set_timing() Greg Kroah-Hartman
` (206 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiansong Chen, Hawking Zhang,
Alex Deucher, Sasha Levin
From: Jiansong Chen <Jiansong.Chen@amd.com>
[ Upstream commit 7d9c70d23550eb86a1bec1954ccaa8d6ec3a3328 ]
Take the situation with gfxoff, the optimization may cause
corrupt CE ram contents. In addition emit_cntxcntl callback
has similar optimization which firmware can handle properly
even for power feature.
Signed-off-by: Jiansong Chen <Jiansong.Chen@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 11 +----------
1 file changed, 1 insertion(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index a2fe2dac32c1..98906a43fda3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -130,7 +130,7 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs,
struct amdgpu_device *adev = ring->adev;
struct amdgpu_ib *ib = &ibs[0];
struct dma_fence *tmp = NULL;
- bool skip_preamble, need_ctx_switch;
+ bool need_ctx_switch;
unsigned patch_offset = ~0;
struct amdgpu_vm *vm;
uint64_t fence_ctx;
@@ -227,7 +227,6 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs,
if (need_ctx_switch)
status |= AMDGPU_HAVE_CTX_SWITCH;
- skip_preamble = ring->current_ctx == fence_ctx;
if (job && ring->funcs->emit_cntxcntl) {
status |= job->preamble_status;
status |= job->preemption_status;
@@ -245,14 +244,6 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs,
for (i = 0; i < num_ibs; ++i) {
ib = &ibs[i];
- /* drop preamble IBs if we don't have a context switch */
- if ((ib->flags & AMDGPU_IB_FLAG_PREAMBLE) &&
- skip_preamble &&
- !(status & AMDGPU_PREAMBLE_IB_PRESENT_FIRST) &&
- !amdgpu_mcbp &&
- !amdgpu_sriov_vf(adev)) /* for SRIOV preemption, Preamble CE ib must be inserted anyway */
- continue;
-
if (job && ring->funcs->emit_frame_cntl) {
if (secure != !!(ib->flags & AMDGPU_IB_FLAGS_SECURE)) {
amdgpu_ring_emit_frame_cntl(ring, false, secure);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 064/266] clk: tegra: tegra124-emc: Fix clock imbalance in emc_set_timing()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 063/266] drm/amdgpu: remove unsafe optimization to drop preamble ib Greg Kroah-Hartman
@ 2021-07-15 18:36 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 065/266] net: tcp better handling of reordering then loss cases Greg Kroah-Hartman
` (205 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:36 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
Thierry Reding, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit f13570e7e830ca4fbf4869015af8492b8918445e ]
After calling clk_prepare_enable(), clk_disable_unprepare() needs
be called when prepare_timing_change() failed.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-tegra124-emc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index bdf6f4a51617..74c1d894cca8 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -249,8 +249,10 @@ static int emc_set_timing(struct tegra_clk_emc *tegra,
div = timing->parent_rate / (timing->rate / 2) - 2;
err = tegra->prepare_timing_change(emc, timing->rate);
- if (err)
+ if (err) {
+ clk_disable_unprepare(timing->parent);
return err;
+ }
spin_lock_irqsave(tegra->lock, flags);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 065/266] net: tcp better handling of reordering then loss cases
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2021-07-15 18:36 ` [PATCH 5.13 064/266] clk: tegra: tegra124-emc: Fix clock imbalance in emc_set_timing() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 066/266] icmp: fix lib conflict with trinity Greg Kroah-Hartman
` (204 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, mingkun bian, Yuchung Cheng,
Neal Cardwell, Eric Dumazet, David S. Miller, Sasha Levin
From: Yuchung Cheng <ycheng@google.com>
[ Upstream commit a29cb6914681a55667436a9eb7a42e28da8cf387 ]
This patch aims to improve the situation when reordering and loss are
ocurring in the same flight of packets.
Previously the reordering would first induce a spurious recovery, then
the subsequent ACK may undo the cwnd (based on the timestamps e.g.).
However the current loss recovery does not proceed to invoke
RACK to install a reordering timer. If some packets are also lost, this
may lead to a long RTO-based recovery. An example is
https://groups.google.com/g/bbr-dev/c/OFHADvJbTEI
The solution is to after reverting the recovery, always invoke RACK
to either mount the RACK timer to fast retransmit after the reordering
window, or restarts the recovery if new loss is identified. Hence
it is possible the sender may go from Recovery to Disorder/Open to
Recovery again in one ACK.
Reported-by: mingkun bian <bianmingkun@gmail.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_input.c | 45 +++++++++++++++++++++++++-------------------
1 file changed, 26 insertions(+), 19 deletions(-)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4cf4dd532d1c..bc266514ce58 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2816,8 +2816,17 @@ static void tcp_process_loss(struct sock *sk, int flag, int num_dupack,
*rexmit = REXMIT_LOST;
}
+static bool tcp_force_fast_retransmit(struct sock *sk)
+{
+ struct tcp_sock *tp = tcp_sk(sk);
+
+ return after(tcp_highest_sack_seq(tp),
+ tp->snd_una + tp->reordering * tp->mss_cache);
+}
+
/* Undo during fast recovery after partial ACK. */
-static bool tcp_try_undo_partial(struct sock *sk, u32 prior_snd_una)
+static bool tcp_try_undo_partial(struct sock *sk, u32 prior_snd_una,
+ bool *do_lost)
{
struct tcp_sock *tp = tcp_sk(sk);
@@ -2842,7 +2851,9 @@ static bool tcp_try_undo_partial(struct sock *sk, u32 prior_snd_una)
tcp_undo_cwnd_reduction(sk, true);
NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPPARTIALUNDO);
tcp_try_keep_open(sk);
- return true;
+ } else {
+ /* Partial ACK arrived. Force fast retransmit. */
+ *do_lost = tcp_force_fast_retransmit(sk);
}
return false;
}
@@ -2866,14 +2877,6 @@ static void tcp_identify_packet_loss(struct sock *sk, int *ack_flag)
}
}
-static bool tcp_force_fast_retransmit(struct sock *sk)
-{
- struct tcp_sock *tp = tcp_sk(sk);
-
- return after(tcp_highest_sack_seq(tp),
- tp->snd_una + tp->reordering * tp->mss_cache);
-}
-
/* Process an event, which can update packets-in-flight not trivially.
* Main goal of this function is to calculate new estimate for left_out,
* taking into account both packets sitting in receiver's buffer and
@@ -2943,17 +2946,21 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,
if (!(flag & FLAG_SND_UNA_ADVANCED)) {
if (tcp_is_reno(tp))
tcp_add_reno_sack(sk, num_dupack, ece_ack);
- } else {
- if (tcp_try_undo_partial(sk, prior_snd_una))
- return;
- /* Partial ACK arrived. Force fast retransmit. */
- do_lost = tcp_force_fast_retransmit(sk);
- }
- if (tcp_try_undo_dsack(sk)) {
- tcp_try_keep_open(sk);
+ } else if (tcp_try_undo_partial(sk, prior_snd_una, &do_lost))
return;
- }
+
+ if (tcp_try_undo_dsack(sk))
+ tcp_try_keep_open(sk);
+
tcp_identify_packet_loss(sk, ack_flag);
+ if (icsk->icsk_ca_state != TCP_CA_Recovery) {
+ if (!tcp_time_to_recover(sk, flag))
+ return;
+ /* Undo reverts the recovery state. If loss is evident,
+ * starts a new recovery (e.g. reordering then loss);
+ */
+ tcp_enter_recovery(sk, ece_ack);
+ }
break;
case TCP_CA_Loss:
tcp_process_loss(sk, flag, num_dupack, rexmit);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 066/266] icmp: fix lib conflict with trinity
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 065/266] net: tcp better handling of reordering then loss cases Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 067/266] RDMA/cxgb4: Fix missing error code in create_qp() Greg Kroah-Hartman
` (203 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Roeseler, David S. Miller,
Sasha Levin
From: Andreas Roeseler <andreas.a.roeseler@gmail.com>
[ Upstream commit e32ea44c7ae476f4c90e35ab0a29dc8ff082bc11 ]
Including <linux/in.h> and <netinet/in.h> in the dependencies breaks
compilation of trinity due to multiple definitions. <linux/in.h> is only
used in <linux/icmp.h> to provide the definition of the struct in_addr,
but this can be substituted out by using the datatype __be32.
Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/icmp.h | 3 +--
net/ipv4/icmp.c | 2 +-
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/include/uapi/linux/icmp.h b/include/uapi/linux/icmp.h
index c1da8244c5e1..163c0998aec9 100644
--- a/include/uapi/linux/icmp.h
+++ b/include/uapi/linux/icmp.h
@@ -20,7 +20,6 @@
#include <linux/types.h>
#include <asm/byteorder.h>
-#include <linux/in.h>
#include <linux/if.h>
#include <linux/in6.h>
@@ -154,7 +153,7 @@ struct icmp_ext_echo_iio {
struct {
struct icmp_ext_echo_ctype3_hdr ctype3_hdr;
union {
- struct in_addr ipv4_addr;
+ __be32 ipv4_addr;
struct in6_addr ipv6_addr;
} ip_addr;
} addr;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 752e392083e6..0a57f1892e7e 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1066,7 +1066,7 @@ static bool icmp_echo(struct sk_buff *skb)
if (ident_len != sizeof(iio->ident.addr.ctype3_hdr) +
sizeof(struct in_addr))
goto send_mal_query;
- dev = ip_dev_find(net, iio->ident.addr.ip_addr.ipv4_addr.s_addr);
+ dev = ip_dev_find(net, iio->ident.addr.ip_addr.ipv4_addr);
break;
#if IS_ENABLED(CONFIG_IPV6)
case ICMP_AFI_IP6:
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 067/266] RDMA/cxgb4: Fix missing error code in create_qp()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 066/266] icmp: fix lib conflict with trinity Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 068/266] dm space maps: dont reset space map allocation cursor when committing Greg Kroah-Hartman
` (202 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Abaci Robot, Jiapeng Chong,
Jason Gunthorpe, Sasha Levin
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
[ Upstream commit aeb27bb76ad8197eb47890b1ff470d5faf8ec9a5 ]
The error code is missing in this code scenario so 0 will be returned. Add
the error code '-EINVAL' to the return value 'ret'.
Eliminates the follow smatch warning:
drivers/infiniband/hw/cxgb4/qp.c:298 create_qp() warn: missing error code 'ret'.
Link: https://lore.kernel.org/r/1622545669-20625-1-git-send-email-jiapeng.chong@linux.alibaba.com
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/cxgb4/qp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index d109bb3822a5..c9403743346e 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -295,6 +295,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
if (user && (!wq->sq.bar2_pa || (need_rq && !wq->rq.bar2_pa))) {
pr_warn("%s: sqid %u or rqid %u not in BAR2 range\n",
pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid);
+ ret = -EINVAL;
goto free_dma;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 068/266] dm space maps: dont reset space map allocation cursor when committing
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 067/266] RDMA/cxgb4: Fix missing error code in create_qp() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 069/266] dm writecache: dont split bios when overwriting contiguous cache content Greg Kroah-Hartman
` (201 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer, Sasha Levin
From: Joe Thornber <ejt@redhat.com>
[ Upstream commit 5faafc77f7de69147d1e818026b9a0cbf036a7b2 ]
Current commit code resets the place where the search for free blocks
will begin back to the start of the metadata device. There are a couple
of repercussions to this:
- The first allocation after the commit is likely to take longer than
normal as it searches for a free block in an area that is likely to
have very few free blocks (if any).
- Any free blocks it finds will have been recently freed. Reusing them
means we have fewer old copies of the metadata to aid recovery from
hardware error.
Fix these issues by leaving the cursor alone, only resetting when the
search hits the end of the metadata device.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/persistent-data/dm-space-map-disk.c | 9 ++++++++-
drivers/md/persistent-data/dm-space-map-metadata.c | 9 ++++++++-
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
index 61f56909e00b..4f8069bb0481 100644
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -171,6 +171,14 @@ static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
* Any block we allocate has to be free in both the old and current ll.
*/
r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b);
+ if (r == -ENOSPC) {
+ /*
+ * There's no free block between smd->begin and the end of the metadata device.
+ * We search before smd->begin in case something has been freed.
+ */
+ r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, 0, smd->begin, b);
+ }
+
if (r)
return r;
@@ -194,7 +202,6 @@ static int sm_disk_commit(struct dm_space_map *sm)
return r;
memcpy(&smd->old_ll, &smd->ll, sizeof(smd->old_ll));
- smd->begin = 0;
smd->nr_allocated_this_transaction = 0;
return 0;
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 9e3c64ec2026..da439ac85796 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -452,6 +452,14 @@ static int sm_metadata_new_block_(struct dm_space_map *sm, dm_block_t *b)
* Any block we allocate has to be free in both the old and current ll.
*/
r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b);
+ if (r == -ENOSPC) {
+ /*
+ * There's no free block between smm->begin and the end of the metadata device.
+ * We search before smm->begin in case something has been freed.
+ */
+ r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, 0, smm->begin, b);
+ }
+
if (r)
return r;
@@ -503,7 +511,6 @@ static int sm_metadata_commit(struct dm_space_map *sm)
return r;
memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll));
- smm->begin = 0;
smm->allocated_this_transaction = 0;
return 0;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 069/266] dm writecache: dont split bios when overwriting contiguous cache content
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 068/266] dm space maps: dont reset space map allocation cursor when committing Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 070/266] dm: Fix dm_accept_partial_bio() relative to zone management commands Greg Kroah-Hartman
` (200 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer, Sasha Levin
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit ee50cc19d80e9b9a8283d1fb517a778faf2f6899 ]
If dm-writecache overwrites existing cached data, it splits the
incoming bio into many block-sized bios. The I/O scheduler does merge
these bios into one large request but this needless splitting and
merging causes performance degradation.
Fix this by avoiding bio splitting if the cache target area that is
being overwritten is contiguous.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 38 ++++++++++++++++++++++++++++++--------
1 file changed, 30 insertions(+), 8 deletions(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index aecc246ade26..a44007297e63 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -1360,14 +1360,18 @@ read_next_block:
} else {
do {
bool found_entry = false;
+ bool search_used = false;
if (writecache_has_error(wc))
goto unlock_error;
e = writecache_find_entry(wc, bio->bi_iter.bi_sector, 0);
if (e) {
- if (!writecache_entry_is_committed(wc, e))
+ if (!writecache_entry_is_committed(wc, e)) {
+ search_used = true;
goto bio_copy;
+ }
if (!WC_MODE_PMEM(wc) && !e->write_in_progress) {
wc->overwrote_committed = true;
+ search_used = true;
goto bio_copy;
}
found_entry = true;
@@ -1404,13 +1408,31 @@ bio_copy:
sector_t current_cache_sec = start_cache_sec + (bio_size >> SECTOR_SHIFT);
while (bio_size < bio->bi_iter.bi_size) {
- struct wc_entry *f = writecache_pop_from_freelist(wc, current_cache_sec);
- if (!f)
- break;
- write_original_sector_seq_count(wc, f, bio->bi_iter.bi_sector +
- (bio_size >> SECTOR_SHIFT), wc->seq_count);
- writecache_insert_entry(wc, f);
- wc->uncommitted_blocks++;
+ if (!search_used) {
+ struct wc_entry *f = writecache_pop_from_freelist(wc, current_cache_sec);
+ if (!f)
+ break;
+ write_original_sector_seq_count(wc, f, bio->bi_iter.bi_sector +
+ (bio_size >> SECTOR_SHIFT), wc->seq_count);
+ writecache_insert_entry(wc, f);
+ wc->uncommitted_blocks++;
+ } else {
+ struct wc_entry *f;
+ struct rb_node *next = rb_next(&e->rb_node);
+ if (!next)
+ break;
+ f = container_of(next, struct wc_entry, rb_node);
+ if (f != e + 1)
+ break;
+ if (read_original_sector(wc, f) !=
+ read_original_sector(wc, e) + (wc->block_size >> SECTOR_SHIFT))
+ break;
+ if (unlikely(f->write_in_progress))
+ break;
+ if (writecache_entry_is_committed(wc, f))
+ wc->overwrote_committed = true;
+ e = f;
+ }
bio_size += wc->block_size;
current_cache_sec += wc->block_size >> SECTOR_SHIFT;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 070/266] dm: Fix dm_accept_partial_bio() relative to zone management commands
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 069/266] dm writecache: dont split bios when overwriting contiguous cache content Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 071/266] block: introduce BIO_ZONE_WRITE_LOCKED bio flag Greg Kroah-Hartman
` (199 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Damien Le Moal, Mike Snitzer, Sasha Levin
From: Damien Le Moal <damien.lemoal@wdc.com>
[ Upstream commit 6842d264aa5205da338b6dcc6acfa2a6732558f1 ]
Fix dm_accept_partial_bio() to actually check that zone management
commands are not passed as explained in the function documentation
comment. Also, since a zone append operation cannot be split, add
REQ_OP_ZONE_APPEND as a forbidden command.
White lines are added around the group of BUG_ON() calls to make the
code more legible.
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index ca2aedd8ee7d..11af20080639 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1237,8 +1237,8 @@ static int dm_dax_zero_page_range(struct dax_device *dax_dev, pgoff_t pgoff,
/*
* A target may call dm_accept_partial_bio only from the map routine. It is
- * allowed for all bio types except REQ_PREFLUSH, REQ_OP_ZONE_RESET,
- * REQ_OP_ZONE_OPEN, REQ_OP_ZONE_CLOSE and REQ_OP_ZONE_FINISH.
+ * allowed for all bio types except REQ_PREFLUSH, REQ_OP_ZONE_* zone management
+ * operations and REQ_OP_ZONE_APPEND (zone append writes).
*
* dm_accept_partial_bio informs the dm that the target only wants to process
* additional n_sectors sectors of the bio and the rest of the data should be
@@ -1268,9 +1268,13 @@ void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors)
{
struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
unsigned bi_size = bio->bi_iter.bi_size >> SECTOR_SHIFT;
+
BUG_ON(bio->bi_opf & REQ_PREFLUSH);
+ BUG_ON(op_is_zone_mgmt(bio_op(bio)));
+ BUG_ON(bio_op(bio) == REQ_OP_ZONE_APPEND);
BUG_ON(bi_size > *tio->len_ptr);
BUG_ON(n_sectors > bi_size);
+
*tio->len_ptr -= bi_size - n_sectors;
bio->bi_iter.bi_size = n_sectors << SECTOR_SHIFT;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 071/266] block: introduce BIO_ZONE_WRITE_LOCKED bio flag
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 070/266] dm: Fix dm_accept_partial_bio() relative to zone management commands Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 072/266] net: bridge: mrp: Update ring transitions Greg Kroah-Hartman
` (198 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Damien Le Moal, Christoph Hellwig,
Hannes Reinecke, Chaitanya Kulkarni, Himanshu Madhani,
Jens Axboe, Mike Snitzer, Sasha Levin
From: Damien Le Moal <damien.lemoal@wdc.com>
[ Upstream commit 9ffbbb435d8f566a0924ce4b5dc7fc1bceb6dbf8 ]
Introduce the BIO flag BIO_ZONE_WRITE_LOCKED to indicate that a BIO owns
the write lock of the zone it is targeting. This is the counterpart of
the struct request flag RQF_ZONE_WRITE_LOCKED.
This new BIO flag is reserved for now for zone write locking control
for device mapper targets exposing a zoned block device. Since in this
case, the lock flag must not be propagated to the struct request that
will be used to process the BIO, a BIO private flag is used rather than
changing the RQF_ZONE_WRITE_LOCKED request flag into a common REQ_XXX
flag that could be used for both BIO and request. This avoids conflicts
down the stack with the block IO scheduler zone write locking
(in mq-deadline).
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Acked-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/blk_types.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index db026b6ec15a..e5cf12f102a2 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -304,6 +304,7 @@ enum {
BIO_CGROUP_ACCT, /* has been accounted to a cgroup */
BIO_TRACKED, /* set if bio goes through the rq_qos path */
BIO_REMAPPED,
+ BIO_ZONE_WRITE_LOCKED, /* Owns a zoned device zone write lock */
BIO_FLAG_LAST
};
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 072/266] net: bridge: mrp: Update ring transitions.
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 071/266] block: introduce BIO_ZONE_WRITE_LOCKED bio flag Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 073/266] pinctrl: mcp23s08: fix race condition in irq handler Greg Kroah-Hartman
` (197 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Horatiu Vultur, David S. Miller, Sasha Levin
From: Horatiu Vultur <horatiu.vultur@microchip.com>
[ Upstream commit fcb34635854a5a5814227628867ea914a9805384 ]
According to the standard IEC 62439-2, the number of transitions needs
to be counted for each transition 'between' ring state open and ring
state closed and not from open state to closed state.
Therefore fix this for both ring and interconnect ring.
Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_mrp.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/net/bridge/br_mrp.c b/net/bridge/br_mrp.c
index cd2b1e424e54..f7012b7d7ce4 100644
--- a/net/bridge/br_mrp.c
+++ b/net/bridge/br_mrp.c
@@ -627,8 +627,7 @@ int br_mrp_set_ring_state(struct net_bridge *br,
if (!mrp)
return -EINVAL;
- if (mrp->ring_state == BR_MRP_RING_STATE_CLOSED &&
- state->ring_state != BR_MRP_RING_STATE_CLOSED)
+ if (mrp->ring_state != state->ring_state)
mrp->ring_transitions++;
mrp->ring_state = state->ring_state;
@@ -715,8 +714,7 @@ int br_mrp_set_in_state(struct net_bridge *br, struct br_mrp_in_state *state)
if (!mrp)
return -EINVAL;
- if (mrp->in_state == BR_MRP_IN_STATE_CLOSED &&
- state->in_state != BR_MRP_IN_STATE_CLOSED)
+ if (mrp->in_state != state->in_state)
mrp->in_transitions++;
mrp->in_state = state->in_state;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 073/266] pinctrl: mcp23s08: fix race condition in irq handler
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 072/266] net: bridge: mrp: Update ring transitions Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 074/266] ice: set the value of global config lock timeout longer Greg Kroah-Hartman
` (196 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Radim Pavlik, Linus Walleij, Sasha Levin
From: Radim Pavlik <radim.pavlik@tbs-biometrics.com>
[ Upstream commit 897120d41e7afd9da435cb00041a142aeeb53c07 ]
Checking value of MCP_INTF in mcp23s08_irq suggests that the handler may be
called even when there is no interrupt pending.
But the actual interrupt could happened between reading MCP_INTF and MCP_GPIO.
In this situation we got nothing from MCP_INTF, but the event gets acknowledged
on the expander by reading MCP_GPIO. This leads to losing events.
Fix the problem by not reading any register until we see something in MCP_INTF.
The error was reproduced and fix tested on MCP23017.
Signed-off-by: Radim Pavlik <radim.pavlik@tbs-biometrics.com>
Link: https://lore.kernel.org/r/AM7PR06MB6769E1183F68DEBB252F665ABA3E9@AM7PR06MB6769.eurprd06.prod.outlook.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-mcp23s08.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
index ce2d8014b7e0..799d596a1a4b 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -351,6 +351,11 @@ static irqreturn_t mcp23s08_irq(int irq, void *data)
if (mcp_read(mcp, MCP_INTF, &intf))
goto unlock;
+ if (intf == 0) {
+ /* There is no interrupt pending */
+ return IRQ_HANDLED;
+ }
+
if (mcp_read(mcp, MCP_INTCAP, &intcap))
goto unlock;
@@ -368,11 +373,6 @@ static irqreturn_t mcp23s08_irq(int irq, void *data)
mcp->cached_gpio = gpio;
mutex_unlock(&mcp->lock);
- if (intf == 0) {
- /* There is no interrupt pending */
- return IRQ_HANDLED;
- }
-
dev_dbg(mcp->chip.parent,
"intcap 0x%04X intf 0x%04X gpio_orig 0x%04X gpio 0x%04X\n",
intcap, intf, gpio_orig, gpio);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 074/266] ice: set the value of global config lock timeout longer
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 073/266] pinctrl: mcp23s08: fix race condition in irq handler Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 075/266] ice: fix clang warning regarding deadcode.DeadStores Greg Kroah-Hartman
` (195 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liwei Song, Tony Brelinski,
Tony Nguyen, Sasha Levin
From: Liwei Song <liwei.song@windriver.com>
[ Upstream commit fb3612840d4f587a0af9511a11d7989d1fa48206 ]
It may need hold Global Config Lock a longer time when download DDP
package file, extend the timeout value to 5000ms to ensure that
download can be finished before other AQ command got time to run,
this will fix the issue below when probe the device, 5000ms is a test
value that work with both Backplane and BreakoutCable NVM image:
ice 0000:f4:00.0: VSI 12 failed lan queue config, error ICE_ERR_CFG
ice 0000:f4:00.0: Failed to delete VSI 12 in FW - error: ICE_ERR_AQ_TIMEOUT
ice 0000:f4:00.0: probe failed due to setup PF switch: -12
ice: probe of 0000:f4:00.0 failed with error -12
Signed-off-by: Liwei Song <liwei.song@windriver.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_type.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
index 4474dd6a7ba1..a925273c2cca 100644
--- a/drivers/net/ethernet/intel/ice/ice_type.h
+++ b/drivers/net/ethernet/intel/ice/ice_type.h
@@ -63,7 +63,7 @@ enum ice_aq_res_ids {
/* FW update timeout definitions are in milliseconds */
#define ICE_NVM_TIMEOUT 180000
#define ICE_CHANGE_LOCK_TIMEOUT 1000
-#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 3000
+#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 5000
enum ice_aq_res_access_type {
ICE_RES_READ = 1,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 075/266] ice: fix clang warning regarding deadcode.DeadStores
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 074/266] ice: set the value of global config lock timeout longer Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 076/266] virtio_net: Remove BUG() to avoid machine dead Greg Kroah-Hartman
` (194 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul M Stillwell Jr, Tony Brelinski,
Tony Nguyen, Sasha Levin
From: Paul M Stillwell Jr <paul.m.stillwell.jr@intel.com>
[ Upstream commit 7e94090ae13e1ae5fe8bd3a9cd08136260bb7039 ]
clang generates deadcode.DeadStores warnings when a variable
is used to read a value, but then that value isn't used later
in the code. Fix this warning.
Signed-off-by: Paul M Stillwell Jr <paul.m.stillwell.jr@intel.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_ethtool.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index 99301ad95290..1f30f24648d8 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -3462,13 +3462,9 @@ static int
ice_get_rc_coalesce(struct ethtool_coalesce *ec, enum ice_container_type c_type,
struct ice_ring_container *rc)
{
- struct ice_pf *pf;
-
if (!rc->ring)
return -EINVAL;
- pf = rc->ring->vsi->back;
-
switch (c_type) {
case ICE_RX_CONTAINER:
ec->use_adaptive_rx_coalesce = ITR_IS_DYNAMIC(rc);
@@ -3480,7 +3476,7 @@ ice_get_rc_coalesce(struct ethtool_coalesce *ec, enum ice_container_type c_type,
ec->tx_coalesce_usecs = rc->itr_setting;
break;
default:
- dev_dbg(ice_pf_to_dev(pf), "Invalid c_type %d\n", c_type);
+ dev_dbg(ice_pf_to_dev(rc->ring->vsi->back), "Invalid c_type %d\n", c_type);
return -EINVAL;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 076/266] virtio_net: Remove BUG() to avoid machine dead
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 075/266] ice: fix clang warning regarding deadcode.DeadStores Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 077/266] net: mscc: ocelot: check return value after calling platform_get_resource() Greg Kroah-Hartman
` (193 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xianting Tian, Leon Romanovsky,
David S. Miller, Sasha Levin
From: Xianting Tian <xianting.tian@linux.alibaba.com>
[ Upstream commit 85eb1389458d134bdb75dad502cc026c3753a619 ]
We should not directly BUG() when there is hdr error, it is
better to output a print when such error happens. Currently,
the caller of xmit_skb() already did it.
Signed-off-by: Xianting Tian <xianting.tian@linux.alibaba.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 252f6718d730..2debb32a1813 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1625,7 +1625,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
if (virtio_net_hdr_from_skb(skb, &hdr->hdr,
virtio_is_little_endian(vi->vdev), false,
0))
- BUG();
+ return -EPROTO;
if (vi->mergeable_rx_bufs)
hdr->num_buffers = 0;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 077/266] net: mscc: ocelot: check return value after calling platform_get_resource()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 076/266] virtio_net: Remove BUG() to avoid machine dead Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 078/266] net: bcmgenet: " Greg Kroah-Hartman
` (192 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Yingliang, Vladimir Oltean,
David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit f1fe19c2cb3fdc92a614cf330ced1613f8f1a681 ]
It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/ocelot/seville_vsc9953.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/dsa/ocelot/seville_vsc9953.c b/drivers/net/dsa/ocelot/seville_vsc9953.c
index 84f93a874d50..deae923c8b7a 100644
--- a/drivers/net/dsa/ocelot/seville_vsc9953.c
+++ b/drivers/net/dsa/ocelot/seville_vsc9953.c
@@ -1206,6 +1206,11 @@ static int seville_probe(struct platform_device *pdev)
felix->info = &seville_info_vsc9953;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!res) {
+ err = -EINVAL;
+ dev_err(&pdev->dev, "Invalid resource\n");
+ goto err_alloc_felix;
+ }
felix->switch_base = res->start;
ds = kzalloc(sizeof(struct dsa_switch), GFP_KERNEL);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 078/266] net: bcmgenet: check return value after calling platform_get_resource()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 077/266] net: mscc: ocelot: check return value after calling platform_get_resource() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 079/266] net: mvpp2: " Greg Kroah-Hartman
` (191 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Yingliang, Florian Fainelli,
David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 74325bf0104573c6dfce42837139aeef3f34be76 ]
It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/genet/bcmmii.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 5335244e4577..89d16c587bb7 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -423,6 +423,10 @@ static int bcmgenet_mii_register(struct bcmgenet_priv *priv)
int id, ret;
pres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!pres) {
+ dev_err(&pdev->dev, "Invalid resource\n");
+ return -EINVAL;
+ }
memset(&res, 0, sizeof(res));
memset(&ppd, 0, sizeof(ppd));
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 079/266] net: mvpp2: check return value after calling platform_get_resource()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 078/266] net: bcmgenet: " Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 080/266] net: micrel: " Greg Kroah-Hartman
` (190 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Yingliang, David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 0bb51a3a385790a4be20085494cf78f70dadf646 ]
It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index b3041fe6c0ae..42cc27ef7378 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -7387,6 +7387,10 @@ static int mvpp2_probe(struct platform_device *pdev)
return PTR_ERR(priv->lms_base);
} else {
res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+ if (!res) {
+ dev_err(&pdev->dev, "Invalid resource\n");
+ return -EINVAL;
+ }
if (has_acpi_companion(&pdev->dev)) {
/* In case the MDIO memory region is declared in
* the ACPI, it can already appear as 'in-use'
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 080/266] net: micrel: check return value after calling platform_get_resource()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 079/266] net: mvpp2: " Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 081/266] net: moxa: Use devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
` (189 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Yingliang, David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 20f1932e2282c58cb5ac59517585206cf5b385ae ]
It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/micrel/ks8842.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/micrel/ks8842.c b/drivers/net/ethernet/micrel/ks8842.c
index caa251d0e381..b27713906d3a 100644
--- a/drivers/net/ethernet/micrel/ks8842.c
+++ b/drivers/net/ethernet/micrel/ks8842.c
@@ -1135,6 +1135,10 @@ static int ks8842_probe(struct platform_device *pdev)
unsigned i;
iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!iomem) {
+ dev_err(&pdev->dev, "Invalid resource\n");
+ return -EINVAL;
+ }
if (!request_mem_region(iomem->start, resource_size(iomem), DRV_NAME))
goto err_mem_region;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 081/266] net: moxa: Use devm_platform_get_and_ioremap_resource()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 080/266] net: micrel: " Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 082/266] drm/amd/display: Fix DCN 3.01 DSCCLK validation Greg Kroah-Hartman
` (188 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Yingliang, David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 35cba15a504bf4f585bb9d78f47b22b28a1a06b2 ]
Use devm_platform_get_and_ioremap_resource() to simplify
code and avoid a null-ptr-deref by checking 'res' in it.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/moxa/moxart_ether.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index b85733942053..5249b64f4fc5 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -481,13 +481,12 @@ static int moxart_mac_probe(struct platform_device *pdev)
priv->ndev = ndev;
priv->pdev = pdev;
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- ndev->base_addr = res->start;
- priv->base = devm_ioremap_resource(p_dev, res);
+ priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
if (IS_ERR(priv->base)) {
ret = PTR_ERR(priv->base);
goto init_fail;
}
+ ndev->base_addr = res->start;
spin_lock_init(&priv->txlock);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 082/266] drm/amd/display: Fix DCN 3.01 DSCCLK validation
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 081/266] net: moxa: Use devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 083/266] drm/amd/display: Revert "Fix clock table filling logic" Greg Kroah-Hartman
` (187 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikola Cornij, Dmytro Laktyushkin,
Stylon Wang, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Nikola Cornij <nikola.cornij@amd.com>
[ Upstream commit 346cf627fb27c0fea63a041cedbaa4f31784e504 ]
[why]
DSCCLK validation is not necessary because DSCCLK is derrived from
DISPCLK, therefore if DISPCLK validation passes, DSCCLK is valid, too.
Doing DSCLK validation in addition to DISPCLK leads to modes being
wrongly rejected when DSCCLK was incorrectly set outside of DML.
[how]
Remove DSCCLK validation because it's implicitly validated under DISPCLK
Signed-off-by: Nikola Cornij <nikola.cornij@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dc/dml/dcn30/display_mode_vba_30.c | 64 ++++++-------------
1 file changed, 21 insertions(+), 43 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
index cb3f70a71b51..af7d57602b2c 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
@@ -64,6 +64,7 @@ typedef struct {
#define BPP_INVALID 0
#define BPP_BLENDED_PIPE 0xffffffff
#define DCN30_MAX_DSC_IMAGE_WIDTH 5184
+#define DCN30_MAX_FMT_420_BUFFER_WIDTH 4096
static void DisplayPipeConfiguration(struct display_mode_lib *mode_lib);
static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerformanceCalculation(
@@ -3987,19 +3988,30 @@ void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
} else if (v->PlaneRequiredDISPCLKWithoutODMCombine > v->MaxDispclkRoundedDownToDFSGranularity) {
v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithODMCombine2To1;
- } else if (v->DSCEnabled[k] && (v->HActive[k] > DCN30_MAX_DSC_IMAGE_WIDTH)) {
- v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
- v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithODMCombine2To1;
} else {
v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithoutODMCombine;
- /*420 format workaround*/
- if (v->HActive[k] > 4096 && v->OutputFormat[k] == dm_420) {
+ }
+ if (v->DSCEnabled[k] && v->HActive[k] > DCN30_MAX_DSC_IMAGE_WIDTH
+ && v->ODMCombineEnablePerState[i][k] != dm_odm_combine_mode_4to1) {
+ if (v->HActive[k] / 2 > DCN30_MAX_DSC_IMAGE_WIDTH) {
+ v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_4to1;
+ v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithODMCombine4To1;
+ } else {
+ v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
+ v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithODMCombine2To1;
+ }
+ }
+ if (v->OutputFormat[k] == dm_420 && v->HActive[k] > DCN30_MAX_FMT_420_BUFFER_WIDTH
+ && v->ODMCombineEnablePerState[i][k] != dm_odm_combine_mode_4to1) {
+ if (v->HActive[k] / 2 > DCN30_MAX_FMT_420_BUFFER_WIDTH) {
+ v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_4to1;
+ v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithODMCombine4To1;
+ } else {
v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithODMCombine2To1;
}
}
-
if (v->ODMCombineEnablePerState[i][k] == dm_odm_combine_mode_4to1) {
v->MPCCombine[i][j][k] = false;
v->NoOfDPP[i][j][k] = 4;
@@ -4281,42 +4293,8 @@ void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
}
}
- for (i = 0; i < v->soc.num_states; i++) {
- v->DSCCLKRequiredMoreThanSupported[i] = false;
- for (k = 0; k <= v->NumberOfActivePlanes - 1; k++) {
- if (v->BlendingAndTiming[k] == k) {
- if (v->Output[k] == dm_dp || v->Output[k] == dm_edp) {
- if (v->OutputFormat[k] == dm_420) {
- v->DSCFormatFactor = 2;
- } else if (v->OutputFormat[k] == dm_444) {
- v->DSCFormatFactor = 1;
- } else if (v->OutputFormat[k] == dm_n422) {
- v->DSCFormatFactor = 2;
- } else {
- v->DSCFormatFactor = 1;
- }
- if (v->RequiresDSC[i][k] == true) {
- if (v->ODMCombineEnablePerState[i][k] == dm_odm_combine_mode_4to1) {
- if (v->PixelClockBackEnd[k] / 12.0 / v->DSCFormatFactor
- > (1.0 - v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0) * v->MaxDSCCLK[i]) {
- v->DSCCLKRequiredMoreThanSupported[i] = true;
- }
- } else if (v->ODMCombineEnablePerState[i][k] == dm_odm_combine_mode_2to1) {
- if (v->PixelClockBackEnd[k] / 6.0 / v->DSCFormatFactor
- > (1.0 - v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0) * v->MaxDSCCLK[i]) {
- v->DSCCLKRequiredMoreThanSupported[i] = true;
- }
- } else {
- if (v->PixelClockBackEnd[k] / 3.0 / v->DSCFormatFactor
- > (1.0 - v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0) * v->MaxDSCCLK[i]) {
- v->DSCCLKRequiredMoreThanSupported[i] = true;
- }
- }
- }
- }
- }
- }
- }
+ /* Skip dscclk validation: as long as dispclk is supported, dscclk is also implicitly supported */
+
for (i = 0; i < v->soc.num_states; i++) {
v->NotEnoughDSCUnits[i] = false;
v->TotalDSCUnitsRequired = 0.0;
@@ -5319,7 +5297,7 @@ void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
for (j = 0; j < 2; j++) {
if (v->ScaleRatioAndTapsSupport == 1 && v->SourceFormatPixelAndScanSupport == 1 && v->ViewportSizeSupport[i][j] == 1
&& v->DIOSupport[i] == 1 && v->ODMCombine4To1SupportCheckOK[i] == 1
- && v->NotEnoughDSCUnits[i] == 0 && v->DSCCLKRequiredMoreThanSupported[i] == 0
+ && v->NotEnoughDSCUnits[i] == 0
&& v->DTBCLKRequiredMoreThanSupported[i] == 0
&& v->ROBSupport[i][j] == 1 && v->DISPCLK_DPPCLK_Support[i][j] == 1 && v->TotalAvailablePipesSupport[i][j] == 1
&& EnoughWritebackUnits == 1 && WritebackModeSupport == 1
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 083/266] drm/amd/display: Revert "Fix clock table filling logic"
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 082/266] drm/amd/display: Fix DCN 3.01 DSCCLK validation Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 084/266] drm/amd/display: Update scaling settings on modeset Greg Kroah-Hartman
` (186 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilya Bakoulin, Sung Lee, Stylon Wang,
Daniel Wheeler, Alex Deucher, Sasha Levin
From: Ilya Bakoulin <Ilya.Bakoulin@amd.com>
[ Upstream commit ae88357c7966ec2a52cb1e70fd42f74a40c9dfcb ]
[Why]
This change was found to break some high-refresh modes. Reverting
to unblock mainline.
Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com>
Reviewed-by: Sung Lee <Sung.Lee@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 78 +++++++------------
.../drm/amd/display/dc/dcn21/dcn21_resource.c | 33 +++-----
2 files changed, 39 insertions(+), 72 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
index 1f56ceab5922..75ba86f951f8 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
@@ -835,66 +835,47 @@ static struct wm_table lpddr4_wm_table_rn = {
}
};
-static unsigned int find_max_fclk_for_voltage(struct dpm_clocks *clock_table,
- unsigned int voltage)
+static unsigned int find_socclk_for_voltage(struct dpm_clocks *clock_table, unsigned int voltage)
{
int i;
- uint32_t max_clk = 0;
- for (i = 0; i < PP_SMU_NUM_FCLK_DPM_LEVELS; i++) {
- if (clock_table->FClocks[i].Vol <= voltage) {
- max_clk = clock_table->FClocks[i].Freq > max_clk ?
- clock_table->FClocks[i].Freq : max_clk;
- }
- }
-
- return max_clk;
-}
-
-static unsigned int find_max_memclk_for_voltage(struct dpm_clocks *clock_table,
- unsigned int voltage)
-{
- int i;
- uint32_t max_clk = 0;
-
- for (i = 0; i < PP_SMU_NUM_MEMCLK_DPM_LEVELS; i++) {
- if (clock_table->MemClocks[i].Vol <= voltage) {
- max_clk = clock_table->MemClocks[i].Freq > max_clk ?
- clock_table->MemClocks[i].Freq : max_clk;
- }
+ for (i = 0; i < PP_SMU_NUM_SOCCLK_DPM_LEVELS; i++) {
+ if (clock_table->SocClocks[i].Vol == voltage)
+ return clock_table->SocClocks[i].Freq;
}
- return max_clk;
+ ASSERT(0);
+ return 0;
}
-static unsigned int find_max_socclk_for_voltage(struct dpm_clocks *clock_table,
- unsigned int voltage)
+static unsigned int find_dcfclk_for_voltage(struct dpm_clocks *clock_table, unsigned int voltage)
{
int i;
- uint32_t max_clk = 0;
- for (i = 0; i < PP_SMU_NUM_SOCCLK_DPM_LEVELS; i++) {
- if (clock_table->SocClocks[i].Vol <= voltage) {
- max_clk = clock_table->SocClocks[i].Freq > max_clk ?
- clock_table->SocClocks[i].Freq : max_clk;
- }
+ for (i = 0; i < PP_SMU_NUM_DCFCLK_DPM_LEVELS; i++) {
+ if (clock_table->DcfClocks[i].Vol == voltage)
+ return clock_table->DcfClocks[i].Freq;
}
- return max_clk;
+ ASSERT(0);
+ return 0;
}
static void rn_clk_mgr_helper_populate_bw_params(struct clk_bw_params *bw_params, struct dpm_clocks *clock_table, struct integrated_info *bios_info)
{
int i, j = 0;
- unsigned int volt;
j = -1;
- /* Find max DPM */
- for (i = 0; i < PP_SMU_NUM_DCFCLK_DPM_LEVELS; ++i) {
- if (clock_table->DcfClocks[i].Freq != 0 &&
- clock_table->DcfClocks[i].Vol != 0)
+ ASSERT(PP_SMU_NUM_FCLK_DPM_LEVELS <= MAX_NUM_DPM_LVL);
+
+ /* Find lowest DPM, FCLK is filled in reverse order*/
+
+ for (i = PP_SMU_NUM_FCLK_DPM_LEVELS - 1; i >= 0; i--) {
+ if (clock_table->FClocks[i].Freq != 0 && clock_table->FClocks[i].Vol != 0) {
j = i;
+ break;
+ }
}
if (j == -1) {
@@ -905,18 +886,13 @@ static void rn_clk_mgr_helper_populate_bw_params(struct clk_bw_params *bw_params
bw_params->clk_table.num_entries = j + 1;
- for (i = 0; i < bw_params->clk_table.num_entries; i++) {
- volt = clock_table->DcfClocks[i].Vol;
-
- bw_params->clk_table.entries[i].voltage = volt;
- bw_params->clk_table.entries[i].dcfclk_mhz =
- clock_table->DcfClocks[i].Freq;
- bw_params->clk_table.entries[i].fclk_mhz =
- find_max_fclk_for_voltage(clock_table, volt);
- bw_params->clk_table.entries[i].memclk_mhz =
- find_max_memclk_for_voltage(clock_table, volt);
- bw_params->clk_table.entries[i].socclk_mhz =
- find_max_socclk_for_voltage(clock_table, volt);
+ for (i = 0; i < bw_params->clk_table.num_entries; i++, j--) {
+ bw_params->clk_table.entries[i].fclk_mhz = clock_table->FClocks[j].Freq;
+ bw_params->clk_table.entries[i].memclk_mhz = clock_table->MemClocks[j].Freq;
+ bw_params->clk_table.entries[i].voltage = clock_table->FClocks[j].Vol;
+ bw_params->clk_table.entries[i].dcfclk_mhz = find_dcfclk_for_voltage(clock_table, clock_table->FClocks[j].Vol);
+ bw_params->clk_table.entries[i].socclk_mhz = find_socclk_for_voltage(clock_table,
+ bw_params->clk_table.entries[i].voltage);
}
bw_params->vram_type = bios_info->memory_type;
diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
index 38a2aa87f5f5..8e3f1d0b4cc3 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
@@ -1575,12 +1575,10 @@ static struct _vcs_dpi_voltage_scaling_st construct_low_pstate_lvl(struct clk_li
low_pstate_lvl.phyclk_d18_mhz = dcn2_1_soc.clock_limits[high_voltage_lvl].phyclk_d18_mhz;
low_pstate_lvl.phyclk_mhz = dcn2_1_soc.clock_limits[high_voltage_lvl].phyclk_mhz;
- if (clk_table->num_entries < MAX_NUM_DPM_LVL) {
- for (i = clk_table->num_entries; i > 1; i--)
- clk_table->entries[i] = clk_table->entries[i-1];
- clk_table->entries[1] = clk_table->entries[0];
- clk_table->num_entries++;
- }
+ for (i = clk_table->num_entries; i > 1; i--)
+ clk_table->entries[i] = clk_table->entries[i-1];
+ clk_table->entries[1] = clk_table->entries[0];
+ clk_table->num_entries++;
return low_pstate_lvl;
}
@@ -1612,6 +1610,10 @@ static void update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param
}
}
+ /* clk_table[1] is reserved for min DF PState. skip here to fill in later. */
+ if (i == 1)
+ k++;
+
clock_limits[k].state = k;
clock_limits[k].dcfclk_mhz = clk_table->entries[i].dcfclk_mhz;
clock_limits[k].fabricclk_mhz = clk_table->entries[i].fclk_mhz;
@@ -1628,25 +1630,14 @@ static void update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param
k++;
}
-
- if (clk_table->num_entries >= MAX_NUM_DPM_LVL) {
- for (i = 0; i < clk_table->num_entries + 1; i++)
- dcn2_1_soc.clock_limits[i] = clock_limits[i];
- } else {
- dcn2_1_soc.clock_limits[0] = clock_limits[0];
- for (i = 2; i < clk_table->num_entries + 1; i++) {
- dcn2_1_soc.clock_limits[i] = clock_limits[i - 1];
- dcn2_1_soc.clock_limits[i].state = i;
- }
- }
-
+ for (i = 0; i < clk_table->num_entries + 1; i++)
+ dcn2_1_soc.clock_limits[i] = clock_limits[i];
if (clk_table->num_entries) {
+ dcn2_1_soc.num_states = clk_table->num_entries + 1;
/* fill in min DF PState */
dcn2_1_soc.clock_limits[1] = construct_low_pstate_lvl(clk_table, closest_clk_lvl);
- dcn2_1_soc.num_states = clk_table->num_entries;
/* duplicate last level */
- dcn2_1_soc.clock_limits[dcn2_1_soc.num_states] =
- dcn2_1_soc.clock_limits[dcn2_1_soc.num_states - 1];
+ dcn2_1_soc.clock_limits[dcn2_1_soc.num_states] = dcn2_1_soc.clock_limits[dcn2_1_soc.num_states - 1];
dcn2_1_soc.clock_limits[dcn2_1_soc.num_states].state = dcn2_1_soc.num_states;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 084/266] drm/amd/display: Update scaling settings on modeset
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 083/266] drm/amd/display: Revert "Fix clock table filling logic" Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 085/266] drm/amd/display: Release MST resources on switch from MST to SST Greg Kroah-Hartman
` (185 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roman Li, Nicholas Kazlauskas,
Stylon Wang, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Roman Li <roman.li@amd.com>
[ Upstream commit c521fc316d12fb9ea7b7680e301d673bceda922e ]
[Why]
We update scaling settings when scaling mode has been changed.
However when changing mode from native resolution the scaling mode previously
set gets ignored.
[How]
Perform scaling settings update on modeset.
Signed-off-by: Roman Li <roman.li@amd.com>
Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 2b2d7b9f26f1..b11d90ea8c37 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -9481,7 +9481,8 @@ skip_modeset:
BUG_ON(dm_new_crtc_state->stream == NULL);
/* Scaling or underscan settings */
- if (is_scaling_state_different(dm_old_conn_state, dm_new_conn_state))
+ if (is_scaling_state_different(dm_old_conn_state, dm_new_conn_state) ||
+ drm_atomic_crtc_needs_modeset(new_crtc_state))
update_stream_scaling_settings(
&new_crtc_state->mode, dm_new_conn_state, dm_new_crtc_state->stream);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 085/266] drm/amd/display: Release MST resources on switch from MST to SST
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 084/266] drm/amd/display: Update scaling settings on modeset Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 086/266] drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7 Greg Kroah-Hartman
` (184 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Stempen, Wenjing Liu,
Stylon Wang, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Vladimir Stempen <vladimir.stempen@amd.com>
[ Upstream commit 3f8518b60c10aa96f3efa38a967a0b4eb9211ac0 ]
[why]
When OS overrides training link training parameters
for MST device to SST mode, MST resources are not
released and leak of the resource may result crash and
incorrect MST discovery during following hot plugs.
[how]
Retaining sink object to be reused by SST link and
releasing MST resources.
Signed-off-by: Vladimir Stempen <vladimir.stempen@amd.com>
Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 72bd7bc681a8..ae6830ff1cf7 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1784,6 +1784,8 @@ static void set_dp_mst_mode(struct dc_link *link, bool mst_enable)
link->type = dc_connection_single;
link->local_sink = link->remote_sinks[0];
link->local_sink->sink_signal = SIGNAL_TYPE_DISPLAY_PORT;
+ dc_sink_retain(link->local_sink);
+ dm_helpers_dp_mst_stop_top_mgr(link->ctx, link);
} else if (mst_enable == true &&
link->type == dc_connection_single &&
link->remote_sinks[0] != NULL) {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 086/266] drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 085/266] drm/amd/display: Release MST resources on switch from MST to SST Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 087/266] drm/amd/display: Fix off-by-one error in DML Greg Kroah-Hartman
` (183 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wesley Chalmers, Dmytro Laktyushkin,
Stylon Wang, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Wesley Chalmers <Wesley.Chalmers@amd.com>
[ Upstream commit 3577e1678772ce3ede92af3a75b44a4b76f9b4ad ]
[WHY]
DISPCLK_MAX_ERRDET_CYCLES must be 7 to prevent connection loss when
changing DENTIST_DISPCLK_WDIVIDER from 126 to 127 and back.
Signed-off-by: Wesley Chalmers <Wesley.Chalmers@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 6a10daec15cc..793554e61c52 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -243,7 +243,7 @@ void dcn20_dccg_init(struct dce_hwseq *hws)
REG_WRITE(MILLISECOND_TIME_BASE_DIV, 0x1186a0);
/* This value is dependent on the hardware pipeline delay so set once per SOC */
- REG_WRITE(DISPCLK_FREQ_CHANGE_CNTL, 0x801003c);
+ REG_WRITE(DISPCLK_FREQ_CHANGE_CNTL, 0xe01003c);
}
void dcn20_disable_vga(
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 087/266] drm/amd/display: Fix off-by-one error in DML
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 086/266] drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7 Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 088/266] drm/amd/display: Fix crash during MPO + ODM combine mode recalculation Greg Kroah-Hartman
` (182 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wesley Chalmers, Dmytro Laktyushkin,
Stylon Wang, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Wesley Chalmers <Wesley.Chalmers@amd.com>
[ Upstream commit e4e3678260e9734f6f41b4325aac0b171833a618 ]
[WHY]
For DCN30 and later, there is no data in DML arrays indexed by state at
index num_states.
Signed-off-by: Wesley Chalmers <Wesley.Chalmers@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
index af7d57602b2c..db6bb7ea5316 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
@@ -2053,7 +2053,7 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman
v->DISPCLKWithoutRamping,
v->DISPCLKDPPCLKVCOSpeed);
v->MaxDispclkRoundedToDFSGranularity = RoundToDFSGranularityDown(
- v->soc.clock_limits[mode_lib->soc.num_states].dispclk_mhz,
+ v->soc.clock_limits[mode_lib->soc.num_states - 1].dispclk_mhz,
v->DISPCLKDPPCLKVCOSpeed);
if (v->DISPCLKWithoutRampingRoundedToDFSGranularity
> v->MaxDispclkRoundedToDFSGranularity) {
@@ -3958,20 +3958,20 @@ void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
for (k = 0; k <= v->NumberOfActivePlanes - 1; k++) {
v->PlaneRequiredDISPCLKWithoutODMCombine = v->PixelClock[k] * (1.0 + v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0)
* (1.0 + v->DISPCLKRampingMargin / 100.0);
- if ((v->PlaneRequiredDISPCLKWithoutODMCombine >= v->MaxDispclk[i] && v->MaxDispclk[i] == v->MaxDispclk[mode_lib->soc.num_states]
- && v->MaxDppclk[i] == v->MaxDppclk[mode_lib->soc.num_states])) {
+ if ((v->PlaneRequiredDISPCLKWithoutODMCombine >= v->MaxDispclk[i] && v->MaxDispclk[i] == v->MaxDispclk[mode_lib->soc.num_states - 1]
+ && v->MaxDppclk[i] == v->MaxDppclk[mode_lib->soc.num_states - 1])) {
v->PlaneRequiredDISPCLKWithoutODMCombine = v->PixelClock[k] * (1 + v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
}
v->PlaneRequiredDISPCLKWithODMCombine2To1 = v->PixelClock[k] / 2 * (1 + v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0)
* (1 + v->DISPCLKRampingMargin / 100.0);
- if ((v->PlaneRequiredDISPCLKWithODMCombine2To1 >= v->MaxDispclk[i] && v->MaxDispclk[i] == v->MaxDispclk[mode_lib->soc.num_states]
- && v->MaxDppclk[i] == v->MaxDppclk[mode_lib->soc.num_states])) {
+ if ((v->PlaneRequiredDISPCLKWithODMCombine2To1 >= v->MaxDispclk[i] && v->MaxDispclk[i] == v->MaxDispclk[mode_lib->soc.num_states - 1]
+ && v->MaxDppclk[i] == v->MaxDppclk[mode_lib->soc.num_states - 1])) {
v->PlaneRequiredDISPCLKWithODMCombine2To1 = v->PixelClock[k] / 2 * (1 + v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
}
v->PlaneRequiredDISPCLKWithODMCombine4To1 = v->PixelClock[k] / 4 * (1 + v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0)
* (1 + v->DISPCLKRampingMargin / 100.0);
- if ((v->PlaneRequiredDISPCLKWithODMCombine4To1 >= v->MaxDispclk[i] && v->MaxDispclk[i] == v->MaxDispclk[mode_lib->soc.num_states]
- && v->MaxDppclk[i] == v->MaxDppclk[mode_lib->soc.num_states])) {
+ if ((v->PlaneRequiredDISPCLKWithODMCombine4To1 >= v->MaxDispclk[i] && v->MaxDispclk[i] == v->MaxDispclk[mode_lib->soc.num_states - 1]
+ && v->MaxDppclk[i] == v->MaxDppclk[mode_lib->soc.num_states - 1])) {
v->PlaneRequiredDISPCLKWithODMCombine4To1 = v->PixelClock[k] / 4 * (1 + v->DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 088/266] drm/amd/display: Fix crash during MPO + ODM combine mode recalculation
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 087/266] drm/amd/display: Fix off-by-one error in DML Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 089/266] net: phy: realtek: add delay to fix RXC generation issue Greg Kroah-Hartman
` (181 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aric Cyr, Krunoslav Kovac,
Stylon Wang, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Aric Cyr <aric.cyr@amd.com>
[ Upstream commit 665f28507a2a3d8d72ed9afa9a2b9b17fd43add1 ]
[Why]
When calculating recout width for an MPO plane on a mode that's using
ODM combine, driver can calculate a negative value, resulting in a
crash.
[How]
For negative widths, use zero such that validation will prune the
configuration correctly and disallow MPO.
Signed-off-by: Aric Cyr <aric.cyr@amd.com>
Reviewed-by: Krunoslav Kovac <Krunoslav.Kovac@amd.com>
Acked-by: Stylon Wang <stylon.wang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index 78278a10d899..3b1068a09095 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -776,6 +776,11 @@ static void calculate_recout(struct pipe_ctx *pipe_ctx)
if (split_idx == split_count) {
/* rightmost pipe is the remainder recout */
data->recout.width -= data->h_active * split_count - data->recout.x;
+
+ /* ODM combine cases with MPO we can get negative widths */
+ if (data->recout.width < 0)
+ data->recout.width = 0;
+
data->recout.x = 0;
} else
data->recout.width = data->h_active - data->recout.x;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 089/266] net: phy: realtek: add delay to fix RXC generation issue
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 088/266] drm/amd/display: Fix crash during MPO + ODM combine mode recalculation Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 090/266] selftests: Clean forgotten resources as part of cleanup() Greg Kroah-Hartman
` (180 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joakim Zhang, David S. Miller, Sasha Levin
From: Joakim Zhang <qiangqing.zhang@nxp.com>
[ Upstream commit 6813cc8cfdaf401476e1a007cec8ae338cefa573 ]
PHY will delay about 11.5ms to generate RXC clock when switching from
power down to normal operation. Read/write registers would also cause RXC
become unstable and stop for a while during this process. Realtek engineer
suggests 15ms or more delay can workaround this issue.
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/realtek.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index 821e85a97367..7b99a3234c65 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -357,6 +357,19 @@ static int rtl8211f_config_init(struct phy_device *phydev)
return 0;
}
+static int rtl821x_resume(struct phy_device *phydev)
+{
+ int ret;
+
+ ret = genphy_resume(phydev);
+ if (ret < 0)
+ return ret;
+
+ msleep(20);
+
+ return 0;
+}
+
static int rtl8211e_config_init(struct phy_device *phydev)
{
int ret = 0, oldpage;
@@ -852,7 +865,7 @@ static struct phy_driver realtek_drvs[] = {
.config_intr = &rtl8211f_config_intr,
.handle_interrupt = rtl8211f_handle_interrupt,
.suspend = genphy_suspend,
- .resume = genphy_resume,
+ .resume = rtl821x_resume,
.read_page = rtl821x_read_page,
.write_page = rtl821x_write_page,
}, {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 090/266] selftests: Clean forgotten resources as part of cleanup()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 089/266] net: phy: realtek: add delay to fix RXC generation issue Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 091/266] net: sgi: ioc3-eth: check return value after calling platform_get_resource() Greg Kroah-Hartman
` (179 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Amit Cohen, Petr Machata,
Ido Schimmel, David S. Miller, Sasha Levin
From: Amit Cohen <amcohen@nvidia.com>
[ Upstream commit e67dfb8d15deb33c425d0b0ee22f2e5eef54c162 ]
Several tests do not set some ports down as part of their cleanup(),
resulting in IPv6 link-local addresses and associated routes not being
deleted.
These leaks were found using a BPF tool that monitors ASIC resources.
Solve this by setting the ports down at the end of the tests.
Signed-off-by: Amit Cohen <amcohen@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh | 3 +++
.../selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh | 3 +++
tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh | 2 ++
tools/testing/selftests/net/forwarding/pedit_dsfield.sh | 2 ++
tools/testing/selftests/net/forwarding/pedit_l4port.sh | 2 ++
tools/testing/selftests/net/forwarding/skbedit_priority.sh | 2 ++
6 files changed, 14 insertions(+)
diff --git a/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh b/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh
index 4029833f7e27..160891dcb4bc 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_drops.sh
@@ -109,6 +109,9 @@ router_destroy()
__addr_add_del $rp1 del 192.0.2.2/24 2001:db8:1::2/64
tc qdisc del dev $rp2 clsact
+
+ ip link set dev $rp2 down
+ ip link set dev $rp1 down
}
setup_prepare()
diff --git a/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh b/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh
index 42d44e27802c..190c1b6b5365 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/devlink_trap_l3_exceptions.sh
@@ -111,6 +111,9 @@ router_destroy()
__addr_add_del $rp1 del 192.0.2.2/24 2001:db8:1::2/64
tc qdisc del dev $rp2 clsact
+
+ ip link set dev $rp2 down
+ ip link set dev $rp1 down
}
setup_prepare()
diff --git a/tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh b/tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh
index 5cbff8038f84..28a570006d4d 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/qos_dscp_bridge.sh
@@ -93,7 +93,9 @@ switch_destroy()
lldptool -T -i $swp1 -V APP -d $(dscp_map 10) >/dev/null
lldpad_app_wait_del
+ ip link set dev $swp2 down
ip link set dev $swp2 nomaster
+ ip link set dev $swp1 down
ip link set dev $swp1 nomaster
ip link del dev br1
}
diff --git a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
index 55eeacf59241..64fbd211d907 100755
--- a/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
+++ b/tools/testing/selftests/net/forwarding/pedit_dsfield.sh
@@ -75,7 +75,9 @@ switch_destroy()
tc qdisc del dev $swp2 clsact
tc qdisc del dev $swp1 clsact
+ ip link set dev $swp2 down
ip link set dev $swp2 nomaster
+ ip link set dev $swp1 down
ip link set dev $swp1 nomaster
ip link del dev br1
}
diff --git a/tools/testing/selftests/net/forwarding/pedit_l4port.sh b/tools/testing/selftests/net/forwarding/pedit_l4port.sh
index 5f20d289ee43..10e594c55117 100755
--- a/tools/testing/selftests/net/forwarding/pedit_l4port.sh
+++ b/tools/testing/selftests/net/forwarding/pedit_l4port.sh
@@ -71,7 +71,9 @@ switch_destroy()
tc qdisc del dev $swp2 clsact
tc qdisc del dev $swp1 clsact
+ ip link set dev $swp2 down
ip link set dev $swp2 nomaster
+ ip link set dev $swp1 down
ip link set dev $swp1 nomaster
ip link del dev br1
}
diff --git a/tools/testing/selftests/net/forwarding/skbedit_priority.sh b/tools/testing/selftests/net/forwarding/skbedit_priority.sh
index e3bd8a6bb8b4..bde11dc27873 100755
--- a/tools/testing/selftests/net/forwarding/skbedit_priority.sh
+++ b/tools/testing/selftests/net/forwarding/skbedit_priority.sh
@@ -72,7 +72,9 @@ switch_destroy()
tc qdisc del dev $swp2 clsact
tc qdisc del dev $swp1 clsact
+ ip link set dev $swp2 down
ip link set dev $swp2 nomaster
+ ip link set dev $swp1 down
ip link set dev $swp1 nomaster
ip link del dev br1
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 091/266] net: sgi: ioc3-eth: check return value after calling platform_get_resource()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 090/266] selftests: Clean forgotten resources as part of cleanup() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 092/266] drm/amdkfd: use allowed domain for vmbo validation Greg Kroah-Hartman
` (178 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Yingliang, David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit db8f7be1e1d64fbf113a456ef94534fbf5e9a9af ]
It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sgi/ioc3-eth.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c b/drivers/net/ethernet/sgi/ioc3-eth.c
index 6eef0f45b133..2b29fd4cbdf4 100644
--- a/drivers/net/ethernet/sgi/ioc3-eth.c
+++ b/drivers/net/ethernet/sgi/ioc3-eth.c
@@ -835,6 +835,10 @@ static int ioc3eth_probe(struct platform_device *pdev)
int err;
regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!regs) {
+ dev_err(&pdev->dev, "Invalid resource\n");
+ return -EINVAL;
+ }
/* get mac addr from one wire prom */
if (ioc3eth_get_mac_addr(regs, mac_addr))
return -EPROBE_DEFER; /* not available yet */
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 092/266] drm/amdkfd: use allowed domain for vmbo validation
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 091/266] net: sgi: ioc3-eth: check return value after calling platform_get_resource() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 093/266] fjes: check return value after calling platform_get_resource() Greg Kroah-Hartman
` (177 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nirmoy Das, Christian König,
Felix Kuehling, Alex Deucher, Sasha Levin
From: Nirmoy Das <nirmoy.das@amd.com>
[ Upstream commit bc05716d4fdd065013633602c5960a2bf1511b9c ]
Fixes handling when page tables are in system memory.
v3: remove struct amdgpu_vm_parser.
v2: remove unwanted variable.
change amdgpu_amdkfd_validate instead of amdgpu_amdkfd_bo_validate.
Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 21 ++++---------------
1 file changed, 4 insertions(+), 17 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 7d4118c8128a..5e69b5b50a19 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -50,12 +50,6 @@ static struct {
spinlock_t mem_limit_lock;
} kfd_mem_limit;
-/* Struct used for amdgpu_amdkfd_bo_validate */
-struct amdgpu_vm_parser {
- uint32_t domain;
- bool wait;
-};
-
static const char * const domain_bit_to_string[] = {
"CPU",
"GTT",
@@ -346,11 +340,9 @@ validate_fail:
return ret;
}
-static int amdgpu_amdkfd_validate(void *param, struct amdgpu_bo *bo)
+static int amdgpu_amdkfd_validate_vm_bo(void *_unused, struct amdgpu_bo *bo)
{
- struct amdgpu_vm_parser *p = param;
-
- return amdgpu_amdkfd_bo_validate(bo, p->domain, p->wait);
+ return amdgpu_amdkfd_bo_validate(bo, bo->allowed_domains, false);
}
/* vm_validate_pt_pd_bos - Validate page table and directory BOs
@@ -364,20 +356,15 @@ static int vm_validate_pt_pd_bos(struct amdgpu_vm *vm)
{
struct amdgpu_bo *pd = vm->root.base.bo;
struct amdgpu_device *adev = amdgpu_ttm_adev(pd->tbo.bdev);
- struct amdgpu_vm_parser param;
int ret;
- param.domain = AMDGPU_GEM_DOMAIN_VRAM;
- param.wait = false;
-
- ret = amdgpu_vm_validate_pt_bos(adev, vm, amdgpu_amdkfd_validate,
- ¶m);
+ ret = amdgpu_vm_validate_pt_bos(adev, vm, amdgpu_amdkfd_validate_vm_bo, NULL);
if (ret) {
pr_err("failed to validate PT BOs\n");
return ret;
}
- ret = amdgpu_amdkfd_validate(¶m, pd);
+ ret = amdgpu_amdkfd_validate_vm_bo(NULL, pd);
if (ret) {
pr_err("failed to validate PD\n");
return ret;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 093/266] fjes: check return value after calling platform_get_resource()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 092/266] drm/amdkfd: use allowed domain for vmbo validation Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 094/266] net: mido: mdio-mux-bcm-iproc: Use devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
` (176 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Yingliang, David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit f18c11812c949553d2b2481ecaa274dd51bed1e7 ]
It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/fjes/fjes_main.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index 466622664424..e449d9466122 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -1262,6 +1262,10 @@ static int fjes_probe(struct platform_device *plat_dev)
adapter->interrupt_watch_enable = false;
res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0);
+ if (!res) {
+ err = -EINVAL;
+ goto err_free_control_wq;
+ }
hw->hw_res.start = res->start;
hw->hw_res.size = resource_size(res);
hw->hw_res.irq = platform_get_irq(plat_dev, 0);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 094/266] net: mido: mdio-mux-bcm-iproc: Use devm_platform_get_and_ioremap_resource()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 093/266] fjes: check return value after calling platform_get_resource() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 095/266] selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC Greg Kroah-Hartman
` (175 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yang Yingliang, David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 8a55a73433e763c8aec4a3e8df5c28c821fc44b9 ]
Use devm_platform_get_and_ioremap_resource() to simplify
code and avoid a null-ptr-deref by checking 'res' in it.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/mdio/mdio-mux-bcm-iproc.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/mdio/mdio-mux-bcm-iproc.c b/drivers/net/mdio/mdio-mux-bcm-iproc.c
index 03261e6b9ceb..aa29d6bdbdf2 100644
--- a/drivers/net/mdio/mdio-mux-bcm-iproc.c
+++ b/drivers/net/mdio/mdio-mux-bcm-iproc.c
@@ -187,7 +187,9 @@ static int mdio_mux_iproc_probe(struct platform_device *pdev)
return -ENOMEM;
md->dev = &pdev->dev;
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ md->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ if (IS_ERR(md->base))
+ return PTR_ERR(md->base);
if (res->start & 0xfff) {
/* For backward compatibility in case the
* base address is specified with an offset.
@@ -196,9 +198,6 @@ static int mdio_mux_iproc_probe(struct platform_device *pdev)
res->start &= ~0xfff;
res->end = res->start + MDIO_REG_ADDR_SPACE_SIZE - 1;
}
- md->base = devm_ioremap_resource(&pdev->dev, res);
- if (IS_ERR(md->base))
- return PTR_ERR(md->base);
md->mii_bus = devm_mdiobus_alloc(&pdev->dev);
if (!md->mii_bus) {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 095/266] selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 094/266] net: mido: mdio-mux-bcm-iproc: Use devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 096/266] r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM Greg Kroah-Hartman
` (174 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Minchan Kim, Paul Moore, Sasha Levin
From: Minchan Kim <minchan@kernel.org>
[ Upstream commit 648f2c6100cfa18e7dfe43bc0b9c3b73560d623c ]
In the field, we have seen lots of allocation failure from the call
path below.
06-03 13:29:12.999 1010315 31557 31557 W Binder : 31542_2: page allocation failure: order:0, mode:0x800(GFP_NOWAIT), nodemask=(null),cpuset=background,mems_allowed=0
...
...
06-03 13:29:12.999 1010315 31557 31557 W Call trace:
06-03 13:29:12.999 1010315 31557 31557 W : dump_backtrace.cfi_jt+0x0/0x8
06-03 13:29:12.999 1010315 31557 31557 W : dump_stack+0xc8/0x14c
06-03 13:29:12.999 1010315 31557 31557 W : warn_alloc+0x158/0x1c8
06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_slowpath+0x9d8/0xb80
06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_nodemask+0x1c4/0x430
06-03 13:29:12.999 1010315 31557 31557 W : allocate_slab+0xb4/0x390
06-03 13:29:12.999 1010315 31557 31557 W : ___slab_alloc+0x12c/0x3a4
06-03 13:29:12.999 1010315 31557 31557 W : kmem_cache_alloc+0x358/0x5e4
06-03 13:29:12.999 1010315 31557 31557 W : avc_alloc_node+0x30/0x184
06-03 13:29:12.999 1010315 31557 31557 W : avc_update_node+0x54/0x4f0
06-03 13:29:12.999 1010315 31557 31557 W : avc_has_extended_perms+0x1a4/0x460
06-03 13:29:12.999 1010315 31557 31557 W : selinux_file_ioctl+0x320/0x3d0
06-03 13:29:12.999 1010315 31557 31557 W : __arm64_sys_ioctl+0xec/0x1fc
06-03 13:29:12.999 1010315 31557 31557 W : el0_svc_common+0xc0/0x24c
06-03 13:29:12.999 1010315 31557 31557 W : el0_svc+0x28/0x88
06-03 13:29:12.999 1010315 31557 31557 W : el0_sync_handler+0x8c/0xf0
06-03 13:29:12.999 1010315 31557 31557 W : el0_sync+0x1a4/0x1c0
..
..
06-03 13:29:12.999 1010315 31557 31557 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:12.999 1010315 31557 31557 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:12.999 1010315 31557 31557 W node 0 : slabs: 57, objs: 2907, free: 0
06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0
06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0
06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:13.000 10230 30892 30892 W node 0 : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
Based on [1], selinux is tolerate for failure of memory allocation.
Then, use __GFP_NOWARN together.
[1] 476accbe2f6e ("selinux: use GFP_NOWAIT in the AVC kmem_caches")
Signed-off-by: Minchan Kim <minchan@kernel.org>
[PM: subj fix, line wraps, normalized commit refs]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/selinux/avc.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index ad451cf9375e..a2dc83228daf 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -297,26 +297,27 @@ static struct avc_xperms_decision_node
struct avc_xperms_decision_node *xpd_node;
struct extended_perms_decision *xpd;
- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT);
+ xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep,
+ GFP_NOWAIT | __GFP_NOWARN);
if (!xpd_node)
return NULL;
xpd = &xpd_node->xpd;
if (which & XPERMS_ALLOWED) {
xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep,
- GFP_NOWAIT);
+ GFP_NOWAIT | __GFP_NOWARN);
if (!xpd->allowed)
goto error;
}
if (which & XPERMS_AUDITALLOW) {
xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep,
- GFP_NOWAIT);
+ GFP_NOWAIT | __GFP_NOWARN);
if (!xpd->auditallow)
goto error;
}
if (which & XPERMS_DONTAUDIT) {
xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep,
- GFP_NOWAIT);
+ GFP_NOWAIT | __GFP_NOWARN);
if (!xpd->dontaudit)
goto error;
}
@@ -344,7 +345,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void)
{
struct avc_xperms_node *xp_node;
- xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT);
+ xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT | __GFP_NOWARN);
if (!xp_node)
return xp_node;
INIT_LIST_HEAD(&xp_node->xpd_head);
@@ -500,7 +501,7 @@ static struct avc_node *avc_alloc_node(struct selinux_avc *avc)
{
struct avc_node *node;
- node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT);
+ node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT | __GFP_NOWARN);
if (!node)
goto out;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 096/266] r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 095/266] selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 097/266] drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check Greg Kroah-Hartman
` (173 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Koba Ko, Heiner Kallweit,
David S. Miller, Sasha Levin
From: Heiner Kallweit <hkallweit1@gmail.com>
[ Upstream commit 1ee8856de82faec9bc8bd0f2308a7f27e30ba207 ]
It has been reported that on RTL8106e the link-up interrupt may be
significantly delayed if the user enables ASPM L1. Per default ASPM
is disabled. The change leaves L1 enabled on the PCIe link (thus still
allowing to reach higher package power saving states), but the
NIC won't actively trigger it.
Reported-by: Koba Ko <koba.ko@canonical.com>
Tested-by: Koba Ko <koba.ko@canonical.com>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/realtek/r8169_main.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 2ee72dc431cd..a0d4e052a79e 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -3510,7 +3510,6 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp)
rtl_eri_write(tp, 0x1b0, ERIAR_MASK_0011, 0x0000);
rtl_pcie_state_l2l3_disable(tp);
- rtl_hw_aspm_clkreq_enable(tp, true);
}
DECLARE_RTL_COND(rtl_mac_ocp_e00e_cond)
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 097/266] drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 096/266] r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 098/266] ibmvnic: fix kernel build warnings in build_hdr_descs_arr Greg Kroah-Hartman
` (172 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Harry Wentland, Mark Yacoub,
Alex Deucher, Sasha Levin
From: Mark Yacoub <markyacoub@chromium.org>
[ Upstream commit 03fc4cf45d30533d54f0f4ebc02aacfa12f52ce2 ]
For each CRTC state, check the size of Gamma and Degamma LUTs so
unexpected and larger sizes wouldn't slip through.
TEST: IGT:kms_color::pipe-invalid-gamma-lut-sizes
v2: fix assignments in if clauses, Mark's email.
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Mark Yacoub <markyacoub@chromium.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 1 +
.../amd/display/amdgpu_dm/amdgpu_dm_color.c | 41 ++++++++++++++++---
3 files changed, 40 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b11d90ea8c37..f2866a625f80 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -10049,6 +10049,10 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
dm_old_crtc_state->dsc_force_changed == false)
continue;
+ ret = amdgpu_dm_verify_lut_sizes(new_crtc_state);
+ if (ret)
+ goto fail;
+
if (!new_crtc_state->enable)
continue;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
index b2f2ccfc20bb..c8e5bbbb8bce 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -591,6 +591,7 @@ void amdgpu_dm_trigger_timing_sync(struct drm_device *dev);
#define MAX_COLOR_LEGACY_LUT_ENTRIES 256
void amdgpu_dm_init_color_mod(void);
+int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state);
int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc);
int amdgpu_dm_update_plane_color_mgmt(struct dm_crtc_state *crtc,
struct dc_plane_state *dc_plane_state);
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
index 157fe4efbb59..a022e5bb30a5 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
@@ -284,6 +284,37 @@ static int __set_input_tf(struct dc_transfer_func *func,
return res ? 0 : -ENOMEM;
}
+/**
+ * Verifies that the Degamma and Gamma LUTs attached to the |crtc_state| are of
+ * the expected size.
+ * Returns 0 on success.
+ */
+int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state)
+{
+ const struct drm_color_lut *lut = NULL;
+ uint32_t size = 0;
+
+ lut = __extract_blob_lut(crtc_state->degamma_lut, &size);
+ if (lut && size != MAX_COLOR_LUT_ENTRIES) {
+ DRM_DEBUG_DRIVER(
+ "Invalid Degamma LUT size. Should be %u but got %u.\n",
+ MAX_COLOR_LUT_ENTRIES, size);
+ return -EINVAL;
+ }
+
+ lut = __extract_blob_lut(crtc_state->gamma_lut, &size);
+ if (lut && size != MAX_COLOR_LUT_ENTRIES &&
+ size != MAX_COLOR_LEGACY_LUT_ENTRIES) {
+ DRM_DEBUG_DRIVER(
+ "Invalid Gamma LUT size. Should be %u (or %u for legacy) but got %u.\n",
+ MAX_COLOR_LUT_ENTRIES, MAX_COLOR_LEGACY_LUT_ENTRIES,
+ size);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
/**
* amdgpu_dm_update_crtc_color_mgmt: Maps DRM color management to DC stream.
* @crtc: amdgpu_dm crtc state
@@ -317,14 +348,12 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
bool is_legacy;
int r;
- degamma_lut = __extract_blob_lut(crtc->base.degamma_lut, °amma_size);
- if (degamma_lut && degamma_size != MAX_COLOR_LUT_ENTRIES)
- return -EINVAL;
+ r = amdgpu_dm_verify_lut_sizes(&crtc->base);
+ if (r)
+ return r;
+ degamma_lut = __extract_blob_lut(crtc->base.degamma_lut, °amma_size);
regamma_lut = __extract_blob_lut(crtc->base.gamma_lut, ®amma_size);
- if (regamma_lut && regamma_size != MAX_COLOR_LUT_ENTRIES &&
- regamma_size != MAX_COLOR_LEGACY_LUT_ENTRIES)
- return -EINVAL;
has_degamma =
degamma_lut && !__is_lut_linear(degamma_lut, degamma_size);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 098/266] ibmvnic: fix kernel build warnings in build_hdr_descs_arr
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 097/266] drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 099/266] xfrm: Fix error reporting in xfrm_state_construct Greg Kroah-Hartman
` (171 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lijun Pan, David S. Miller, Sasha Levin
From: Lijun Pan <lijunp213@gmail.com>
[ Upstream commit 73214a690c50a134bd364e1a4430e0e7ac81a8d8 ]
Fix the following kernel build warnings:
drivers/net/ethernet/ibm/ibmvnic.c:1516: warning: Function parameter or member 'skb' not described in 'build_hdr_descs_arr'
drivers/net/ethernet/ibm/ibmvnic.c:1516: warning: Function parameter or member 'indir_arr' not described in 'build_hdr_descs_arr'
drivers/net/ethernet/ibm/ibmvnic.c:1516: warning: Excess function parameter 'txbuff' description in 'build_hdr_descs_arr'
Signed-off-by: Lijun Pan <lijunp213@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index ede65b32f821..efc98903c0b7 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1554,7 +1554,8 @@ static int create_hdr_descs(u8 hdr_field, u8 *hdr_data, int len, int *hdr_len,
/**
* build_hdr_descs_arr - build a header descriptor array
- * @txbuff: tx buffer
+ * @skb: tx socket buffer
+ * @indir_arr: indirect array
* @num_entries: number of descriptors to be sent
* @hdr_field: bit field determining which headers will be sent
*
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 099/266] xfrm: Fix error reporting in xfrm_state_construct.
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 098/266] ibmvnic: fix kernel build warnings in build_hdr_descs_arr Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 100/266] dm writecache: commit just one block, not a full page Greg Kroah-Hartman
` (170 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tobias Brunner, Steffen Klassert,
Sasha Levin
From: Steffen Klassert <steffen.klassert@secunet.com>
[ Upstream commit 6fd06963fa74197103cdbb4b494763127b3f2f34 ]
When memory allocation for XFRMA_ENCAP or XFRMA_COADDR fails,
the error will not be reported because the -ENOMEM assignment
to the err variable is overwritten before. Fix this by moving
these two in front of the function so that memory allocation
failures will be reported.
Reported-by: Tobias Brunner <tobias@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_user.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f0aecee4d539..b47d613409b7 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -580,6 +580,20 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
copy_from_user_state(x, p);
+ if (attrs[XFRMA_ENCAP]) {
+ x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
+ sizeof(*x->encap), GFP_KERNEL);
+ if (x->encap == NULL)
+ goto error;
+ }
+
+ if (attrs[XFRMA_COADDR]) {
+ x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
+ sizeof(*x->coaddr), GFP_KERNEL);
+ if (x->coaddr == NULL)
+ goto error;
+ }
+
if (attrs[XFRMA_SA_EXTRA_FLAGS])
x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);
@@ -600,23 +614,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
attrs[XFRMA_ALG_COMP])))
goto error;
- if (attrs[XFRMA_ENCAP]) {
- x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
- sizeof(*x->encap), GFP_KERNEL);
- if (x->encap == NULL)
- goto error;
- }
-
if (attrs[XFRMA_TFCPAD])
x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
- if (attrs[XFRMA_COADDR]) {
- x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
- sizeof(*x->coaddr), GFP_KERNEL);
- if (x->coaddr == NULL)
- goto error;
- }
-
xfrm_mark_get(attrs, &x->mark);
xfrm_smark_init(attrs, &x->props.smark);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 100/266] dm writecache: commit just one block, not a full page
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 099/266] xfrm: Fix error reporting in xfrm_state_construct Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 101/266] wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP Greg Kroah-Hartman
` (169 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer, Sasha Levin
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 991bd8d7bc78966b4dc427b53a144f276bffcd52 ]
Some architectures have pages larger than 4k and committing a full
page causes needless overhead.
Fix this by writing a single block when committing the superblock.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-writecache.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
index a44007297e63..0e3a6c4bd5e3 100644
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -532,11 +532,7 @@ static void ssd_commit_superblock(struct dm_writecache *wc)
region.bdev = wc->ssd_dev->bdev;
region.sector = 0;
- region.count = PAGE_SIZE >> SECTOR_SHIFT;
-
- if (unlikely(region.sector + region.count > wc->metadata_sectors))
- region.count = wc->metadata_sectors - region.sector;
-
+ region.count = wc->block_size >> SECTOR_SHIFT;
region.sector += wc->start_sector;
req.bi_op = REQ_OP_WRITE;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 101/266] wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 100/266] dm writecache: commit just one block, not a full page Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 102/266] net: phy: nxp-c45-tja11xx: enable MDIO write access to the master/slave registers Greg Kroah-Hartman
` (168 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Carl Philipp Klemm, Tony Lindgren,
Kalle Valo, Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 11ef6bc846dcdce838f0b00c5f6a562c57e5d43b ]
At least on wl12xx, reading the MAC after boot can fail with a warning
at drivers/net/wireless/ti/wlcore/sdio.c:78 wl12xx_sdio_raw_read.
The failed call comes from wl12xx_get_mac() that wlcore_nvs_cb() calls
after request_firmware_work_func().
After the error, no wireless interface is created. Reloading the wl12xx
module makes the interface work.
Turns out the wlan controller can be in a low-power ELP state after the
boot from the bootloader or kexec, and needs to be woken up first.
Let's wake the hardware and add a sleep after that similar to
wl12xx_pre_boot() is already doing.
Note that a similar issue could exist for wl18xx, but I have not seen it
so far. And a search for wl18xx_get_mac and wl12xx_sdio_raw_read did not
produce similar errors.
Cc: Carl Philipp Klemm <philipp@uvos.xyz>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210603062814.19464-1-tony@atomide.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ti/wl12xx/main.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index 9d7dbfe7fe0c..c6da0cfb4afb 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -1503,6 +1503,13 @@ static int wl12xx_get_fuse_mac(struct wl1271 *wl)
u32 mac1, mac2;
int ret;
+ /* Device may be in ELP from the bootloader or kexec */
+ ret = wlcore_write32(wl, WL12XX_WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
+ if (ret < 0)
+ goto out;
+
+ usleep_range(500000, 700000);
+
ret = wlcore_set_partition(wl, &wl->ptable[PART_DRPW]);
if (ret < 0)
goto out;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 102/266] net: phy: nxp-c45-tja11xx: enable MDIO write access to the master/slave registers
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 101/266] wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 103/266] wl1251: Fix possible buffer overflow in wl1251_cmd_scan Greg Kroah-Hartman
` (167 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Radu Pirea (NXP OSS),
Vladimir Oltean, Russell King (Oracle),
David S. Miller, Sasha Levin
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 0b5f0f29b118910c89fe249cdfbc11b400a86a18 ]
The SJA1110 switch integrates TJA1103 PHYs, but in SJA1110 switch rev B
silicon, there is a bug in that the registers for selecting the 100base-T1
autoneg master/slave roles are not writable.
To enable write access to the master/slave registers, these additional
PHY writes are necessary during initialization.
The issue has been corrected in later SJA1110 silicon versions and is
not present in the standalone PHY variants, but applying the workaround
unconditionally in the driver should not do any harm.
Suggested-by: Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/nxp-c45-tja11xx.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/phy/nxp-c45-tja11xx.c b/drivers/net/phy/nxp-c45-tja11xx.c
index 26b9c0d7cb9d..b7ce0e737333 100644
--- a/drivers/net/phy/nxp-c45-tja11xx.c
+++ b/drivers/net/phy/nxp-c45-tja11xx.c
@@ -546,6 +546,12 @@ static int nxp_c45_config_init(struct phy_device *phydev)
return ret;
}
+ /* Bug workaround for SJA1110 rev B: enable write access
+ * to MDIO_MMD_PMAPMD
+ */
+ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F8, 1);
+ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F9, 2);
+
phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, VEND1_PHY_CONFIG,
PHY_CONFIG_AUTO);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 103/266] wl1251: Fix possible buffer overflow in wl1251_cmd_scan
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 102/266] net: phy: nxp-c45-tja11xx: enable MDIO write access to the master/slave registers Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 104/266] cw1200: add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
` (166 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lee Gibson, Kalle Valo, Sasha Levin
From: Lee Gibson <leegib@gmail.com>
[ Upstream commit d10a87a3535cce2b890897914f5d0d83df669c63 ]
Function wl1251_cmd_scan calls memcpy without checking the length.
Harden by checking the length is within the maximum allowed size.
Signed-off-by: Lee Gibson <leegib@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210428115508.25624-1-leegib@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ti/wl1251/cmd.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
index 498c8db2eb48..d7a869106782 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.c
+++ b/drivers/net/wireless/ti/wl1251/cmd.c
@@ -454,9 +454,12 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
cmd->channels[i].channel = channels[i]->hw_value;
}
- cmd->params.ssid_len = ssid_len;
- if (ssid)
- memcpy(cmd->params.ssid, ssid, ssid_len);
+ if (ssid) {
+ int len = clamp_val(ssid_len, 0, IEEE80211_MAX_SSID_LEN);
+
+ cmd->params.ssid_len = len;
+ memcpy(cmd->params.ssid, ssid, len);
+ }
ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd));
if (ret < 0) {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 104/266] cw1200: add missing MODULE_DEVICE_TABLE
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 103/266] wl1251: Fix possible buffer overflow in wl1251_cmd_scan Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 105/266] drm/amdkfd: fix circular locking on get_wave_state Greg Kroah-Hartman
` (165 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zou Wei, Kalle Valo, Sasha Levin
From: Zou Wei <zou_wei@huawei.com>
[ Upstream commit dd778f89225cd258e8f0fed2b7256124982c8bb5 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1620788714-14300-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/st/cw1200/cw1200_sdio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/st/cw1200/cw1200_sdio.c b/drivers/net/wireless/st/cw1200/cw1200_sdio.c
index b65ec14136c7..4c30b5772ce0 100644
--- a/drivers/net/wireless/st/cw1200/cw1200_sdio.c
+++ b/drivers/net/wireless/st/cw1200/cw1200_sdio.c
@@ -53,6 +53,7 @@ static const struct sdio_device_id cw1200_sdio_ids[] = {
{ SDIO_DEVICE(SDIO_VENDOR_ID_STE, SDIO_DEVICE_ID_STE_CW1200) },
{ /* end: all zeroes */ },
};
+MODULE_DEVICE_TABLE(sdio, cw1200_sdio_ids);
/* hwbus_ops implemetation */
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 105/266] drm/amdkfd: fix circular locking on get_wave_state
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 104/266] cw1200: add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 106/266] drm/amd/display: Cover edge-case when changing DISPCLK WDIVIDER Greg Kroah-Hartman
` (164 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Kim, Felix Kuehling,
Alex Deucher, Sasha Levin
From: Jonathan Kim <jonathan.kim@amd.com>
[ Upstream commit 63f6e01237257e7226efc5087f3f0b525d320f54 ]
get_wave_state acquires the mmap_lock on copy_to_user but so do
mmu_notifiers. mmu_notifiers allows dqm locking so do get_wave_state
outside the dqm_lock to prevent circular locking.
v2: squash in unused variable removal.
Signed-off-by: Jonathan Kim <jonathan.kim@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/amdkfd/kfd_device_queue_manager.c | 28 +++++++++----------
1 file changed, 13 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index d3eaa1549bd7..ccc9d108caff 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1674,29 +1674,27 @@ static int get_wave_state(struct device_queue_manager *dqm,
u32 *save_area_used_size)
{
struct mqd_manager *mqd_mgr;
- int r;
dqm_lock(dqm);
- if (q->properties.type != KFD_QUEUE_TYPE_COMPUTE ||
- q->properties.is_active || !q->device->cwsr_enabled) {
- r = -EINVAL;
- goto dqm_unlock;
- }
-
mqd_mgr = dqm->mqd_mgrs[KFD_MQD_TYPE_CP];
- if (!mqd_mgr->get_wave_state) {
- r = -EINVAL;
- goto dqm_unlock;
+ if (q->properties.type != KFD_QUEUE_TYPE_COMPUTE ||
+ q->properties.is_active || !q->device->cwsr_enabled ||
+ !mqd_mgr->get_wave_state) {
+ dqm_unlock(dqm);
+ return -EINVAL;
}
- r = mqd_mgr->get_wave_state(mqd_mgr, q->mqd, ctl_stack,
- ctl_stack_used_size, save_area_used_size);
-
-dqm_unlock:
dqm_unlock(dqm);
- return r;
+
+ /*
+ * get_wave_state is outside the dqm lock to prevent circular locking
+ * and the queue should be protected against destruction by the process
+ * lock.
+ */
+ return mqd_mgr->get_wave_state(mqd_mgr, q->mqd, ctl_stack,
+ ctl_stack_used_size, save_area_used_size);
}
static int process_termination_cpsch(struct device_queue_manager *dqm,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 106/266] drm/amd/display: Cover edge-case when changing DISPCLK WDIVIDER
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 105/266] drm/amdkfd: fix circular locking on get_wave_state Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 21:12 ` Stefan Lippers-Hollmann
2021-07-15 18:37 ` [PATCH 5.13 107/266] drm/amdkfd: Fix circular lock in nocpsch path Greg Kroah-Hartman
` (163 subsequent siblings)
269 siblings, 1 reply; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wesley Chalmers, Dmytro Laktyushkin,
Anson Jacob, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Wesley Chalmers <Wesley.Chalmers@amd.com>
[ Upstream commit 78ebca321999699f30ea19029726d1a3908b395f ]
[WHY]
When changing the DISPCLK_WDIVIDER value from 126 to 127, the change in
clock rate is too great for the FIFOs to handle. This can cause visible
corruption during clock change.
HW has handed down this register sequence to fix the issue.
[HOW]
The sequence, from HW:
a. 127 -> 126
Read DIG_FIFO_CAL_AVERAGE_LEVEL
FIFO level N = DIG_FIFO_CAL_AVERAGE_LEVEL / 4
Set DCCG_FIFO_ERRDET_OVR_EN = 1
Write 1 to OTGx_DROP_PIXEL for (N-4) times
Set DCCG_FIFO_ERRDET_OVR_EN = 0
Write DENTIST_DISPCLK_RDIVIDER = 126
Because of frequency stepping, sequence a can be executed to change the
divider from 127 to any other divider value.
b. 126 -> 127
Read DIG_FIFO_CAL_AVERAGE_LEVEL
FIFO level N = DIG_FIFO_CAL_AVERAGE_LEVEL / 4
Set DCCG_FIFO_ERRDET_OVR_EN = 1
Write 1 to OTGx_ADD_PIXEL for (12-N) times
Set DCCG_FIFO_ERRDET_OVR_EN = 0
Write DENTIST_DISPCLK_RDIVIDER = 127
Because of frequency stepping, divider must first be set from any other
divider value to 126 before executing sequence b.
Signed-off-by: Wesley Chalmers <Wesley.Chalmers@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Acked-by: Anson Jacob <Anson.Jacob@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c | 68 ++++++++++++++++++-
.../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h | 3 +-
.../display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c | 4 +-
3 files changed, 69 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
index 372d53b5a34d..3d335b4e9891 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
@@ -123,7 +123,7 @@ void dcn20_update_clocks_update_dpp_dto(struct clk_mgr_internal *clk_mgr,
}
}
-void dcn20_update_clocks_update_dentist(struct clk_mgr_internal *clk_mgr)
+void dcn20_update_clocks_update_dentist(struct clk_mgr_internal *clk_mgr, struct dc_state *context)
{
int dpp_divider = DENTIST_DIVIDER_RANGE_SCALE_FACTOR
* clk_mgr->base.dentist_vco_freq_khz / clk_mgr->base.clks.dppclk_khz;
@@ -132,6 +132,68 @@ void dcn20_update_clocks_update_dentist(struct clk_mgr_internal *clk_mgr)
uint32_t dppclk_wdivider = dentist_get_did_from_divider(dpp_divider);
uint32_t dispclk_wdivider = dentist_get_did_from_divider(disp_divider);
+ uint32_t current_dispclk_wdivider;
+ uint32_t i;
+
+ REG_GET(DENTIST_DISPCLK_CNTL,
+ DENTIST_DISPCLK_WDIVIDER, ¤t_dispclk_wdivider);
+
+ /* When changing divider to or from 127, some extra programming is required to prevent corruption */
+ if (current_dispclk_wdivider == 127 && dispclk_wdivider != 127) {
+ for (i = 0; i < clk_mgr->base.ctx->dc->res_pool->pipe_count; i++) {
+ struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+ uint32_t fifo_level;
+ struct dccg *dccg = clk_mgr->base.ctx->dc->res_pool->dccg;
+ struct stream_encoder *stream_enc = pipe_ctx->stream_res.stream_enc;
+ int32_t N;
+ int32_t j;
+
+ if (!pipe_ctx->stream)
+ continue;
+ /* Virtual encoders don't have this function */
+ if (!stream_enc->funcs->get_fifo_cal_average_level)
+ continue;
+ fifo_level = stream_enc->funcs->get_fifo_cal_average_level(
+ stream_enc);
+ N = fifo_level / 4;
+ dccg->funcs->set_fifo_errdet_ovr_en(
+ dccg,
+ true);
+ for (j = 0; j < N - 4; j++)
+ dccg->funcs->otg_drop_pixel(
+ dccg,
+ pipe_ctx->stream_res.tg->inst);
+ dccg->funcs->set_fifo_errdet_ovr_en(
+ dccg,
+ false);
+ }
+ } else if (dispclk_wdivider == 127 && current_dispclk_wdivider != 127) {
+ REG_UPDATE(DENTIST_DISPCLK_CNTL,
+ DENTIST_DISPCLK_WDIVIDER, 126);
+ REG_WAIT(DENTIST_DISPCLK_CNTL, DENTIST_DISPCLK_CHG_DONE, 1, 50, 100);
+ for (i = 0; i < clk_mgr->base.ctx->dc->res_pool->pipe_count; i++) {
+ struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+ struct dccg *dccg = clk_mgr->base.ctx->dc->res_pool->dccg;
+ struct stream_encoder *stream_enc = pipe_ctx->stream_res.stream_enc;
+ uint32_t fifo_level;
+ int32_t N;
+ int32_t j;
+
+ if (!pipe_ctx->stream)
+ continue;
+ /* Virtual encoders don't have this function */
+ if (!stream_enc->funcs->get_fifo_cal_average_level)
+ continue;
+ fifo_level = stream_enc->funcs->get_fifo_cal_average_level(
+ stream_enc);
+ N = fifo_level / 4;
+ dccg->funcs->set_fifo_errdet_ovr_en(dccg, true);
+ for (j = 0; j < 12 - N; j++)
+ dccg->funcs->otg_add_pixel(dccg,
+ pipe_ctx->stream_res.tg->inst);
+ dccg->funcs->set_fifo_errdet_ovr_en(dccg, false);
+ }
+ }
REG_UPDATE(DENTIST_DISPCLK_CNTL,
DENTIST_DISPCLK_WDIVIDER, dispclk_wdivider);
@@ -251,11 +313,11 @@ void dcn2_update_clocks(struct clk_mgr *clk_mgr_base,
if (dpp_clock_lowered) {
// if clock is being lowered, increase DTO before lowering refclk
dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
- dcn20_update_clocks_update_dentist(clk_mgr);
+ dcn20_update_clocks_update_dentist(clk_mgr, context);
} else {
// if clock is being raised, increase refclk before lowering DTO
if (update_dppclk || update_dispclk)
- dcn20_update_clocks_update_dentist(clk_mgr);
+ dcn20_update_clocks_update_dentist(clk_mgr, context);
// always update dtos unless clock is lowered and not safe to lower
dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
}
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h
index 0b9c045b0c8e..d254d0b6fba1 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h
@@ -50,7 +50,8 @@ void dcn2_get_clock(struct clk_mgr *clk_mgr,
enum dc_clock_type clock_type,
struct dc_clock_config *clock_cfg);
-void dcn20_update_clocks_update_dentist(struct clk_mgr_internal *clk_mgr);
+void dcn20_update_clocks_update_dentist(struct clk_mgr_internal *clk_mgr,
+ struct dc_state *context);
void dcn2_read_clocks_from_hw_dentist(struct clk_mgr *clk_mgr_base);
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
index 652fa89fae5f..513676a6f52b 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
@@ -334,11 +334,11 @@ static void dcn3_update_clocks(struct clk_mgr *clk_mgr_base,
if (dpp_clock_lowered) {
/* if clock is being lowered, increase DTO before lowering refclk */
dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
- dcn20_update_clocks_update_dentist(clk_mgr);
+ dcn20_update_clocks_update_dentist(clk_mgr, context);
} else {
/* if clock is being raised, increase refclk before lowering DTO */
if (update_dppclk || update_dispclk)
- dcn20_update_clocks_update_dentist(clk_mgr);
+ dcn20_update_clocks_update_dentist(clk_mgr, context);
/* There is a check inside dcn20_update_clocks_update_dpp_dto which ensures
* that we do not lower dto when it is not safe to lower. We do not need to
* compare the current and new dppclk before calling this function.*/
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 106/266] drm/amd/display: Cover edge-case when changing DISPCLK WDIVIDER
2021-07-15 18:37 ` [PATCH 5.13 106/266] drm/amd/display: Cover edge-case when changing DISPCLK WDIVIDER Greg Kroah-Hartman
@ 2021-07-15 21:12 ` Stefan Lippers-Hollmann
2021-07-16 18:01 ` Greg Kroah-Hartman
0 siblings, 1 reply; 277+ messages in thread
From: Stefan Lippers-Hollmann @ 2021-07-15 21:12 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Wesley Chalmers, Dmytro Laktyushkin,
Anson Jacob, Daniel Wheeler, Alex Deucher, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 4867 bytes --]
Hi
On 2021-07-15, Greg Kroah-Hartman wrote:
> From: Wesley Chalmers <Wesley.Chalmers@amd.com>
>
> [ Upstream commit 78ebca321999699f30ea19029726d1a3908b395f ]
>
> [WHY]
> When changing the DISPCLK_WDIVIDER value from 126 to 127, the change in
> clock rate is too great for the FIFOs to handle. This can cause visible
> corruption during clock change.
>
> HW has handed down this register sequence to fix the issue.
>
> [HOW]
> The sequence, from HW:
> a. 127 -> 126
> Read DIG_FIFO_CAL_AVERAGE_LEVEL
> FIFO level N = DIG_FIFO_CAL_AVERAGE_LEVEL / 4
> Set DCCG_FIFO_ERRDET_OVR_EN = 1
> Write 1 to OTGx_DROP_PIXEL for (N-4) times
> Set DCCG_FIFO_ERRDET_OVR_EN = 0
> Write DENTIST_DISPCLK_RDIVIDER = 126
>
> Because of frequency stepping, sequence a can be executed to change the
> divider from 127 to any other divider value.
>
> b. 126 -> 127
> Read DIG_FIFO_CAL_AVERAGE_LEVEL
> FIFO level N = DIG_FIFO_CAL_AVERAGE_LEVEL / 4
> Set DCCG_FIFO_ERRDET_OVR_EN = 1
> Write 1 to OTGx_ADD_PIXEL for (12-N) times
> Set DCCG_FIFO_ERRDET_OVR_EN = 0
> Write DENTIST_DISPCLK_RDIVIDER = 127
>
> Because of frequency stepping, divider must first be set from any other
> divider value to 126 before executing sequence b.
[...]
This patch seem to introduce a build regression for x86_64:
CC [M] drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.o
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c: In function 'dcn20_update_clocks_update_dentist':
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:154:26: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
154 | if (!stream_enc->funcs->get_fifo_cal_average_level)
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:156:34: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
156 | fifo_level = stream_enc->funcs->get_fifo_cal_average_level(
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:159:15: error: 'const struct dccg_funcs' has no member named 'set_fifo_errdet_ovr_en'
159 | dccg->funcs->set_fifo_errdet_ovr_en(
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:163:16: error: 'const struct dccg_funcs' has no member named 'otg_drop_pixel'
163 | dccg->funcs->otg_drop_pixel(
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:166:15: error: 'const struct dccg_funcs' has no member named 'set_fifo_errdet_ovr_en'
166 | dccg->funcs->set_fifo_errdet_ovr_en(
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:185:26: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
185 | if (!stream_enc->funcs->get_fifo_cal_average_level)
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:187:34: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
187 | fifo_level = stream_enc->funcs->get_fifo_cal_average_level(
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:190:15: error: 'const struct dccg_funcs' has no member named 'set_fifo_errdet_ovr_en'
190 | dccg->funcs->set_fifo_errdet_ovr_en(dccg, true);
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:192:16: error: 'const struct dccg_funcs' has no member named 'otg_add_pixel'
192 | dccg->funcs->otg_add_pixel(dccg,
| ^~
/build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:194:15: error: 'const struct dccg_funcs' has no member named 'set_fifo_errdet_ovr_en'
194 | dccg->funcs->set_fifo_errdet_ovr_en(dccg, false);
| ^~
make[5]: *** [/build/linux-aptosid-5.13/scripts/Makefile.build:273: drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.o] Error 1
make[4]: *** [/build/linux-aptosid-5.13/scripts/Makefile.build:516: drivers/gpu/drm/amd/amdgpu] Error 2
make[3]: *** [/build/linux-aptosid-5.13/scripts/Makefile.build:516: drivers/gpu/drm] Error 2
make[2]: *** [/build/linux-aptosid-5.13/scripts/Makefile.build:516: drivers/gpu] Error 2
make[1]: *** [/build/linux-aptosid-5.13/Makefile:1864: drivers] Error 2
make: *** [/build/linux-aptosid-5.13/Makefile:215: __sub-make] Error 2
Regards
Stefan Lippers-Hollmann
[-- Attachment #2: Digitale Signatur von OpenPGP --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 106/266] drm/amd/display: Cover edge-case when changing DISPCLK WDIVIDER
2021-07-15 21:12 ` Stefan Lippers-Hollmann
@ 2021-07-16 18:01 ` Greg Kroah-Hartman
0 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-16 18:01 UTC (permalink / raw)
To: Stefan Lippers-Hollmann
Cc: linux-kernel, stable, Wesley Chalmers, Dmytro Laktyushkin,
Anson Jacob, Daniel Wheeler, Alex Deucher, Sasha Levin
On Thu, Jul 15, 2021 at 11:12:55PM +0200, Stefan Lippers-Hollmann wrote:
> Hi
>
> On 2021-07-15, Greg Kroah-Hartman wrote:
> > From: Wesley Chalmers <Wesley.Chalmers@amd.com>
> >
> > [ Upstream commit 78ebca321999699f30ea19029726d1a3908b395f ]
> >
> > [WHY]
> > When changing the DISPCLK_WDIVIDER value from 126 to 127, the change in
> > clock rate is too great for the FIFOs to handle. This can cause visible
> > corruption during clock change.
> >
> > HW has handed down this register sequence to fix the issue.
> >
> > [HOW]
> > The sequence, from HW:
> > a. 127 -> 126
> > Read DIG_FIFO_CAL_AVERAGE_LEVEL
> > FIFO level N = DIG_FIFO_CAL_AVERAGE_LEVEL / 4
> > Set DCCG_FIFO_ERRDET_OVR_EN = 1
> > Write 1 to OTGx_DROP_PIXEL for (N-4) times
> > Set DCCG_FIFO_ERRDET_OVR_EN = 0
> > Write DENTIST_DISPCLK_RDIVIDER = 126
> >
> > Because of frequency stepping, sequence a can be executed to change the
> > divider from 127 to any other divider value.
> >
> > b. 126 -> 127
> > Read DIG_FIFO_CAL_AVERAGE_LEVEL
> > FIFO level N = DIG_FIFO_CAL_AVERAGE_LEVEL / 4
> > Set DCCG_FIFO_ERRDET_OVR_EN = 1
> > Write 1 to OTGx_ADD_PIXEL for (12-N) times
> > Set DCCG_FIFO_ERRDET_OVR_EN = 0
> > Write DENTIST_DISPCLK_RDIVIDER = 127
> >
> > Because of frequency stepping, divider must first be set from any other
> > divider value to 126 before executing sequence b.
> [...]
>
> This patch seem to introduce a build regression for x86_64:
>
> CC [M] drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.o
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c: In function 'dcn20_update_clocks_update_dentist':
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:154:26: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
> 154 | if (!stream_enc->funcs->get_fifo_cal_average_level)
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:156:34: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
> 156 | fifo_level = stream_enc->funcs->get_fifo_cal_average_level(
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:159:15: error: 'const struct dccg_funcs' has no member named 'set_fifo_errdet_ovr_en'
> 159 | dccg->funcs->set_fifo_errdet_ovr_en(
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:163:16: error: 'const struct dccg_funcs' has no member named 'otg_drop_pixel'
> 163 | dccg->funcs->otg_drop_pixel(
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:166:15: error: 'const struct dccg_funcs' has no member named 'set_fifo_errdet_ovr_en'
> 166 | dccg->funcs->set_fifo_errdet_ovr_en(
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:185:26: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
> 185 | if (!stream_enc->funcs->get_fifo_cal_average_level)
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:187:34: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
> 187 | fifo_level = stream_enc->funcs->get_fifo_cal_average_level(
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:190:15: error: 'const struct dccg_funcs' has no member named 'set_fifo_errdet_ovr_en'
> 190 | dccg->funcs->set_fifo_errdet_ovr_en(dccg, true);
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:192:16: error: 'const struct dccg_funcs' has no member named 'otg_add_pixel'
> 192 | dccg->funcs->otg_add_pixel(dccg,
> | ^~
> /build/linux-5.13/drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:194:15: error: 'const struct dccg_funcs' has no member named 'set_fifo_errdet_ovr_en'
> 194 | dccg->funcs->set_fifo_errdet_ovr_en(dccg, false);
> | ^~
> make[5]: *** [/build/linux-aptosid-5.13/scripts/Makefile.build:273: drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.o] Error 1
> make[4]: *** [/build/linux-aptosid-5.13/scripts/Makefile.build:516: drivers/gpu/drm/amd/amdgpu] Error 2
> make[3]: *** [/build/linux-aptosid-5.13/scripts/Makefile.build:516: drivers/gpu/drm] Error 2
> make[2]: *** [/build/linux-aptosid-5.13/scripts/Makefile.build:516: drivers/gpu] Error 2
> make[1]: *** [/build/linux-aptosid-5.13/Makefile:1864: drivers] Error 2
> make: *** [/build/linux-aptosid-5.13/Makefile:215: __sub-make] Error 2
>
> Regards
> Stefan Lippers-Hollmann
Now dropped, thanks!
greg k-h
^ permalink raw reply [flat|nested] 277+ messages in thread
* [PATCH 5.13 107/266] drm/amdkfd: Fix circular lock in nocpsch path
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 106/266] drm/amd/display: Cover edge-case when changing DISPCLK WDIVIDER Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 108/266] net: hsr: dont check sequence number if tag removal is offloaded Greg Kroah-Hartman
` (162 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Amber Lin, Felix Kuehling,
Alex Deucher, Sasha Levin
From: Amber Lin <Amber.Lin@amd.com>
[ Upstream commit a7b2451d31cfa2e8aeccf3b35612ce33f02371fc ]
Calling free_mqd inside of destroy_queue_nocpsch_locked can cause a
circular lock. destroy_queue_nocpsch_locked is called under a DQM lock,
which is taken in MMU notifiers, potentially in FS reclaim context.
Taking another lock, which is BO reservation lock from free_mqd, while
causing an FS reclaim inside the DQM lock creates a problematic circular
lock dependency. Therefore move free_mqd out of
destroy_queue_nocpsch_locked and call it after unlocking DQM.
Signed-off-by: Amber Lin <Amber.Lin@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/amdkfd/kfd_device_queue_manager.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index ccc9d108caff..e9b3e2e32bf8 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -486,9 +486,6 @@ static int destroy_queue_nocpsch_locked(struct device_queue_manager *dqm,
if (retval == -ETIME)
qpd->reset_wavefronts = true;
-
- mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj);
-
list_del(&q->list);
if (list_empty(&qpd->queues_list)) {
if (qpd->reset_wavefronts) {
@@ -523,6 +520,8 @@ static int destroy_queue_nocpsch(struct device_queue_manager *dqm,
int retval;
uint64_t sdma_val = 0;
struct kfd_process_device *pdd = qpd_to_pdd(qpd);
+ struct mqd_manager *mqd_mgr =
+ dqm->mqd_mgrs[get_mqd_type_from_queue_type(q->properties.type)];
/* Get the SDMA queue stats */
if ((q->properties.type == KFD_QUEUE_TYPE_SDMA) ||
@@ -540,6 +539,8 @@ static int destroy_queue_nocpsch(struct device_queue_manager *dqm,
pdd->sdma_past_activity_counter += sdma_val;
dqm_unlock(dqm);
+ mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj);
+
return retval;
}
@@ -1629,7 +1630,7 @@ out:
static int process_termination_nocpsch(struct device_queue_manager *dqm,
struct qcm_process_device *qpd)
{
- struct queue *q, *next;
+ struct queue *q;
struct device_process_node *cur, *next_dpn;
int retval = 0;
bool found = false;
@@ -1637,12 +1638,19 @@ static int process_termination_nocpsch(struct device_queue_manager *dqm,
dqm_lock(dqm);
/* Clear all user mode queues */
- list_for_each_entry_safe(q, next, &qpd->queues_list, list) {
+ while (!list_empty(&qpd->queues_list)) {
+ struct mqd_manager *mqd_mgr;
int ret;
+ q = list_first_entry(&qpd->queues_list, struct queue, list);
+ mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type(
+ q->properties.type)];
ret = destroy_queue_nocpsch_locked(dqm, qpd, q);
if (ret)
retval = ret;
+ dqm_unlock(dqm);
+ mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj);
+ dqm_lock(dqm);
}
/* Unregister process */
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 108/266] net: hsr: dont check sequence number if tag removal is offloaded
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 107/266] drm/amdkfd: Fix circular lock in nocpsch path Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 109/266] bpf: Fix up register-based shifts in interpreter to silence KUBSAN Greg Kroah-Hartman
` (161 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, George McCollister, David S. Miller,
Sasha Levin
From: George McCollister <george.mccollister@gmail.com>
[ Upstream commit c2ae34a7deaff463ecafb7db627b77faaca8e159 ]
Don't check the sequence number when deciding when to update time_in in
the node table if tag removal is offloaded since the sequence number is
part of the tag. This fixes a problem where the times in the node table
wouldn't update when 0 appeared to be before or equal to seq_out when
tag removal was offloaded.
Signed-off-by: George McCollister <george.mccollister@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/hsr/hsr_framereg.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index bb1351c38397..e31949479305 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -397,7 +397,8 @@ void hsr_register_frame_in(struct hsr_node *node, struct hsr_port *port,
* ensures entries of restarted nodes gets pruned so that they can
* re-register and resume communications.
*/
- if (seq_nr_before(sequence_nr, node->seq_out[port->type]))
+ if (!(port->dev->features & NETIF_F_HW_HSR_TAG_RM) &&
+ seq_nr_before(sequence_nr, node->seq_out[port->type]))
return;
node->time_in[port->type] = jiffies;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 109/266] bpf: Fix up register-based shifts in interpreter to silence KUBSAN
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 108/266] net: hsr: dont check sequence number if tag removal is offloaded Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 110/266] ext4: fix memory leak in ext4_fill_super Greg Kroah-Hartman
` (160 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+bed360704c521841c85d,
Kurt Manucredo, Eric Biggers, Daniel Borkmann,
Alexei Starovoitov, Andrii Nakryiko, Edward Cree, Sasha Levin
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 28131e9d933339a92f78e7ab6429f4aaaa07061c ]
syzbot reported a shift-out-of-bounds that KUBSAN observed in the
interpreter:
[...]
UBSAN: shift-out-of-bounds in kernel/bpf/core.c:1420:2
shift exponent 255 is too large for 64-bit type 'long long unsigned int'
CPU: 1 PID: 11097 Comm: syz-executor.4 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x141/0x1d7 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
___bpf_prog_run.cold+0x19/0x56c kernel/bpf/core.c:1420
__bpf_prog_run32+0x8f/0xd0 kernel/bpf/core.c:1735
bpf_dispatcher_nop_func include/linux/bpf.h:644 [inline]
bpf_prog_run_pin_on_cpu include/linux/filter.h:624 [inline]
bpf_prog_run_clear_cb include/linux/filter.h:755 [inline]
run_filter+0x1a1/0x470 net/packet/af_packet.c:2031
packet_rcv+0x313/0x13e0 net/packet/af_packet.c:2104
dev_queue_xmit_nit+0x7c2/0xa90 net/core/dev.c:2387
xmit_one net/core/dev.c:3588 [inline]
dev_hard_start_xmit+0xad/0x920 net/core/dev.c:3609
__dev_queue_xmit+0x2121/0x2e00 net/core/dev.c:4182
__bpf_tx_skb net/core/filter.c:2116 [inline]
__bpf_redirect_no_mac net/core/filter.c:2141 [inline]
__bpf_redirect+0x548/0xc80 net/core/filter.c:2164
____bpf_clone_redirect net/core/filter.c:2448 [inline]
bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2420
___bpf_prog_run+0x34e1/0x77d0 kernel/bpf/core.c:1523
__bpf_prog_run512+0x99/0xe0 kernel/bpf/core.c:1737
bpf_dispatcher_nop_func include/linux/bpf.h:644 [inline]
bpf_test_run+0x3ed/0xc50 net/bpf/test_run.c:50
bpf_prog_test_run_skb+0xabc/0x1c50 net/bpf/test_run.c:582
bpf_prog_test_run kernel/bpf/syscall.c:3127 [inline]
__do_sys_bpf+0x1ea9/0x4f00 kernel/bpf/syscall.c:4406
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xae
[...]
Generally speaking, KUBSAN reports from the kernel should be fixed.
However, in case of BPF, this particular report caused concerns since
the large shift is not wrong from BPF point of view, just undefined.
In the verifier, K-based shifts that are >= {64,32} (depending on the
bitwidth of the instruction) are already rejected. The register-based
cases were not given their content might not be known at verification
time. Ideas such as verifier instruction rewrite with an additional
AND instruction for the source register were brought up, but regularly
rejected due to the additional runtime overhead they incur.
As Edward Cree rightly put it:
Shifts by more than insn bitness are legal in the BPF ISA; they are
implementation-defined behaviour [of the underlying architecture],
rather than UB, and have been made legal for performance reasons.
Each of the JIT backends compiles the BPF shift operations to machine
instructions which produce implementation-defined results in such a
case; the resulting contents of the register may be arbitrary but
program behaviour as a whole remains defined.
Guard checks in the fast path (i.e. affecting JITted code) will thus
not be accepted.
The case of division by zero is not truly analogous here, as division
instructions on many of the JIT-targeted architectures will raise a
machine exception / fault on division by zero, whereas (to the best
of my knowledge) none will do so on an out-of-bounds shift.
Given the KUBSAN report only affects the BPF interpreter, but not JITs,
one solution is to add the ANDs with 63 or 31 into ___bpf_prog_run().
That would make the shifts defined, and thus shuts up KUBSAN, and the
compiler would optimize out the AND on any CPU that interprets the shift
amounts modulo the width anyway (e.g., confirmed from disassembly that
on x86-64 and arm64 the generated interpreter code is the same before
and after this fix).
The BPF interpreter is slow path, and most likely compiled out anyway
as distros select BPF_JIT_ALWAYS_ON to avoid speculative execution of
BPF instructions by the interpreter. Given the main argument was to
avoid sacrificing performance, the fact that the AND is optimized away
from compiler for mainstream archs helps as well as a solution moving
forward. Also add a comment on LSH/RSH/ARSH translation for JIT authors
to provide guidance when they see the ___bpf_prog_run() interpreter
code and use it as a model for a new JIT backend.
Reported-by: syzbot+bed360704c521841c85d@syzkaller.appspotmail.com
Reported-by: Kurt Manucredo <fuzzybritches0@gmail.com>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Co-developed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Tested-by: syzbot+bed360704c521841c85d@syzkaller.appspotmail.com
Cc: Edward Cree <ecree.xilinx@gmail.com>
Link: https://lore.kernel.org/bpf/0000000000008f912605bd30d5d7@google.com
Link: https://lore.kernel.org/bpf/bac16d8d-c174-bdc4-91bd-bfa62b410190@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/core.c | 61 +++++++++++++++++++++++++++++++++--------------
1 file changed, 43 insertions(+), 18 deletions(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 5e31ee9f7512..034ad93a1ad7 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1392,29 +1392,54 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)
select_insn:
goto *jumptable[insn->code];
- /* ALU */
-#define ALU(OPCODE, OP) \
- ALU64_##OPCODE##_X: \
- DST = DST OP SRC; \
- CONT; \
- ALU_##OPCODE##_X: \
- DST = (u32) DST OP (u32) SRC; \
- CONT; \
- ALU64_##OPCODE##_K: \
- DST = DST OP IMM; \
- CONT; \
- ALU_##OPCODE##_K: \
- DST = (u32) DST OP (u32) IMM; \
+ /* Explicitly mask the register-based shift amounts with 63 or 31
+ * to avoid undefined behavior. Normally this won't affect the
+ * generated code, for example, in case of native 64 bit archs such
+ * as x86-64 or arm64, the compiler is optimizing the AND away for
+ * the interpreter. In case of JITs, each of the JIT backends compiles
+ * the BPF shift operations to machine instructions which produce
+ * implementation-defined results in such a case; the resulting
+ * contents of the register may be arbitrary, but program behaviour
+ * as a whole remains defined. In other words, in case of JIT backends,
+ * the AND must /not/ be added to the emitted LSH/RSH/ARSH translation.
+ */
+ /* ALU (shifts) */
+#define SHT(OPCODE, OP) \
+ ALU64_##OPCODE##_X: \
+ DST = DST OP (SRC & 63); \
+ CONT; \
+ ALU_##OPCODE##_X: \
+ DST = (u32) DST OP ((u32) SRC & 31); \
+ CONT; \
+ ALU64_##OPCODE##_K: \
+ DST = DST OP IMM; \
+ CONT; \
+ ALU_##OPCODE##_K: \
+ DST = (u32) DST OP (u32) IMM; \
+ CONT;
+ /* ALU (rest) */
+#define ALU(OPCODE, OP) \
+ ALU64_##OPCODE##_X: \
+ DST = DST OP SRC; \
+ CONT; \
+ ALU_##OPCODE##_X: \
+ DST = (u32) DST OP (u32) SRC; \
+ CONT; \
+ ALU64_##OPCODE##_K: \
+ DST = DST OP IMM; \
+ CONT; \
+ ALU_##OPCODE##_K: \
+ DST = (u32) DST OP (u32) IMM; \
CONT;
-
ALU(ADD, +)
ALU(SUB, -)
ALU(AND, &)
ALU(OR, |)
- ALU(LSH, <<)
- ALU(RSH, >>)
ALU(XOR, ^)
ALU(MUL, *)
+ SHT(LSH, <<)
+ SHT(RSH, >>)
+#undef SHT
#undef ALU
ALU_NEG:
DST = (u32) -DST;
@@ -1439,13 +1464,13 @@ select_insn:
insn++;
CONT;
ALU_ARSH_X:
- DST = (u64) (u32) (((s32) DST) >> SRC);
+ DST = (u64) (u32) (((s32) DST) >> (SRC & 31));
CONT;
ALU_ARSH_K:
DST = (u64) (u32) (((s32) DST) >> IMM);
CONT;
ALU64_ARSH_X:
- (*(s64 *) &DST) >>= SRC;
+ (*(s64 *) &DST) >>= (SRC & 63);
CONT;
ALU64_ARSH_K:
(*(s64 *) &DST) >>= IMM;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 110/266] ext4: fix memory leak in ext4_fill_super
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 109/266] bpf: Fix up register-based shifts in interpreter to silence KUBSAN Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 111/266] ice: fix incorrect payload indicator on PTYPE Greg Kroah-Hartman
` (159 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+d9e482e303930fa4f6ff,
Pavel Skripkin, Theodore Tso, Sasha Levin
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 618f003199c6188e01472b03cdbba227f1dc5f24 ]
static int kthread(void *_create) will return -ENOMEM
or -EINTR in case of internal failure or
kthread_stop() call happens before threadfn call.
To prevent fancy error checking and make code
more straightforward we moved all cleanup code out
of kmmpd threadfn.
Also, dropped struct mmpd_data at all. Now struct super_block
is a threadfn data and struct buffer_head embedded into
struct ext4_sb_info.
Reported-by: syzbot+d9e482e303930fa4f6ff@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20210430185046.15742-1-paskripkin@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ext4.h | 4 ++++
fs/ext4/mmp.c | 28 +++++++++++++---------------
fs/ext4/super.c | 10 ++++------
3 files changed, 21 insertions(+), 21 deletions(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 37002663d521..a179c0bbc12e 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1488,6 +1488,7 @@ struct ext4_sb_info {
struct kobject s_kobj;
struct completion s_kobj_unregister;
struct super_block *s_sb;
+ struct buffer_head *s_mmp_bh;
/* Journaling */
struct journal_s *s_journal;
@@ -3720,6 +3721,9 @@ extern struct ext4_io_end_vec *ext4_last_io_end_vec(ext4_io_end_t *io_end);
/* mmp.c */
extern int ext4_multi_mount_protect(struct super_block *, ext4_fsblk_t);
+/* mmp.c */
+extern void ext4_stop_mmpd(struct ext4_sb_info *sbi);
+
/* verity.c */
extern const struct fsverity_operations ext4_verityops;
diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
index 68fbeedd627b..6cb598b549ca 100644
--- a/fs/ext4/mmp.c
+++ b/fs/ext4/mmp.c
@@ -127,9 +127,9 @@ void __dump_mmp_msg(struct super_block *sb, struct mmp_struct *mmp,
*/
static int kmmpd(void *data)
{
- struct super_block *sb = ((struct mmpd_data *) data)->sb;
- struct buffer_head *bh = ((struct mmpd_data *) data)->bh;
+ struct super_block *sb = (struct super_block *) data;
struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+ struct buffer_head *bh = EXT4_SB(sb)->s_mmp_bh;
struct mmp_struct *mmp;
ext4_fsblk_t mmp_block;
u32 seq = 0;
@@ -245,12 +245,18 @@ static int kmmpd(void *data)
retval = write_mmp_block(sb, bh);
exit_thread:
- EXT4_SB(sb)->s_mmp_tsk = NULL;
- kfree(data);
- brelse(bh);
return retval;
}
+void ext4_stop_mmpd(struct ext4_sb_info *sbi)
+{
+ if (sbi->s_mmp_tsk) {
+ kthread_stop(sbi->s_mmp_tsk);
+ brelse(sbi->s_mmp_bh);
+ sbi->s_mmp_tsk = NULL;
+ }
+}
+
/*
* Get a random new sequence number but make sure it is not greater than
* EXT4_MMP_SEQ_MAX.
@@ -275,7 +281,6 @@ int ext4_multi_mount_protect(struct super_block *sb,
struct ext4_super_block *es = EXT4_SB(sb)->s_es;
struct buffer_head *bh = NULL;
struct mmp_struct *mmp = NULL;
- struct mmpd_data *mmpd_data;
u32 seq;
unsigned int mmp_check_interval = le16_to_cpu(es->s_mmp_update_interval);
unsigned int wait_time = 0;
@@ -364,24 +369,17 @@ skip:
goto failed;
}
- mmpd_data = kmalloc(sizeof(*mmpd_data), GFP_KERNEL);
- if (!mmpd_data) {
- ext4_warning(sb, "not enough memory for mmpd_data");
- goto failed;
- }
- mmpd_data->sb = sb;
- mmpd_data->bh = bh;
+ EXT4_SB(sb)->s_mmp_bh = bh;
/*
* Start a kernel thread to update the MMP block periodically.
*/
- EXT4_SB(sb)->s_mmp_tsk = kthread_run(kmmpd, mmpd_data, "kmmpd-%.*s",
+ EXT4_SB(sb)->s_mmp_tsk = kthread_run(kmmpd, sb, "kmmpd-%.*s",
(int)sizeof(mmp->mmp_bdevname),
bdevname(bh->b_bdev,
mmp->mmp_bdevname));
if (IS_ERR(EXT4_SB(sb)->s_mmp_tsk)) {
EXT4_SB(sb)->s_mmp_tsk = NULL;
- kfree(mmpd_data);
ext4_warning(sb, "Unable to create kmmpd thread for %s.",
sb->s_id);
goto failed;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 736724ce86d7..3b6203543607 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1245,8 +1245,8 @@ static void ext4_put_super(struct super_block *sb)
ext4_xattr_destroy_cache(sbi->s_ea_block_cache);
sbi->s_ea_block_cache = NULL;
- if (sbi->s_mmp_tsk)
- kthread_stop(sbi->s_mmp_tsk);
+ ext4_stop_mmpd(sbi);
+
brelse(sbi->s_sbh);
sb->s_fs_info = NULL;
/*
@@ -5194,8 +5194,7 @@ failed_mount3a:
failed_mount3:
flush_work(&sbi->s_error_work);
del_timer_sync(&sbi->s_err_report);
- if (sbi->s_mmp_tsk)
- kthread_stop(sbi->s_mmp_tsk);
+ ext4_stop_mmpd(sbi);
failed_mount2:
rcu_read_lock();
group_desc = rcu_dereference(sbi->s_group_desc);
@@ -5997,8 +5996,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
*/
ext4_mark_recovery_complete(sb, es);
}
- if (sbi->s_mmp_tsk)
- kthread_stop(sbi->s_mmp_tsk);
+ ext4_stop_mmpd(sbi);
} else {
/* Make sure we can mount this feature set readwrite */
if (ext4_has_feature_readonly(sb) ||
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 111/266] ice: fix incorrect payload indicator on PTYPE
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 110/266] ext4: fix memory leak in ext4_fill_super Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 112/266] ice: mark PTYPE 2 as reserved Greg Kroah-Hartman
` (158 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jacob Keller, Tony Brelinski,
Tony Nguyen, Sasha Levin
From: Jacob Keller <jacob.e.keller@intel.com>
[ Upstream commit 638a0c8c8861cb8a3b54203e632ea5dcc23d8ca5 ]
The entry for PTYPE 90 indicates that the payload is layer 3. This does
not match the specification in the datasheet which indicates the packet
is a MAC, IPv6, UDP packet, with a payload in layer 4.
Fix the lookup table to match the data sheet.
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
index 21329ed3087e..fc3b56c13786 100644
--- a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
+++ b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
@@ -744,7 +744,7 @@ static const struct ice_rx_ptype_decoded ice_ptype_lkup[] = {
/* Non Tunneled IPv6 */
ICE_PTT(88, IP, IPV6, FRG, NONE, NONE, NOF, NONE, PAY3),
ICE_PTT(89, IP, IPV6, NOF, NONE, NONE, NOF, NONE, PAY3),
- ICE_PTT(90, IP, IPV6, NOF, NONE, NONE, NOF, UDP, PAY3),
+ ICE_PTT(90, IP, IPV6, NOF, NONE, NONE, NOF, UDP, PAY4),
ICE_PTT_UNUSED_ENTRY(91),
ICE_PTT(92, IP, IPV6, NOF, NONE, NONE, NOF, TCP, PAY4),
ICE_PTT(93, IP, IPV6, NOF, NONE, NONE, NOF, SCTP, PAY4),
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 112/266] ice: mark PTYPE 2 as reserved
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 111/266] ice: fix incorrect payload indicator on PTYPE Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 113/266] mt76: mt7615: fix fixed-rate tx status reporting Greg Kroah-Hartman
` (157 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jacob Keller, Tony Brelinski,
Tony Nguyen, Sasha Levin
From: Jacob Keller <jacob.e.keller@intel.com>
[ Upstream commit 0c526d440f76676733cb470b454db9d5507a3a50 ]
The entry for PTYPE 2 in the ice_ptype_lkup table incorrectly states
that this is an L2 packet with no payload. According to the datasheet,
this PTYPE is actually unused and reserved.
Fix the lookup entry to indicate this is an unused entry that is
reserved.
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
index fc3b56c13786..4238ab0433ee 100644
--- a/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
+++ b/drivers/net/ethernet/intel/ice/ice_lan_tx_rx.h
@@ -630,7 +630,7 @@ static const struct ice_rx_ptype_decoded ice_ptype_lkup[] = {
/* L2 Packet types */
ICE_PTT_UNUSED_ENTRY(0),
ICE_PTT(1, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
- ICE_PTT(2, L2, NONE, NOF, NONE, NONE, NOF, NONE, NONE),
+ ICE_PTT_UNUSED_ENTRY(2),
ICE_PTT_UNUSED_ENTRY(3),
ICE_PTT_UNUSED_ENTRY(4),
ICE_PTT_UNUSED_ENTRY(5),
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 113/266] mt76: mt7615: fix fixed-rate tx status reporting
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 112/266] ice: mark PTYPE 2 as reserved Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 114/266] mt76: dma: use ieee80211_tx_status_ext to free packets when tx fails Greg Kroah-Hartman
` (156 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Sasha Levin
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit ec8f1a90d006f7cedcf86ef19fd034a406a213d6 ]
Rely on the txs fixed-rate bit instead of info->control.rates
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
index e2dcfee6be81..7bdf3378a4d1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -1235,22 +1235,20 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta,
int first_idx = 0, last_idx;
int i, idx, count;
bool fixed_rate, ack_timeout;
- bool probe, ampdu, cck = false;
+ bool ampdu, cck = false;
bool rs_idx;
u32 rate_set_tsf;
u32 final_rate, final_rate_flags, final_nss, txs;
- fixed_rate = info->status.rates[0].count;
- probe = !!(info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE);
-
txs = le32_to_cpu(txs_data[1]);
- ampdu = !fixed_rate && (txs & MT_TXS1_AMPDU);
+ ampdu = txs & MT_TXS1_AMPDU;
txs = le32_to_cpu(txs_data[3]);
count = FIELD_GET(MT_TXS3_TX_COUNT, txs);
last_idx = FIELD_GET(MT_TXS3_LAST_TX_RATE, txs);
txs = le32_to_cpu(txs_data[0]);
+ fixed_rate = txs & MT_TXS0_FIXED_RATE;
final_rate = FIELD_GET(MT_TXS0_TX_RATE, txs);
ack_timeout = txs & MT_TXS0_ACK_TIMEOUT;
@@ -1272,7 +1270,7 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta,
first_idx = max_t(int, 0, last_idx - (count - 1) / MT7615_RATE_RETRY);
- if (fixed_rate && !probe) {
+ if (fixed_rate) {
info->status.rates[0].count = count;
i = 0;
goto out;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 114/266] mt76: dma: use ieee80211_tx_status_ext to free packets when tx fails
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 113/266] mt76: mt7615: fix fixed-rate tx status reporting Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 115/266] net: fix mistake path for netdev_features_strings Greg Kroah-Hartman
` (155 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Sasha Levin
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 94e4f5794627a80ce036c35b32a9900daeb31be3 ]
Fixes AQL issues on full queues, especially with 802.3 encap offload
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/dma.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 72b1cc0ecfda..e5c324dd24f9 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -349,6 +349,9 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
struct sk_buff *skb, struct mt76_wcid *wcid,
struct ieee80211_sta *sta)
{
+ struct ieee80211_tx_status status = {
+ .sta = sta,
+ };
struct mt76_tx_info tx_info = {
.skb = skb,
};
@@ -360,11 +363,9 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
u8 *txwi;
t = mt76_get_txwi(dev);
- if (!t) {
- hw = mt76_tx_status_get_hw(dev, skb);
- ieee80211_free_txskb(hw, skb);
- return -ENOMEM;
- }
+ if (!t)
+ goto free_skb;
+
txwi = mt76_get_txwi_ptr(dev, t);
skb->prev = skb->next = NULL;
@@ -427,8 +428,13 @@ free:
}
#endif
- dev_kfree_skb(tx_info.skb);
mt76_put_txwi(dev, t);
+
+free_skb:
+ status.skb = tx_info.skb;
+ hw = mt76_tx_status_get_hw(dev, tx_info.skb);
+ ieee80211_tx_status_ext(hw, &status);
+
return ret;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 115/266] net: fix mistake path for netdev_features_strings
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 114/266] mt76: dma: use ieee80211_tx_status_ext to free packets when tx fails Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 116/266] net: ipa: Add missing of_node_put() in ipa_firmware_load() Greg Kroah-Hartman
` (154 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jian Shen, David S. Miller, Sasha Levin
From: Jian Shen <shenjian15@huawei.com>
[ Upstream commit 2d8ea148e553e1dd4e80a87741abdfb229e2b323 ]
Th_strings arrays netdev_features_strings, tunable_strings, and
phy_tunable_strings has been moved to file net/ethtool/common.c.
So fixes the comment.
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/netdev_features.h | 2 +-
include/uapi/linux/ethtool.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 3de38d6a0aea..2c6b9e416225 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -93,7 +93,7 @@ enum {
/*
* Add your fresh new feature above and remember to update
- * netdev_features_strings[] in net/core/ethtool.c and maybe
+ * netdev_features_strings[] in net/ethtool/common.c and maybe
* some feature mask #defines below. Please also describe it
* in Documentation/networking/netdev-features.rst.
*/
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index cfef6b08169a..67aa7134b301 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -233,7 +233,7 @@ enum tunable_id {
ETHTOOL_PFC_PREVENTION_TOUT, /* timeout in msecs */
/*
* Add your fresh new tunable attribute above and remember to update
- * tunable_strings[] in net/core/ethtool.c
+ * tunable_strings[] in net/ethtool/common.c
*/
__ETHTOOL_TUNABLE_COUNT,
};
@@ -297,7 +297,7 @@ enum phy_tunable_id {
ETHTOOL_PHY_EDPD,
/*
* Add your fresh new phy tunable attribute above and remember to update
- * phy_tunable_strings[] in net/core/ethtool.c
+ * phy_tunable_strings[] in net/ethtool/common.c
*/
__ETHTOOL_PHY_TUNABLE_COUNT,
};
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 116/266] net: ipa: Add missing of_node_put() in ipa_firmware_load()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 115/266] net: fix mistake path for netdev_features_strings Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 117/266] net: sched: fix error return code in tcf_del_walker() Greg Kroah-Hartman
` (153 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
Alex Elder, David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit b244163f2c45c12053cb0291c955f892e79ed8a9 ]
This node pointer is returned by of_parse_phandle() with refcount
incremented in this function. of_node_put() on it before exiting
this function.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: Alex Elder <elder@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ipa/ipa_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
index 9915603ed10b..c4ad5f20496e 100644
--- a/drivers/net/ipa/ipa_main.c
+++ b/drivers/net/ipa/ipa_main.c
@@ -529,6 +529,7 @@ static int ipa_firmware_load(struct device *dev)
}
ret = of_address_to_resource(node, 0, &res);
+ of_node_put(node);
if (ret) {
dev_err(dev, "error %d getting \"memory-region\" resource\n",
ret);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 117/266] net: sched: fix error return code in tcf_del_walker()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 116/266] net: ipa: Add missing of_node_put() in ipa_firmware_load() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 118/266] io_uring: fix false WARN_ONCE Greg Kroah-Hartman
` (152 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
David S. Miller, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 55d96f72e8ddc0a294e0b9c94016edbb699537e1 ]
When nla_put_u32() fails, 'ret' could be 0, it should
return error code in tcf_del_walker().
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_api.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index f6d5755d669e..d17a66aab8ee 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -381,7 +381,8 @@ static int tcf_del_walker(struct tcf_idrinfo *idrinfo, struct sk_buff *skb,
}
mutex_unlock(&idrinfo->lock);
- if (nla_put_u32(skb, TCA_FCNT, n_i))
+ ret = nla_put_u32(skb, TCA_FCNT, n_i);
+ if (ret)
goto nla_put_failure;
nla_nest_end(skb, nest);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 118/266] io_uring: fix false WARN_ONCE
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 117/266] net: sched: fix error return code in tcf_del_walker() Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 119/266] drm/amdgpu: fix bad address translation for sienna_cichlid Greg Kroah-Hartman
` (151 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+ea2f1484cffe5109dc10,
Pavel Begunkov, Jens Axboe, Sasha Levin
From: Pavel Begunkov <asml.silence@gmail.com>
[ Upstream commit e6ab8991c5d0b0deae0961dc22c0edd1dee328f5 ]
WARNING: CPU: 1 PID: 11749 at fs/io-wq.c:244 io_wqe_wake_worker fs/io-wq.c:244 [inline]
WARNING: CPU: 1 PID: 11749 at fs/io-wq.c:244 io_wqe_enqueue+0x7f6/0x910 fs/io-wq.c:751
A WARN_ON_ONCE() in io_wqe_wake_worker() can be triggered by a valid
userspace setup. Replace it with pr_warn.
Reported-by: syzbot+ea2f1484cffe5109dc10@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/f7ede342c3342c4c26668f5168e2993e38bbd99c.1623949695.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/io-wq.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/io-wq.c b/fs/io-wq.c
index b3e8624a37d0..60f58efdb5f4 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -241,7 +241,8 @@ static void io_wqe_wake_worker(struct io_wqe *wqe, struct io_wqe_acct *acct)
* Most likely an attempt to queue unbounded work on an io_wq that
* wasn't setup with any unbounded workers.
*/
- WARN_ON_ONCE(!acct->max_workers);
+ if (unlikely(!acct->max_workers))
+ pr_warn_once("io-wq is not configured for unbound workers");
rcu_read_lock();
ret = io_wqe_activate_free_worker(wqe);
@@ -906,6 +907,8 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data)
if (WARN_ON_ONCE(!data->free_work || !data->do_work))
return ERR_PTR(-EINVAL);
+ if (WARN_ON_ONCE(!bounded))
+ return ERR_PTR(-EINVAL);
wq = kzalloc(sizeof(*wq), GFP_KERNEL);
if (!wq)
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 119/266] drm/amdgpu: fix bad address translation for sienna_cichlid
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 118/266] io_uring: fix false WARN_ONCE Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 120/266] drm/amdkfd: Walk through list with dqm lock hold Greg Kroah-Hartman
` (150 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stanley.Yang, Hawking Zhang,
Alex Deucher, Sasha Levin
From: Stanley.Yang <Stanley.Yang@amd.com>
[ Upstream commit 6ec598cc9dfbf40433e94a2ed1a622e3ef80268b ]
Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_umc.h | 5 +++++
drivers/gpu/drm/amd/amdgpu/umc_v8_7.c | 2 +-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.h
index bbcccf53080d..e5a75fb788dd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.h
@@ -21,6 +21,11 @@
#ifndef __AMDGPU_UMC_H__
#define __AMDGPU_UMC_H__
+/*
+ * (addr / 256) * 4096, the higher 26 bits in ErrorAddr
+ * is the index of 4KB block
+ */
+#define ADDR_OF_4KB_BLOCK(addr) (((addr) & ~0xffULL) << 4)
/*
* (addr / 256) * 8192, the higher 26 bits in ErrorAddr
* is the index of 8KB block
diff --git a/drivers/gpu/drm/amd/amdgpu/umc_v8_7.c b/drivers/gpu/drm/amd/amdgpu/umc_v8_7.c
index 89d20adfa001..af59a35788e3 100644
--- a/drivers/gpu/drm/amd/amdgpu/umc_v8_7.c
+++ b/drivers/gpu/drm/amd/amdgpu/umc_v8_7.c
@@ -234,7 +234,7 @@ static void umc_v8_7_query_error_address(struct amdgpu_device *adev,
err_addr &= ~((0x1ULL << lsb) - 1);
/* translate umc channel address to soc pa, 3 parts are included */
- retired_page = ADDR_OF_8KB_BLOCK(err_addr) |
+ retired_page = ADDR_OF_4KB_BLOCK(err_addr) |
ADDR_OF_256B_BLOCK(channel_index) |
OFFSET_IN_256B_BLOCK(err_addr);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 120/266] drm/amdkfd: Walk through list with dqm lock hold
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 119/266] drm/amdgpu: fix bad address translation for sienna_cichlid Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 121/266] mt76: mt7915: fix tssi indication field of DBDC NICs Greg Kroah-Hartman
` (149 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, xinhui pan, Felix Kuehling,
Alex Deucher, Sasha Levin
From: xinhui pan <xinhui.pan@amd.com>
[ Upstream commit 56f221b6389e7ab99c30bbf01c71998ae92fc584 ]
To avoid any list corruption.
Signed-off-by: xinhui pan <xinhui.pan@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/amdkfd/kfd_device_queue_manager.c | 22 ++++++++++---------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index e9b3e2e32bf8..f0bad74af230 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -1709,7 +1709,7 @@ static int process_termination_cpsch(struct device_queue_manager *dqm,
struct qcm_process_device *qpd)
{
int retval;
- struct queue *q, *next;
+ struct queue *q;
struct kernel_queue *kq, *kq_next;
struct mqd_manager *mqd_mgr;
struct device_process_node *cur, *next_dpn;
@@ -1766,24 +1766,26 @@ static int process_termination_cpsch(struct device_queue_manager *dqm,
qpd->reset_wavefronts = false;
}
- dqm_unlock(dqm);
-
- /* Outside the DQM lock because under the DQM lock we can't do
- * reclaim or take other locks that others hold while reclaiming.
- */
- if (found)
- kfd_dec_compute_active(dqm->dev);
-
/* Lastly, free mqd resources.
* Do free_mqd() after dqm_unlock to avoid circular locking.
*/
- list_for_each_entry_safe(q, next, &qpd->queues_list, list) {
+ while (!list_empty(&qpd->queues_list)) {
+ q = list_first_entry(&qpd->queues_list, struct queue, list);
mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type(
q->properties.type)];
list_del(&q->list);
qpd->queue_count--;
+ dqm_unlock(dqm);
mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj);
+ dqm_lock(dqm);
}
+ dqm_unlock(dqm);
+
+ /* Outside the DQM lock because under the DQM lock we can't do
+ * reclaim or take other locks that others hold while reclaiming.
+ */
+ if (found)
+ kfd_dec_compute_active(dqm->dev);
return retval;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 121/266] mt76: mt7915: fix tssi indication field of DBDC NICs
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 120/266] drm/amdkfd: Walk through list with dqm lock hold Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 122/266] mt76: mt7921: fix reset under the deep sleep is enabled Greg Kroah-Hartman
` (148 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Evelyn Tsai, Shayne Chen,
Felix Fietkau, Sasha Levin
From: Evelyn Tsai <evelyn.tsai@mediatek.com>
[ Upstream commit 64cf5ad3c2fa841e4b416343a7ea69c63d60fa4e ]
Correct the bitfield which indicates TSSI on/off for MT7915D NIC.
Signed-off-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
index 30bf41b8ed15..a43389a41800 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
@@ -99,12 +99,15 @@ static inline bool
mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
{
u8 *eep = dev->mt76.eeprom.data;
+ u8 val = eep[MT_EE_WIFI_CONF + 7];
- /* TODO: DBDC */
- if (band == NL80211_BAND_5GHZ)
- return eep[MT_EE_WIFI_CONF + 7] & MT_EE_WIFI_CONF7_TSSI0_5G;
+ if (band == NL80211_BAND_2GHZ)
+ return val & MT_EE_WIFI_CONF7_TSSI0_2G;
+
+ if (dev->dbdc_support)
+ return val & MT_EE_WIFI_CONF7_TSSI1_5G;
else
- return eep[MT_EE_WIFI_CONF + 7] & MT_EE_WIFI_CONF7_TSSI0_2G;
+ return val & MT_EE_WIFI_CONF7_TSSI0_5G;
}
extern const u8 mt7915_sku_group_len[MAX_SKU_RATE_GROUP_NUM];
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 122/266] mt76: mt7921: fix reset under the deep sleep is enabled
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 121/266] mt76: mt7915: fix tssi indication field of DBDC NICs Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 123/266] mt76: mt7921: reset wfsys during hw probe Greg Kroah-Hartman
` (147 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Sean Wang,
Felix Fietkau, Sasha Levin
From: Sean Wang <sean.wang@mediatek.com>
[ Upstream commit 7bf0a71e839822bb6ba04a6e163ad334314e2659 ]
To fix possibly the race to access register between the WiFi reset
and the other context that is caused by explicitly cancelling ps_work
and wake_work to break PM_STATE consistency.
Deep sleep would cause the hardware into the inactive state,
so we forcely put device drv_own state before we start to reset.
The patch also ignore the reset request when the procedure is in
progress to avoid the consecutive WiFi resets.
localhost ~ # [ 2932.073966] SError Interrupt on CPU7, code 0xbe000011
[ 2932.073967] CPU: 7 PID: 8761 Comm: kworker/u16:2 Not tainted 5.4.112 #30
[ 2932.073968] Hardware name: MediaTek Asurada rev1 board (DT)
[ 2932.073968] Workqueue: phy0 ieee80211_reconfig_filter [mac80211]
[ 2932.073969] pstate: 80400089 (Nzcv daIf +PAN -UAO)
[ 2932.073969] pc : el1_irq+0x78/0x180
[ 2932.073970] lr : mt76_mmio_rmw+0x30/0x5c [mt76]
[ 2932.073970] sp : ffffffc01142bad0
[ 2932.073970] x29: ffffffc01142bc00 x28: ffffff8f96fb1e00
[ 2932.073971] x27: ffffffd2cdc12138 x26: ffffffd2cdaeb018
[ 2932.073972] x25: 0000000000000000 x24: ffffff8fa8e14c08
[ 2932.073973] x23: 0000000080c00009 x22: ffffffd2a5603918
[ 2932.073974] x21: ffffffc01142bc10 x20: 0000007fffffffff
[ 2932.073975] x19: 0000000000000000 x18: 0000000000000400
[ 2932.073975] x17: 0000000000000400 x16: ffffffd2cd2b87dc
[ 2932.073976] x15: 0000000000000000 x14: 0000000000000000
[ 2932.073977] x13: 0000000000000001 x12: 0000000000000001
[ 2932.073978] x11: 0000000000000001 x10: 000000000010e000
[ 2932.073978] x9 : 0000000000000000 x8 : ffffffc013921404
[ 2932.073979] x7 : 000000b2b5593519 x6 : 0000000000300000
[ 2932.073980] x5 : 0000000000000000 x4 : ffffffc01142bbc8
[ 2932.073980] x3 : 00000000000001f0 x2 : 0000000000000000
[ 2932.073981] x1 : 0000000000021404 x0 : ffffff8fa8e12300
[ 2932.073982] Kernel panic - not syncing: Asynchronous SError Interrupt
[ 2932.073983] CPU: 7 PID: 8761 Comm: kworker/u16:2 Not tainted 5.4.112 #30
[ 2932.073983] Hardware name: MediaTek Asurada rev1 board (DT)
[ 2932.073984] Workqueue: phy0 ieee80211_reconfig_filter [mac80211]
[ 2932.073984] Call trace:
[ 2932.073985] dump_backtrace+0x0/0x14c
[ 2932.073985] show_stack+0x20/0x2c
[ 2932.073985] dump_stack+0xa0/0xf8
[ 2932.073986] panic+0x154/0x360
[ 2932.073986] test_taint+0x0/0x44
[ 2932.073986] arm64_serror_panic+0x78/0x84
[ 2932.073987] do_serror+0x0/0x118
[ 2932.073987] do_serror+0xa4/0x118
[ 2932.073987] el1_error+0x84/0xf8
[ 2932.073988] el1_irq+0x78/0x180
[ 2932.073988] mt76_mmio_rr+0x30/0xf0 [mt76]
[ 2932.073988] mt76_mmio_rmw+0x30/0x5c [mt76]
[ 2932.073989] mt7921_rmw+0x4c/0x5c [mt7921e]
[ 2932.073989] mt7921_configure_filter+0x138/0x160 [mt7921e]
[ 2932.073990] ieee80211_configure_filter+0x2f0/0x3e0 [mac80211]
[ 2932.073990] ieee80211_reconfig_filter+0x1c/0x28 [mac80211]
[ 2932.073990] process_one_work+0x208/0x3c8
[ 2932.073991] worker_thread+0x23c/0x3e8
[ 2932.073991] kthread+0x140/0x17c
[ 2932.073992] ret_from_fork+0x10/0x18
[ 2932.074071] SMP: stopping secondary CPUs
[ 2932.074071] Kernel Offset: 0x12bc800000 from 0xffffffc010000000
[ 2932.074072] PHYS_OFFSET: 0xfffffff180000000
[ 2932.074072] CPU features: 0x080026,2a80aa18
[ 2932.074072] Memory Limit: none
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7921/mac.c | 21 +++++++++--------
.../net/wireless/mediatek/mt76/mt7921/mcu.c | 23 ++++++++++++++-----
.../wireless/mediatek/mt76/mt7921/mt7921.h | 1 +
3 files changed, 30 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
index 493c2aba2f79..751d97bef534 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
@@ -1245,9 +1245,10 @@ mt7921_mac_reset(struct mt7921_dev *dev)
mt76_worker_enable(&dev->mt76.tx_worker);
clear_bit(MT76_MCU_RESET, &dev->mphy.state);
- clear_bit(MT76_STATE_PM, &dev->mphy.state);
- mt76_wr(dev, MT_WFDMA0_HOST_INT_ENA, 0);
+ mt76_wr(dev, MT_WFDMA0_HOST_INT_ENA,
+ MT_INT_RX_DONE_ALL | MT_INT_TX_DONE_ALL |
+ MT_INT_MCU_CMD);
mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0xff);
err = mt7921_run_firmware(dev);
@@ -1265,23 +1266,24 @@ mt7921_mac_reset(struct mt7921_dev *dev)
/* system error recovery */
void mt7921_mac_reset_work(struct work_struct *work)
{
- struct ieee80211_hw *hw;
- struct mt7921_dev *dev;
+ struct mt7921_dev *dev = container_of(work, struct mt7921_dev,
+ reset_work);
+ struct ieee80211_hw *hw = mt76_hw(dev);
+ struct mt76_connac_pm *pm = &dev->pm;
int i;
- dev = container_of(work, struct mt7921_dev, reset_work);
- hw = mt76_hw(dev);
-
dev_err(dev->mt76.dev, "chip reset\n");
dev->hw_full_reset = true;
ieee80211_stop_queues(hw);
cancel_delayed_work_sync(&dev->mphy.mac_work);
- cancel_delayed_work_sync(&dev->pm.ps_work);
- cancel_work_sync(&dev->pm.wake_work);
+ cancel_delayed_work_sync(&pm->ps_work);
+ cancel_work_sync(&pm->wake_work);
mutex_lock(&dev->mt76.mutex);
for (i = 0; i < 10; i++) {
+ __mt7921_mcu_drv_pmctrl(dev);
+
if (!mt7921_mac_reset(dev))
break;
}
@@ -1303,6 +1305,7 @@ void mt7921_mac_reset_work(struct work_struct *work)
ieee80211_iterate_active_interfaces(hw,
IEEE80211_IFACE_ITER_RESUME_ALL,
mt7921_vif_connect_iter, NULL);
+ mt76_connac_power_save_sched(&dev->mt76.phy, pm);
}
void mt7921_reset(struct mt76_dev *mdev)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 7c68182cad55..06209d58ce27 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -1299,17 +1299,12 @@ int mt7921_mcu_sta_add(struct mt7921_dev *dev, struct ieee80211_sta *sta,
return mt76_connac_mcu_add_sta_cmd(&dev->mphy, &info);
}
-int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
+int __mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
{
struct mt76_phy *mphy = &dev->mt76.phy;
struct mt76_connac_pm *pm = &dev->pm;
int i, err = 0;
- mutex_lock(&pm->mutex);
-
- if (!test_bit(MT76_STATE_PM, &mphy->state))
- goto out;
-
for (i = 0; i < MT7921_DRV_OWN_RETRY_COUNT; i++) {
mt76_wr(dev, MT_CONN_ON_LPCTL, PCIE_LPCR_HOST_CLR_OWN);
if (mt76_poll_msec(dev, MT_CONN_ON_LPCTL,
@@ -1329,6 +1324,22 @@ int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
pm->stats.last_wake_event = jiffies;
pm->stats.doze_time += pm->stats.last_wake_event -
pm->stats.last_doze_event;
+out:
+ return err;
+}
+
+int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev)
+{
+ struct mt76_phy *mphy = &dev->mt76.phy;
+ struct mt76_connac_pm *pm = &dev->pm;
+ int err = 0;
+
+ mutex_lock(&pm->mutex);
+
+ if (!test_bit(MT76_STATE_PM, &mphy->state))
+ goto out;
+
+ err = __mt7921_mcu_drv_pmctrl(dev);
out:
mutex_unlock(&pm->mutex);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
index 4cc8a372b277..710ad242fd53 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
@@ -369,6 +369,7 @@ int mt7921_mcu_uni_bss_bcnft(struct mt7921_dev *dev, struct ieee80211_vif *vif,
bool enable);
int mt7921_mcu_set_bss_pm(struct mt7921_dev *dev, struct ieee80211_vif *vif,
bool enable);
+int __mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev);
int mt7921_mcu_drv_pmctrl(struct mt7921_dev *dev);
int mt7921_mcu_fw_pmctrl(struct mt7921_dev *dev);
void mt7921_pm_wake_work(struct work_struct *work);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 123/266] mt76: mt7921: reset wfsys during hw probe
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 122/266] mt76: mt7921: fix reset under the deep sleep is enabled Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:37 ` [PATCH 5.13 124/266] mt76: mt7921: enable hw offloading for wep keys Greg Kroah-Hartman
` (146 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lorenzo Bianconi, Felix Fietkau, Sasha Levin
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 01f7da40917923bf9d8fd8d5c9a6ed646004e47c ]
This patch fixes a mcu hang during device probe on
Marvell ESPRESSObin after a hot reboot.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7921/dma.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
index bd9143dc865f..7fca7dc466b8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/dma.c
@@ -402,6 +402,10 @@ int mt7921_dma_init(struct mt7921_dev *dev)
if (ret)
return ret;
+ ret = mt7921_wfsys_reset(dev);
+ if (ret)
+ return ret;
+
/* init tx queue */
ret = mt7921_init_tx_queues(&dev->phy, MT7921_TXQ_BAND0,
MT7921_TX_RING_SIZE);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 124/266] mt76: mt7921: enable hw offloading for wep keys
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 123/266] mt76: mt7921: reset wfsys during hw probe Greg Kroah-Hartman
@ 2021-07-15 18:37 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 125/266] mt76: connac: fix UC entry is being overwritten Greg Kroah-Hartman
` (145 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:37 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Deren.Wu, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit a60951d4faa0ef2e475797dd217c2eaee32ed1c2 ]
Enable wep key hw offloading for sta mode. This patch fixes
WoW support for wep connections.
Tested-by: Deren.Wu <deren.wu@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7921/main.c | 22 ++++++++++++++-----
.../wireless/mediatek/mt76/mt7921/mt7921.h | 2 ++
2 files changed, 19 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index bd77a04a15fb..992a74e122e5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -376,6 +376,10 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIE;
wcid_keyidx = &wcid->hw_key_idx2;
break;
+ case WLAN_CIPHER_SUITE_WEP40:
+ case WLAN_CIPHER_SUITE_WEP104:
+ if (!mvif->wep_sta)
+ return -EOPNOTSUPP;
case WLAN_CIPHER_SUITE_TKIP:
case WLAN_CIPHER_SUITE_CCMP:
case WLAN_CIPHER_SUITE_CCMP_256:
@@ -383,8 +387,6 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
case WLAN_CIPHER_SUITE_GCMP_256:
case WLAN_CIPHER_SUITE_SMS4:
break;
- case WLAN_CIPHER_SUITE_WEP40:
- case WLAN_CIPHER_SUITE_WEP104:
default:
return -EOPNOTSUPP;
}
@@ -402,6 +404,12 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
cmd == SET_KEY ? key : NULL);
err = mt7921_mcu_add_key(dev, vif, msta, key, cmd);
+ if (err)
+ goto out;
+
+ if (key->cipher == WLAN_CIPHER_SUITE_WEP104 ||
+ key->cipher == WLAN_CIPHER_SUITE_WEP40)
+ err = mt7921_mcu_add_key(dev, vif, mvif->wep_sta, key, cmd);
out:
mt7921_mutex_release(dev);
@@ -608,9 +616,12 @@ int mt7921_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
if (ret)
return ret;
- if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls)
- mt76_connac_mcu_uni_add_bss(&dev->mphy, vif, &mvif->sta.wcid,
- true);
+ if (vif->type == NL80211_IFTYPE_STATION) {
+ mvif->wep_sta = msta;
+ if (!sta->tdls)
+ mt76_connac_mcu_uni_add_bss(&dev->mphy, vif,
+ &mvif->sta.wcid, true);
+ }
mt7921_mac_wtbl_update(dev, idx,
MT_WTBL_UPDATE_ADM_COUNT_CLEAR);
@@ -640,6 +651,7 @@ void mt7921_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
if (vif->type == NL80211_IFTYPE_STATION) {
struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv;
+ mvif->wep_sta = NULL;
ewma_rssi_init(&mvif->rssi);
if (!sta->tdls)
mt76_connac_mcu_uni_add_bss(&dev->mphy, vif,
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
index 710ad242fd53..957084c3ca43 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
@@ -100,6 +100,8 @@ struct mt7921_vif {
struct mt76_vif mt76; /* must be first */
struct mt7921_sta sta;
+ struct mt7921_sta *wep_sta;
+
struct mt7921_phy *phy;
struct ewma_rssi rssi;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 125/266] mt76: connac: fix UC entry is being overwritten
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2021-07-15 18:37 ` [PATCH 5.13 124/266] mt76: mt7921: enable hw offloading for wep keys Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 126/266] mt76: connac: fix the maximum interval schedule scan can support Greg Kroah-Hartman
` (144 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Deren Wu, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 82453b1cbf9ef166364c12b5464251f16bac5f51 ]
Fix UC entry is being overwritten by BC entry
Tested-by: Deren Wu <deren.wu@mediatek.com>
Co-developed-by: Deren Wu <deren.wu@mediatek.com>
Signed-off-by: Deren Wu <deren.wu@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 8 +++++---
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 10 ++++++----
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 1 +
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 1 +
4 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
index ae2191371f51..257a2c4ddf36 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
@@ -1123,12 +1123,14 @@ mt7615_mcu_sta_rx_ba(struct mt7615_dev *dev,
static int
__mt7615_mcu_add_sta(struct mt76_phy *phy, struct ieee80211_vif *vif,
- struct ieee80211_sta *sta, bool enable, int cmd)
+ struct ieee80211_sta *sta, bool enable, int cmd,
+ bool offload_fw)
{
struct mt7615_vif *mvif = (struct mt7615_vif *)vif->drv_priv;
struct mt76_sta_cmd_info info = {
.sta = sta,
.vif = vif,
+ .offload_fw = offload_fw,
.enable = enable,
.cmd = cmd,
};
@@ -1142,7 +1144,7 @@ mt7615_mcu_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
struct ieee80211_sta *sta, bool enable)
{
return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
- MCU_EXT_CMD_STA_REC_UPDATE);
+ MCU_EXT_CMD_STA_REC_UPDATE, false);
}
static const struct mt7615_mcu_ops sta_update_ops = {
@@ -1283,7 +1285,7 @@ mt7615_mcu_uni_add_sta(struct mt7615_phy *phy, struct ieee80211_vif *vif,
struct ieee80211_sta *sta, bool enable)
{
return __mt7615_mcu_add_sta(phy->mt76, vif, sta, enable,
- MCU_UNI_CMD_STA_REC_UPDATE);
+ MCU_UNI_CMD_STA_REC_UPDATE, true);
}
static int
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
index eb19721f9d79..e5721603586f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
@@ -841,10 +841,12 @@ int mt76_connac_mcu_add_sta_cmd(struct mt76_phy *phy,
if (IS_ERR(skb))
return PTR_ERR(skb);
- mt76_connac_mcu_sta_basic_tlv(skb, info->vif, info->sta, info->enable);
- if (info->enable && info->sta)
- mt76_connac_mcu_sta_tlv(phy, skb, info->sta, info->vif,
- info->rcpi);
+ if (info->sta || !info->offload_fw)
+ mt76_connac_mcu_sta_basic_tlv(skb, info->vif, info->sta,
+ info->enable);
+ if (info->sta && info->enable)
+ mt76_connac_mcu_sta_tlv(phy, skb, info->sta,
+ info->vif, info->rcpi);
sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
sizeof(struct tlv));
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
index 3bcae732872e..0450d8c1c181 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
@@ -899,6 +899,7 @@ struct mt76_sta_cmd_info {
struct ieee80211_vif *vif;
+ bool offload_fw;
bool enable;
int cmd;
u8 rcpi;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 06209d58ce27..9bc35ce80153 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -1289,6 +1289,7 @@ int mt7921_mcu_sta_add(struct mt7921_dev *dev, struct ieee80211_sta *sta,
.vif = vif,
.enable = enable,
.cmd = MCU_UNI_CMD_STA_REC_UPDATE,
+ .offload_fw = true,
.rcpi = to_rcpi(rssi),
};
struct mt7921_sta *msta;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 126/266] mt76: connac: fix the maximum interval schedule scan can support
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 125/266] mt76: connac: fix UC entry is being overwritten Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 127/266] mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode Greg Kroah-Hartman
` (143 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sean Wang, Felix Fietkau, Sasha Levin
From: Sean Wang <sean.wang@mediatek.com>
[ Upstream commit abded041a07467c2f3dfe10afd9ea10572c63cc9 ]
Maximum interval (in seconds) for schedule scan plan supported by
the offload firmware can be U16_MAX.
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/init.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt76_connac.h | 3 ++-
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +-
drivers/net/wireless/mediatek/mt76/mt7921/init.c | 2 +-
4 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
index d20f05a7717d..0d01fd3c77b5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
@@ -362,7 +362,7 @@ mt7615_init_wiphy(struct ieee80211_hw *hw)
wiphy->reg_notifier = mt7615_regd_notifier;
wiphy->max_sched_scan_plan_interval =
- MT76_CONNAC_MAX_SCHED_SCAN_INTERVAL;
+ MT76_CONNAC_MAX_TIME_SCHED_SCAN_INTERVAL;
wiphy->max_sched_scan_ie_len = IEEE80211_MAX_DATA_LEN;
wiphy->max_scan_ie_len = MT76_CONNAC_SCAN_IE_LEN;
wiphy->max_sched_scan_ssids = MT76_CONNAC_MAX_SCHED_SCAN_SSID;
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac.h
index c26cfef425ed..75223b6e1c87 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac.h
@@ -7,7 +7,8 @@
#include "mt76.h"
#define MT76_CONNAC_SCAN_IE_LEN 600
-#define MT76_CONNAC_MAX_SCHED_SCAN_INTERVAL 10
+#define MT76_CONNAC_MAX_NUM_SCHED_SCAN_INTERVAL 10
+#define MT76_CONNAC_MAX_TIME_SCHED_SCAN_INTERVAL U16_MAX
#define MT76_CONNAC_MAX_SCHED_SCAN_SSID 10
#define MT76_CONNAC_MAX_SCAN_MATCH 16
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
index 0450d8c1c181..facebed1e301 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
@@ -770,7 +770,7 @@ struct mt76_connac_sched_scan_req {
u8 intervals_num;
u8 scan_func; /* MT7663: BIT(0) eable random mac address */
struct mt76_connac_mcu_scan_channel channels[64];
- __le16 intervals[MT76_CONNAC_MAX_SCHED_SCAN_INTERVAL];
+ __le16 intervals[MT76_CONNAC_MAX_NUM_SCHED_SCAN_INTERVAL];
union {
struct {
u8 random_mac[ETH_ALEN];
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
index 2cb0252e63b2..db7e436076b3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
@@ -93,7 +93,7 @@ mt7921_init_wiphy(struct ieee80211_hw *hw)
wiphy->max_scan_ie_len = MT76_CONNAC_SCAN_IE_LEN;
wiphy->max_scan_ssids = 4;
wiphy->max_sched_scan_plan_interval =
- MT76_CONNAC_MAX_SCHED_SCAN_INTERVAL;
+ MT76_CONNAC_MAX_TIME_SCHED_SCAN_INTERVAL;
wiphy->max_sched_scan_ie_len = IEEE80211_MAX_DATA_LEN;
wiphy->max_sched_scan_ssids = MT76_CONNAC_MAX_SCHED_SCAN_SSID;
wiphy->max_match_sets = MT76_CONNAC_MAX_SCAN_MATCH;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 127/266] mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 126/266] mt76: connac: fix the maximum interval schedule scan can support Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 128/266] mt76: fix iv and CCMP header insertion Greg Kroah-Hartman
` (142 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ryder Lee, Felix Fietkau, Sasha Levin
From: Ryder Lee <ryder.lee@mediatek.com>
[ Upstream commit 2707ff4dd7b1479dbd44ebb3c74788084cc95245 ]
The value of station mode is always 0.
Fixed: 00b2e16e0063 ("mt76: mt7915: add TxBF capabilities")
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/init.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
index 822f3aa6bb8b..feb2aa57ef22 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
@@ -480,6 +480,9 @@ mt7915_set_stream_he_txbf_caps(struct ieee80211_sta_he_cap *he_cap,
if (nss < 2)
return;
+ /* the maximum cap is 4 x 3, (Nr, Nc) = (3, 2) */
+ elem->phy_cap_info[7] |= min_t(int, nss - 1, 2) << 3;
+
if (vif != NL80211_IFTYPE_AP)
return;
@@ -493,9 +496,6 @@ mt7915_set_stream_he_txbf_caps(struct ieee80211_sta_he_cap *he_cap,
c = IEEE80211_HE_PHY_CAP6_TRIG_SU_BEAMFORMING_FB |
IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMING_PARTIAL_BW_FB;
elem->phy_cap_info[6] |= c;
-
- /* the maximum cap is 4 x 3, (Nr, Nc) = (3, 2) */
- elem->phy_cap_info[7] |= min_t(int, nss - 1, 2) << 3;
}
static void
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 128/266] mt76: fix iv and CCMP header insertion
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 127/266] mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 129/266] rtl8xxxu: Fix device info for RTL8192EU devices Greg Kroah-Hartman
` (141 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xing Song, Ryder Lee, Felix Fietkau,
Sasha Levin
From: Ryder Lee <ryder.lee@mediatek.com>
[ Upstream commit c368362c36d3d4cedbc9a1c9caa95960912cc429 ]
The iv from RXD is only for TKIP_RSC/CCMP_PN/GCMP_PN, and it needs a
check for CCMP header insertion. Move mt76_cipher_type to mt76.h to
reduce duplicated code.
Signed-off-by: Xing Song <xing.song@mediatek.com>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt76.h | 16 +++++
.../net/wireless/mediatek/mt76/mt7603/mac.c | 33 +++++++---
.../net/wireless/mediatek/mt76/mt7603/regs.h | 12 ----
.../net/wireless/mediatek/mt76/mt7615/mac.c | 64 +++++++++++++++----
.../net/wireless/mediatek/mt76/mt7615/mac.h | 42 ------------
.../net/wireless/mediatek/mt76/mt76x02_mac.c | 28 ++++----
.../net/wireless/mediatek/mt76/mt76x02_regs.h | 18 +++---
.../net/wireless/mediatek/mt76/mt7915/mac.c | 29 ++++++---
.../net/wireless/mediatek/mt76/mt7915/mcu.c | 30 ++++-----
.../net/wireless/mediatek/mt76/mt7915/mcu.h | 23 ++++---
.../net/wireless/mediatek/mt76/mt7921/mac.c | 29 ++++++---
.../net/wireless/mediatek/mt76/mt7921/mcu.c | 30 ++++-----
.../net/wireless/mediatek/mt76/mt7921/mcu.h | 23 ++++---
13 files changed, 208 insertions(+), 169 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 36ede65919f8..0c23edbfbdbb 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -87,6 +87,22 @@ enum mt76_rxq_id {
__MT_RXQ_MAX
};
+enum mt76_cipher_type {
+ MT_CIPHER_NONE,
+ MT_CIPHER_WEP40,
+ MT_CIPHER_TKIP,
+ MT_CIPHER_TKIP_NO_MIC,
+ MT_CIPHER_AES_CCMP,
+ MT_CIPHER_WEP104,
+ MT_CIPHER_BIP_CMAC_128,
+ MT_CIPHER_WEP128,
+ MT_CIPHER_WAPI,
+ MT_CIPHER_CCMP_CCX,
+ MT_CIPHER_CCMP_256,
+ MT_CIPHER_GCMP,
+ MT_CIPHER_GCMP_256,
+};
+
struct mt76_queue_buf {
dma_addr_t addr;
u16 len;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
index fbceb07c5f37..3aa7483e929f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
@@ -550,14 +550,27 @@ mt7603_mac_fill_rx(struct mt7603_dev *dev, struct sk_buff *skb)
u8 *data = (u8 *)rxd;
if (status->flag & RX_FLAG_DECRYPTED) {
- status->iv[0] = data[5];
- status->iv[1] = data[4];
- status->iv[2] = data[3];
- status->iv[3] = data[2];
- status->iv[4] = data[1];
- status->iv[5] = data[0];
-
- insert_ccmp_hdr = FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
+ switch (FIELD_GET(MT_RXD2_NORMAL_SEC_MODE, rxd2)) {
+ case MT_CIPHER_AES_CCMP:
+ case MT_CIPHER_CCMP_CCX:
+ case MT_CIPHER_CCMP_256:
+ insert_ccmp_hdr =
+ FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
+ fallthrough;
+ case MT_CIPHER_TKIP:
+ case MT_CIPHER_TKIP_NO_MIC:
+ case MT_CIPHER_GCMP:
+ case MT_CIPHER_GCMP_256:
+ status->iv[0] = data[5];
+ status->iv[1] = data[4];
+ status->iv[2] = data[3];
+ status->iv[3] = data[2];
+ status->iv[4] = data[1];
+ status->iv[5] = data[0];
+ break;
+ default:
+ break;
+ }
}
rxd += 4;
@@ -831,7 +844,7 @@ void mt7603_wtbl_set_rates(struct mt7603_dev *dev, struct mt7603_sta *sta,
sta->wcid.tx_info |= MT_WCID_TX_INFO_SET;
}
-static enum mt7603_cipher_type
+static enum mt76_cipher_type
mt7603_mac_get_key_info(struct ieee80211_key_conf *key, u8 *key_data)
{
memset(key_data, 0, 32);
@@ -863,7 +876,7 @@ mt7603_mac_get_key_info(struct ieee80211_key_conf *key, u8 *key_data)
int mt7603_wtbl_set_key(struct mt7603_dev *dev, int wcid,
struct ieee80211_key_conf *key)
{
- enum mt7603_cipher_type cipher;
+ enum mt76_cipher_type cipher;
u32 addr = mt7603_wtbl3_addr(wcid);
u8 key_data[32];
int key_len = sizeof(key_data);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/regs.h b/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
index 6741e6907194..3b901090b29c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/regs.h
@@ -765,16 +765,4 @@ enum {
#define MT_WTBL1_OR (MT_WTBL1_BASE + 0x2300)
#define MT_WTBL1_OR_PSM_WRITE BIT(31)
-enum mt7603_cipher_type {
- MT_CIPHER_NONE,
- MT_CIPHER_WEP40,
- MT_CIPHER_TKIP,
- MT_CIPHER_TKIP_NO_MIC,
- MT_CIPHER_AES_CCMP,
- MT_CIPHER_WEP104,
- MT_CIPHER_BIP_CMAC_128,
- MT_CIPHER_WEP128,
- MT_CIPHER_WAPI,
-};
-
#endif
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
index 7bdf3378a4d1..4873154d082e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -57,6 +57,33 @@ static const struct mt7615_dfs_radar_spec jp_radar_specs = {
},
};
+static enum mt76_cipher_type
+mt7615_mac_get_cipher(int cipher)
+{
+ switch (cipher) {
+ case WLAN_CIPHER_SUITE_WEP40:
+ return MT_CIPHER_WEP40;
+ case WLAN_CIPHER_SUITE_WEP104:
+ return MT_CIPHER_WEP104;
+ case WLAN_CIPHER_SUITE_TKIP:
+ return MT_CIPHER_TKIP;
+ case WLAN_CIPHER_SUITE_AES_CMAC:
+ return MT_CIPHER_BIP_CMAC_128;
+ case WLAN_CIPHER_SUITE_CCMP:
+ return MT_CIPHER_AES_CCMP;
+ case WLAN_CIPHER_SUITE_CCMP_256:
+ return MT_CIPHER_CCMP_256;
+ case WLAN_CIPHER_SUITE_GCMP:
+ return MT_CIPHER_GCMP;
+ case WLAN_CIPHER_SUITE_GCMP_256:
+ return MT_CIPHER_GCMP_256;
+ case WLAN_CIPHER_SUITE_SMS4:
+ return MT_CIPHER_WAPI;
+ default:
+ return MT_CIPHER_NONE;
+ }
+}
+
static struct mt76_wcid *mt7615_rx_get_wcid(struct mt7615_dev *dev,
u8 idx, bool unicast)
{
@@ -313,14 +340,27 @@ static int mt7615_mac_fill_rx(struct mt7615_dev *dev, struct sk_buff *skb)
u8 *data = (u8 *)rxd;
if (status->flag & RX_FLAG_DECRYPTED) {
- status->iv[0] = data[5];
- status->iv[1] = data[4];
- status->iv[2] = data[3];
- status->iv[3] = data[2];
- status->iv[4] = data[1];
- status->iv[5] = data[0];
-
- insert_ccmp_hdr = FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
+ switch (FIELD_GET(MT_RXD2_NORMAL_SEC_MODE, rxd2)) {
+ case MT_CIPHER_AES_CCMP:
+ case MT_CIPHER_CCMP_CCX:
+ case MT_CIPHER_CCMP_256:
+ insert_ccmp_hdr =
+ FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
+ fallthrough;
+ case MT_CIPHER_TKIP:
+ case MT_CIPHER_TKIP_NO_MIC:
+ case MT_CIPHER_GCMP:
+ case MT_CIPHER_GCMP_256:
+ status->iv[0] = data[5];
+ status->iv[1] = data[4];
+ status->iv[2] = data[3];
+ status->iv[3] = data[2];
+ status->iv[4] = data[1];
+ status->iv[5] = data[0];
+ break;
+ default:
+ break;
+ }
}
rxd += 4;
if ((u8 *)rxd - skb->data >= skb->len)
@@ -1078,7 +1118,7 @@ EXPORT_SYMBOL_GPL(mt7615_mac_set_rates);
static int
mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
struct ieee80211_key_conf *key,
- enum mt7615_cipher_type cipher, u16 cipher_mask,
+ enum mt76_cipher_type cipher, u16 cipher_mask,
enum set_key_cmd cmd)
{
u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx) + 30 * 4;
@@ -1118,7 +1158,7 @@ mt7615_mac_wtbl_update_key(struct mt7615_dev *dev, struct mt76_wcid *wcid,
static int
mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
- enum mt7615_cipher_type cipher, u16 cipher_mask,
+ enum mt76_cipher_type cipher, u16 cipher_mask,
int keyidx, enum set_key_cmd cmd)
{
u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx), w0, w1;
@@ -1157,7 +1197,7 @@ mt7615_mac_wtbl_update_pk(struct mt7615_dev *dev, struct mt76_wcid *wcid,
static void
mt7615_mac_wtbl_update_cipher(struct mt7615_dev *dev, struct mt76_wcid *wcid,
- enum mt7615_cipher_type cipher, u16 cipher_mask,
+ enum mt76_cipher_type cipher, u16 cipher_mask,
enum set_key_cmd cmd)
{
u32 addr = mt7615_mac_wtbl_addr(dev, wcid->idx);
@@ -1183,7 +1223,7 @@ int __mt7615_mac_wtbl_set_key(struct mt7615_dev *dev,
struct ieee80211_key_conf *key,
enum set_key_cmd cmd)
{
- enum mt7615_cipher_type cipher;
+ enum mt76_cipher_type cipher;
u16 cipher_mask = wcid->cipher;
int err;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.h b/drivers/net/wireless/mediatek/mt76/mt7615/mac.h
index 6bf9da040196..46f283eb8d0f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.h
@@ -383,48 +383,6 @@ struct mt7615_dfs_radar_spec {
struct mt7615_dfs_pattern radar_pattern[16];
};
-enum mt7615_cipher_type {
- MT_CIPHER_NONE,
- MT_CIPHER_WEP40,
- MT_CIPHER_TKIP,
- MT_CIPHER_TKIP_NO_MIC,
- MT_CIPHER_AES_CCMP,
- MT_CIPHER_WEP104,
- MT_CIPHER_BIP_CMAC_128,
- MT_CIPHER_WEP128,
- MT_CIPHER_WAPI,
- MT_CIPHER_CCMP_256 = 10,
- MT_CIPHER_GCMP,
- MT_CIPHER_GCMP_256,
-};
-
-static inline enum mt7615_cipher_type
-mt7615_mac_get_cipher(int cipher)
-{
- switch (cipher) {
- case WLAN_CIPHER_SUITE_WEP40:
- return MT_CIPHER_WEP40;
- case WLAN_CIPHER_SUITE_WEP104:
- return MT_CIPHER_WEP104;
- case WLAN_CIPHER_SUITE_TKIP:
- return MT_CIPHER_TKIP;
- case WLAN_CIPHER_SUITE_AES_CMAC:
- return MT_CIPHER_BIP_CMAC_128;
- case WLAN_CIPHER_SUITE_CCMP:
- return MT_CIPHER_AES_CCMP;
- case WLAN_CIPHER_SUITE_CCMP_256:
- return MT_CIPHER_CCMP_256;
- case WLAN_CIPHER_SUITE_GCMP:
- return MT_CIPHER_GCMP;
- case WLAN_CIPHER_SUITE_GCMP_256:
- return MT_CIPHER_GCMP_256;
- case WLAN_CIPHER_SUITE_SMS4:
- return MT_CIPHER_WAPI;
- default:
- return MT_CIPHER_NONE;
- }
-}
-
static inline struct mt7615_txp_common *
mt7615_txwi_to_txp(struct mt76_dev *dev, struct mt76_txwi_cache *t)
{
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index 0da37867cb64..10d66775c391 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -34,24 +34,24 @@ mt76x02_mac_get_key_info(struct ieee80211_key_conf *key, u8 *key_data)
{
memset(key_data, 0, 32);
if (!key)
- return MT_CIPHER_NONE;
+ return MT76X02_CIPHER_NONE;
if (key->keylen > 32)
- return MT_CIPHER_NONE;
+ return MT76X02_CIPHER_NONE;
memcpy(key_data, key->key, key->keylen);
switch (key->cipher) {
case WLAN_CIPHER_SUITE_WEP40:
- return MT_CIPHER_WEP40;
+ return MT76X02_CIPHER_WEP40;
case WLAN_CIPHER_SUITE_WEP104:
- return MT_CIPHER_WEP104;
+ return MT76X02_CIPHER_WEP104;
case WLAN_CIPHER_SUITE_TKIP:
- return MT_CIPHER_TKIP;
+ return MT76X02_CIPHER_TKIP;
case WLAN_CIPHER_SUITE_CCMP:
- return MT_CIPHER_AES_CCMP;
+ return MT76X02_CIPHER_AES_CCMP;
default:
- return MT_CIPHER_NONE;
+ return MT76X02_CIPHER_NONE;
}
}
@@ -63,7 +63,7 @@ int mt76x02_mac_shared_key_setup(struct mt76x02_dev *dev, u8 vif_idx,
u32 val;
cipher = mt76x02_mac_get_key_info(key, key_data);
- if (cipher == MT_CIPHER_NONE && key)
+ if (cipher == MT76X02_CIPHER_NONE && key)
return -EOPNOTSUPP;
val = mt76_rr(dev, MT_SKEY_MODE(vif_idx));
@@ -91,10 +91,10 @@ void mt76x02_mac_wcid_sync_pn(struct mt76x02_dev *dev, u8 idx,
eiv = mt76_rr(dev, MT_WCID_IV(idx) + 4);
pn = (u64)eiv << 16;
- if (cipher == MT_CIPHER_TKIP) {
+ if (cipher == MT76X02_CIPHER_TKIP) {
pn |= (iv >> 16) & 0xff;
pn |= (iv & 0xff) << 8;
- } else if (cipher >= MT_CIPHER_AES_CCMP) {
+ } else if (cipher >= MT76X02_CIPHER_AES_CCMP) {
pn |= iv & 0xffff;
} else {
return;
@@ -112,7 +112,7 @@ int mt76x02_mac_wcid_set_key(struct mt76x02_dev *dev, u8 idx,
u64 pn;
cipher = mt76x02_mac_get_key_info(key, key_data);
- if (cipher == MT_CIPHER_NONE && key)
+ if (cipher == MT76X02_CIPHER_NONE && key)
return -EOPNOTSUPP;
mt76_wr_copy(dev, MT_WCID_KEY(idx), key_data, sizeof(key_data));
@@ -126,16 +126,16 @@ int mt76x02_mac_wcid_set_key(struct mt76x02_dev *dev, u8 idx,
pn = atomic64_read(&key->tx_pn);
iv_data[3] = key->keyidx << 6;
- if (cipher >= MT_CIPHER_TKIP) {
+ if (cipher >= MT76X02_CIPHER_TKIP) {
iv_data[3] |= 0x20;
put_unaligned_le32(pn >> 16, &iv_data[4]);
}
- if (cipher == MT_CIPHER_TKIP) {
+ if (cipher == MT76X02_CIPHER_TKIP) {
iv_data[0] = (pn >> 8) & 0xff;
iv_data[1] = (iv_data[0] | 0x20) & 0x7f;
iv_data[2] = pn & 0xff;
- } else if (cipher >= MT_CIPHER_AES_CCMP) {
+ } else if (cipher >= MT76X02_CIPHER_AES_CCMP) {
put_unaligned_le16((pn & 0xffff), &iv_data[0]);
}
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_regs.h b/drivers/net/wireless/mediatek/mt76/mt76x02_regs.h
index 3e722276b5c2..fa7872ac22bf 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_regs.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_regs.h
@@ -692,15 +692,15 @@ struct mt76_wcid_key {
} __packed __aligned(4);
enum mt76x02_cipher_type {
- MT_CIPHER_NONE,
- MT_CIPHER_WEP40,
- MT_CIPHER_WEP104,
- MT_CIPHER_TKIP,
- MT_CIPHER_AES_CCMP,
- MT_CIPHER_CKIP40,
- MT_CIPHER_CKIP104,
- MT_CIPHER_CKIP128,
- MT_CIPHER_WAPI,
+ MT76X02_CIPHER_NONE,
+ MT76X02_CIPHER_WEP40,
+ MT76X02_CIPHER_WEP104,
+ MT76X02_CIPHER_TKIP,
+ MT76X02_CIPHER_AES_CCMP,
+ MT76X02_CIPHER_CKIP40,
+ MT76X02_CIPHER_CKIP104,
+ MT76X02_CIPHER_CKIP128,
+ MT76X02_CIPHER_WAPI,
};
#endif
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
index 7a9759fb79d8..f4544c46c173 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
@@ -412,14 +412,27 @@ int mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)
u8 *data = (u8 *)rxd;
if (status->flag & RX_FLAG_DECRYPTED) {
- status->iv[0] = data[5];
- status->iv[1] = data[4];
- status->iv[2] = data[3];
- status->iv[3] = data[2];
- status->iv[4] = data[1];
- status->iv[5] = data[0];
-
- insert_ccmp_hdr = FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
+ switch (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1)) {
+ case MT_CIPHER_AES_CCMP:
+ case MT_CIPHER_CCMP_CCX:
+ case MT_CIPHER_CCMP_256:
+ insert_ccmp_hdr =
+ FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
+ fallthrough;
+ case MT_CIPHER_TKIP:
+ case MT_CIPHER_TKIP_NO_MIC:
+ case MT_CIPHER_GCMP:
+ case MT_CIPHER_GCMP_256:
+ status->iv[0] = data[5];
+ status->iv[1] = data[4];
+ status->iv[2] = data[3];
+ status->iv[3] = data[2];
+ status->iv[4] = data[1];
+ status->iv[5] = data[0];
+ break;
+ default:
+ break;
+ }
}
rxd += 4;
if ((u8 *)rxd - skb->data >= skb->len)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 764f25a828fa..607980321d27 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -88,28 +88,28 @@ struct mt7915_fw_region {
#define HE_PHY(p, c) u8_get_bits(c, IEEE80211_HE_PHY_##p)
#define HE_MAC(m, c) u8_get_bits(c, IEEE80211_HE_MAC_##m)
-static enum mt7915_cipher_type
+static enum mcu_cipher_type
mt7915_mcu_get_cipher(int cipher)
{
switch (cipher) {
case WLAN_CIPHER_SUITE_WEP40:
- return MT_CIPHER_WEP40;
+ return MCU_CIPHER_WEP40;
case WLAN_CIPHER_SUITE_WEP104:
- return MT_CIPHER_WEP104;
+ return MCU_CIPHER_WEP104;
case WLAN_CIPHER_SUITE_TKIP:
- return MT_CIPHER_TKIP;
+ return MCU_CIPHER_TKIP;
case WLAN_CIPHER_SUITE_AES_CMAC:
- return MT_CIPHER_BIP_CMAC_128;
+ return MCU_CIPHER_BIP_CMAC_128;
case WLAN_CIPHER_SUITE_CCMP:
- return MT_CIPHER_AES_CCMP;
+ return MCU_CIPHER_AES_CCMP;
case WLAN_CIPHER_SUITE_CCMP_256:
- return MT_CIPHER_CCMP_256;
+ return MCU_CIPHER_CCMP_256;
case WLAN_CIPHER_SUITE_GCMP:
- return MT_CIPHER_GCMP;
+ return MCU_CIPHER_GCMP;
case WLAN_CIPHER_SUITE_GCMP_256:
- return MT_CIPHER_GCMP_256;
+ return MCU_CIPHER_GCMP_256;
case WLAN_CIPHER_SUITE_SMS4:
- return MT_CIPHER_WAPI;
+ return MCU_CIPHER_WAPI;
default:
return MT_CIPHER_NONE;
}
@@ -1072,14 +1072,14 @@ mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
sec_key = &sec->key[0];
sec_key->cipher_len = sizeof(*sec_key);
- if (cipher == MT_CIPHER_BIP_CMAC_128) {
- sec_key->cipher_id = MT_CIPHER_AES_CCMP;
+ if (cipher == MCU_CIPHER_BIP_CMAC_128) {
+ sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
sec_key->key_id = bip->keyidx;
sec_key->key_len = 16;
memcpy(sec_key->key, bip->key, 16);
sec_key = &sec->key[1];
- sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
+ sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
sec_key->cipher_len = sizeof(*sec_key);
sec_key->key_len = 16;
memcpy(sec_key->key, key->key, 16);
@@ -1091,14 +1091,14 @@ mt7915_mcu_sta_key_tlv(struct mt7915_sta *msta, struct sk_buff *skb,
sec_key->key_len = key->keylen;
memcpy(sec_key->key, key->key, key->keylen);
- if (cipher == MT_CIPHER_TKIP) {
+ if (cipher == MCU_CIPHER_TKIP) {
/* Rx/Tx MIC keys are swapped */
memcpy(sec_key->key + 16, key->key + 24, 8);
memcpy(sec_key->key + 24, key->key + 16, 8);
}
/* store key_conf for BIP batch update */
- if (cipher == MT_CIPHER_AES_CCMP) {
+ if (cipher == MCU_CIPHER_AES_CCMP) {
memcpy(bip->key, key->key, key->keylen);
bip->keyidx = key->keyidx;
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
index 42582a66e42d..517621044d9e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h
@@ -1034,18 +1034,17 @@ enum {
STA_REC_MAX_NUM
};
-enum mt7915_cipher_type {
- MT_CIPHER_NONE,
- MT_CIPHER_WEP40,
- MT_CIPHER_WEP104,
- MT_CIPHER_WEP128,
- MT_CIPHER_TKIP,
- MT_CIPHER_AES_CCMP,
- MT_CIPHER_CCMP_256,
- MT_CIPHER_GCMP,
- MT_CIPHER_GCMP_256,
- MT_CIPHER_WAPI,
- MT_CIPHER_BIP_CMAC_128,
+enum mcu_cipher_type {
+ MCU_CIPHER_WEP40 = 1,
+ MCU_CIPHER_WEP104,
+ MCU_CIPHER_WEP128,
+ MCU_CIPHER_TKIP,
+ MCU_CIPHER_AES_CCMP,
+ MCU_CIPHER_CCMP_256,
+ MCU_CIPHER_GCMP,
+ MCU_CIPHER_GCMP_256,
+ MCU_CIPHER_WAPI,
+ MCU_CIPHER_BIP_CMAC_128,
};
enum {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
index 751d97bef534..d7d8c909acdf 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c
@@ -386,14 +386,27 @@ int mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb)
u8 *data = (u8 *)rxd;
if (status->flag & RX_FLAG_DECRYPTED) {
- status->iv[0] = data[5];
- status->iv[1] = data[4];
- status->iv[2] = data[3];
- status->iv[3] = data[2];
- status->iv[4] = data[1];
- status->iv[5] = data[0];
-
- insert_ccmp_hdr = FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
+ switch (FIELD_GET(MT_RXD1_NORMAL_SEC_MODE, rxd1)) {
+ case MT_CIPHER_AES_CCMP:
+ case MT_CIPHER_CCMP_CCX:
+ case MT_CIPHER_CCMP_256:
+ insert_ccmp_hdr =
+ FIELD_GET(MT_RXD2_NORMAL_FRAG, rxd2);
+ fallthrough;
+ case MT_CIPHER_TKIP:
+ case MT_CIPHER_TKIP_NO_MIC:
+ case MT_CIPHER_GCMP:
+ case MT_CIPHER_GCMP_256:
+ status->iv[0] = data[5];
+ status->iv[1] = data[4];
+ status->iv[2] = data[3];
+ status->iv[3] = data[2];
+ status->iv[4] = data[1];
+ status->iv[5] = data[0];
+ break;
+ default:
+ break;
+ }
}
rxd += 4;
if ((u8 *)rxd - skb->data >= skb->len)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index 9bc35ce80153..ee6cf189103f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -88,28 +88,28 @@ struct mt7921_fw_region {
#define to_wcid_lo(id) FIELD_GET(GENMASK(7, 0), (u16)id)
#define to_wcid_hi(id) FIELD_GET(GENMASK(9, 8), (u16)id)
-static enum mt7921_cipher_type
+static enum mcu_cipher_type
mt7921_mcu_get_cipher(int cipher)
{
switch (cipher) {
case WLAN_CIPHER_SUITE_WEP40:
- return MT_CIPHER_WEP40;
+ return MCU_CIPHER_WEP40;
case WLAN_CIPHER_SUITE_WEP104:
- return MT_CIPHER_WEP104;
+ return MCU_CIPHER_WEP104;
case WLAN_CIPHER_SUITE_TKIP:
- return MT_CIPHER_TKIP;
+ return MCU_CIPHER_TKIP;
case WLAN_CIPHER_SUITE_AES_CMAC:
- return MT_CIPHER_BIP_CMAC_128;
+ return MCU_CIPHER_BIP_CMAC_128;
case WLAN_CIPHER_SUITE_CCMP:
- return MT_CIPHER_AES_CCMP;
+ return MCU_CIPHER_AES_CCMP;
case WLAN_CIPHER_SUITE_CCMP_256:
- return MT_CIPHER_CCMP_256;
+ return MCU_CIPHER_CCMP_256;
case WLAN_CIPHER_SUITE_GCMP:
- return MT_CIPHER_GCMP;
+ return MCU_CIPHER_GCMP;
case WLAN_CIPHER_SUITE_GCMP_256:
- return MT_CIPHER_GCMP_256;
+ return MCU_CIPHER_GCMP_256;
case WLAN_CIPHER_SUITE_SMS4:
- return MT_CIPHER_WAPI;
+ return MCU_CIPHER_WAPI;
default:
return MT_CIPHER_NONE;
}
@@ -615,14 +615,14 @@ mt7921_mcu_sta_key_tlv(struct mt7921_sta *msta, struct sk_buff *skb,
sec_key = &sec->key[0];
sec_key->cipher_len = sizeof(*sec_key);
- if (cipher == MT_CIPHER_BIP_CMAC_128) {
- sec_key->cipher_id = MT_CIPHER_AES_CCMP;
+ if (cipher == MCU_CIPHER_BIP_CMAC_128) {
+ sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
sec_key->key_id = bip->keyidx;
sec_key->key_len = 16;
memcpy(sec_key->key, bip->key, 16);
sec_key = &sec->key[1];
- sec_key->cipher_id = MT_CIPHER_BIP_CMAC_128;
+ sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
sec_key->cipher_len = sizeof(*sec_key);
sec_key->key_len = 16;
memcpy(sec_key->key, key->key, 16);
@@ -634,14 +634,14 @@ mt7921_mcu_sta_key_tlv(struct mt7921_sta *msta, struct sk_buff *skb,
sec_key->key_len = key->keylen;
memcpy(sec_key->key, key->key, key->keylen);
- if (cipher == MT_CIPHER_TKIP) {
+ if (cipher == MCU_CIPHER_TKIP) {
/* Rx/Tx MIC keys are swapped */
memcpy(sec_key->key + 16, key->key + 24, 8);
memcpy(sec_key->key + 24, key->key + 16, 8);
}
/* store key_conf for BIP batch update */
- if (cipher == MT_CIPHER_AES_CCMP) {
+ if (cipher == MCU_CIPHER_AES_CCMP) {
memcpy(bip->key, key->key, key->keylen);
bip->keyidx = key->keyidx;
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h
index 49823d0a3d0a..07abe86f07a9 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h
@@ -197,18 +197,17 @@ struct sta_rec_sec {
struct sec_key key[2];
} __packed;
-enum mt7921_cipher_type {
- MT_CIPHER_NONE,
- MT_CIPHER_WEP40,
- MT_CIPHER_WEP104,
- MT_CIPHER_WEP128,
- MT_CIPHER_TKIP,
- MT_CIPHER_AES_CCMP,
- MT_CIPHER_CCMP_256,
- MT_CIPHER_GCMP,
- MT_CIPHER_GCMP_256,
- MT_CIPHER_WAPI,
- MT_CIPHER_BIP_CMAC_128,
+enum mcu_cipher_type {
+ MCU_CIPHER_WEP40 = 1,
+ MCU_CIPHER_WEP104,
+ MCU_CIPHER_WEP128,
+ MCU_CIPHER_TKIP,
+ MCU_CIPHER_AES_CCMP,
+ MCU_CIPHER_CCMP_256,
+ MCU_CIPHER_GCMP,
+ MCU_CIPHER_GCMP_256,
+ MCU_CIPHER_WAPI,
+ MCU_CIPHER_BIP_CMAC_128,
};
enum {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 129/266] rtl8xxxu: Fix device info for RTL8192EU devices
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 128/266] mt76: fix iv and CCMP header insertion Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 130/266] MIPS: add PMD table accounting into MIPSpmd_alloc_one Greg Kroah-Hartman
` (140 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pascal Terjan, Kalle Valo, Sasha Levin
From: Pascal Terjan <pterjan@google.com>
[ Upstream commit c240b044edefa3c3af4014a4030e017dd95b59a1 ]
Based on 2001:3319 and 2357:0109 which I used to test the fix and
0bda:818b and 2357:0108 for which I found efuse dumps online.
== 2357:0109 ==
=== Before ===
Vendor: Realtek
Product: \x03802.11n NI
Serial:
=== After ===
Vendor: Realtek
Product: 802.11n NIC
Serial not available.
== 2001:3319 ==
=== Before ===
Vendor: Realtek
Product: Wireless N
Serial: no USB Adap
=== After ===
Vendor: Realtek
Product: Wireless N Nano USB Adapter
Serial not available.
Signed-off-by: Pascal Terjan <pterjan@google.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210424172959.1559890-1-pterjan@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 11 +---
.../realtek/rtl8xxxu/rtl8xxxu_8192e.c | 59 +++++++++++++++++--
2 files changed, 56 insertions(+), 14 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
index d1a566cc0c9e..01735776345a 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
@@ -853,15 +853,10 @@ struct rtl8192eu_efuse {
u8 usb_optional_function;
u8 res9[2];
u8 mac_addr[ETH_ALEN]; /* 0xd7 */
- u8 res10[2];
- u8 vendor_name[7];
- u8 res11[2];
- u8 device_name[0x0b]; /* 0xe8 */
- u8 res12[2];
- u8 serial[0x0b]; /* 0xf5 */
- u8 res13[0x30];
+ u8 device_info[80];
+ u8 res11[3];
u8 unknown[0x0d]; /* 0x130 */
- u8 res14[0xc3];
+ u8 res12[0xc3];
};
struct rtl8xxxu_reg8val {
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
index cfe2dfdae928..b06508d0cdf8 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
@@ -554,9 +554,43 @@ rtl8192e_set_tx_power(struct rtl8xxxu_priv *priv, int channel, bool ht40)
}
}
+static void rtl8192eu_log_next_device_info(struct rtl8xxxu_priv *priv,
+ char *record_name,
+ char *device_info,
+ unsigned int *record_offset)
+{
+ char *record = device_info + *record_offset;
+
+ /* A record is [ total length | 0x03 | value ] */
+ unsigned char l = record[0];
+
+ /*
+ * The whole device info section seems to be 80 characters, make sure
+ * we don't read further.
+ */
+ if (*record_offset + l > 80) {
+ dev_warn(&priv->udev->dev,
+ "invalid record length %d while parsing \"%s\" at offset %u.\n",
+ l, record_name, *record_offset);
+ return;
+ }
+
+ if (l >= 2) {
+ char value[80];
+
+ memcpy(value, &record[2], l - 2);
+ value[l - 2] = '\0';
+ dev_info(&priv->udev->dev, "%s: %s\n", record_name, value);
+ *record_offset = *record_offset + l;
+ } else {
+ dev_info(&priv->udev->dev, "%s not available.\n", record_name);
+ }
+}
+
static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv)
{
struct rtl8192eu_efuse *efuse = &priv->efuse_wifi.efuse8192eu;
+ unsigned int record_offset;
int i;
if (efuse->rtl_id != cpu_to_le16(0x8129))
@@ -604,12 +638,25 @@ static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv)
priv->has_xtalk = 1;
priv->xtalk = priv->efuse_wifi.efuse8192eu.xtal_k & 0x3f;
- dev_info(&priv->udev->dev, "Vendor: %.7s\n", efuse->vendor_name);
- dev_info(&priv->udev->dev, "Product: %.11s\n", efuse->device_name);
- if (memchr_inv(efuse->serial, 0xff, 11))
- dev_info(&priv->udev->dev, "Serial: %.11s\n", efuse->serial);
- else
- dev_info(&priv->udev->dev, "Serial not available.\n");
+ /*
+ * device_info section seems to be laid out as records
+ * [ total length | 0x03 | value ] so:
+ * - vendor length + 2
+ * - 0x03
+ * - vendor string (not null terminated)
+ * - product length + 2
+ * - 0x03
+ * - product string (not null terminated)
+ * Then there is one or 2 0x00 on all the 4 devices I own or found
+ * dumped online.
+ * As previous version of the code handled an optional serial
+ * string, I now assume there may be a third record if the
+ * length is not 0.
+ */
+ record_offset = 0;
+ rtl8192eu_log_next_device_info(priv, "Vendor", efuse->device_info, &record_offset);
+ rtl8192eu_log_next_device_info(priv, "Product", efuse->device_info, &record_offset);
+ rtl8192eu_log_next_device_info(priv, "Serial", efuse->device_info, &record_offset);
if (rtl8xxxu_debug & RTL8XXXU_DEBUG_EFUSE) {
unsigned char *raw = priv->efuse_wifi.raw;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 130/266] MIPS: add PMD table accounting into MIPSpmd_alloc_one
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 129/266] rtl8xxxu: Fix device info for RTL8192EU devices Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 131/266] net: fec: add FEC_QUIRK_HAS_MULTI_QUEUES represents i.MX6SX ENET IP Greg Kroah-Hartman
` (139 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Huang Pei, Thomas Bogendoerfer, Sasha Levin
From: Huang Pei <huangpei@loongson.cn>
[ Upstream commit ed914d48b6a1040d1039d371b56273d422c0081e ]
This fixes Page Table accounting bug.
MIPS is the ONLY arch just defining __HAVE_ARCH_PMD_ALLOC_ONE alone.
Since commit b2b29d6d011944 (mm: account PMD tables like PTE tables),
"pmd_free" in asm-generic with PMD table accounting and "pmd_alloc_one"
in MIPS without PMD table accounting causes PageTable accounting number
negative, which read by global_zone_page_state(), always returns 0.
Signed-off-by: Huang Pei <huangpei@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/asm/pgalloc.h | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
index 8b18424b3120..d0cf997b4ba8 100644
--- a/arch/mips/include/asm/pgalloc.h
+++ b/arch/mips/include/asm/pgalloc.h
@@ -59,11 +59,15 @@ do { \
static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
{
- pmd_t *pmd;
+ pmd_t *pmd = NULL;
+ struct page *pg;
- pmd = (pmd_t *) __get_free_pages(GFP_KERNEL, PMD_ORDER);
- if (pmd)
+ pg = alloc_pages(GFP_KERNEL | __GFP_ACCOUNT, PMD_ORDER);
+ if (pg) {
+ pgtable_pmd_page_ctor(pg);
+ pmd = (pmd_t *)page_address(pg);
pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table);
+ }
return pmd;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 131/266] net: fec: add FEC_QUIRK_HAS_MULTI_QUEUES represents i.MX6SX ENET IP
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 130/266] MIPS: add PMD table accounting into MIPSpmd_alloc_one Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 132/266] net: fec: add ndo_select_queue to fix TX bandwidth fluctuations Greg Kroah-Hartman
` (138 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frieder Schrempf, Joakim Zhang,
David S. Miller, Sasha Levin
From: Joakim Zhang <qiangqing.zhang@nxp.com>
[ Upstream commit 471ff4455d61c9929ae912328859921708e1eafc ]
Frieder Schrempf reported a TX throuthput issue [1], it happens quite often
that the measured bandwidth in TX direction drops from its expected/nominal
value to something like ~50% (for 100M) or ~67% (for 1G) connections.
[1] https://lore.kernel.org/linux-arm-kernel/421cc86c-b66f-b372-32f7-21e59f9a98bc@kontron.de/
The issue becomes clear after digging into it, Net core would select
queues when transmitting packets. Since FEC have not impletemented
ndo_select_queue callback yet, so it will call netdev_pick_tx to select
queues randomly.
For i.MX6SX ENET IP with AVB support, driver default enables this
feature. According to the setting of QOS/RCMRn/DMAnCFG registers, AVB
configured to Credit-based scheme, 50% bandwidth of each queue 1&2.
With below tests let me think more:
1) With FEC_QUIRK_HAS_AVB quirk, can reproduce TX bandwidth fluctuations issue.
2) Without FEC_QUIRK_HAS_AVB quirk, can't reproduce TX bandwidth fluctuations issue.
The related difference with or w/o FEC_QUIRK_HAS_AVB quirk is that, whether we
program FTYPE field of TxBD or not. As I describe above, AVB feature is
enabled by default. With FEC_QUIRK_HAS_AVB quirk, frames in queue 0
marked as non-AVB, and frames in queue 1&2 marked as AVB Class A&B. It's
unreasonable if frames in queue 1&2 are not required to be time-sensitive.
So when Net core select tx queues ramdomly, Credit-based scheme would work
and lead to TX bandwidth fluctuated. On the other hand, w/o
FEC_QUIRK_HAS_AVB quirk, frames in queue 1&2 are all marked as non-AVB, so
Credit-based scheme would not work.
Till now, how can we fix this TX throughput issue? Yes, please remove
FEC_QUIRK_HAS_AVB quirk if you suffer it from time-nonsensitive networking.
However, this quirk is used to indicate i.MX6SX, other setting depends
on it. So this patch adds a new quirk FEC_QUIRK_HAS_MULTI_QUEUES to
represent i.MX6SX, it is safe for us remove FEC_QUIRK_HAS_AVB quirk
now.
FEC_QUIRK_HAS_AVB quirk is set by default in the driver, and users may
not know much about driver details, they would waste effort to find the
root cause, that is not we want. The following patch is a implementation
to fix it and users don't need to modify the driver.
Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reported-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/fec.h | 5 +++++
drivers/net/ethernet/freescale/fec_main.c | 11 ++++++-----
2 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 0602d5d5d2ee..2e002e4b4b4a 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -467,6 +467,11 @@ struct bufdesc_ex {
*/
#define FEC_QUIRK_NO_HARD_RESET (1 << 18)
+/* i.MX6SX ENET IP supports multiple queues (3 queues), use this quirk to
+ * represents this ENET IP.
+ */
+#define FEC_QUIRK_HAS_MULTI_QUEUES (1 << 19)
+
struct bufdesc_prop {
int qid;
/* Address of Rx and Tx buffers */
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index ad82cffc6f3f..98cd38379275 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -122,7 +122,7 @@ static const struct fec_devinfo fec_imx6x_info = {
FEC_QUIRK_HAS_VLAN | FEC_QUIRK_HAS_AVB |
FEC_QUIRK_ERR007885 | FEC_QUIRK_BUG_CAPTURE |
FEC_QUIRK_HAS_RACC | FEC_QUIRK_HAS_COALESCE |
- FEC_QUIRK_CLEAR_SETUP_MII,
+ FEC_QUIRK_CLEAR_SETUP_MII | FEC_QUIRK_HAS_MULTI_QUEUES,
};
static const struct fec_devinfo fec_imx6ul_info = {
@@ -421,6 +421,7 @@ fec_enet_txq_submit_frag_skb(struct fec_enet_priv_tx_q *txq,
estatus |= FEC_TX_BD_FTYPE(txq->bd.qid);
if (skb->ip_summed == CHECKSUM_PARTIAL)
estatus |= BD_ENET_TX_PINS | BD_ENET_TX_IINS;
+
ebdp->cbd_bdu = 0;
ebdp->cbd_esc = cpu_to_fec32(estatus);
}
@@ -954,7 +955,7 @@ fec_restart(struct net_device *ndev)
* For i.MX6SX SOC, enet use AXI bus, we use disable MAC
* instead of reset MAC itself.
*/
- if (fep->quirks & FEC_QUIRK_HAS_AVB ||
+ if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES ||
((fep->quirks & FEC_QUIRK_NO_HARD_RESET) && fep->link)) {
writel(0, fep->hwp + FEC_ECNTRL);
} else {
@@ -1165,7 +1166,7 @@ fec_stop(struct net_device *ndev)
* instead of reset MAC itself.
*/
if (!(fep->wol_flag & FEC_WOL_FLAG_SLEEP_ON)) {
- if (fep->quirks & FEC_QUIRK_HAS_AVB) {
+ if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) {
writel(0, fep->hwp + FEC_ECNTRL);
} else {
writel(1, fep->hwp + FEC_ECNTRL);
@@ -2570,7 +2571,7 @@ static void fec_enet_itr_coal_set(struct net_device *ndev)
writel(tx_itr, fep->hwp + FEC_TXIC0);
writel(rx_itr, fep->hwp + FEC_RXIC0);
- if (fep->quirks & FEC_QUIRK_HAS_AVB) {
+ if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) {
writel(tx_itr, fep->hwp + FEC_TXIC1);
writel(rx_itr, fep->hwp + FEC_RXIC1);
writel(tx_itr, fep->hwp + FEC_TXIC2);
@@ -3371,7 +3372,7 @@ static int fec_enet_init(struct net_device *ndev)
fep->csum_flags |= FLAG_RX_CSUM_ENABLED;
}
- if (fep->quirks & FEC_QUIRK_HAS_AVB) {
+ if (fep->quirks & FEC_QUIRK_HAS_MULTI_QUEUES) {
fep->tx_align = 0;
fep->rx_align = 0x3f;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 132/266] net: fec: add ndo_select_queue to fix TX bandwidth fluctuations
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 131/266] net: fec: add FEC_QUIRK_HAS_MULTI_QUEUES represents i.MX6SX ENET IP Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 133/266] atm: nicstar: use dma_free_coherent instead of kfree Greg Kroah-Hartman
` (137 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frieder Schrempf, Fugang Duan,
Joakim Zhang, kernel test robot, David S. Miller, Sasha Levin
From: Fugang Duan <fugang.duan@nxp.com>
[ Upstream commit 52c4a1a85f4b346c39c896c0168f4a843b3385ff ]
As we know that AVB is enabled by default, and the ENET IP design is
queue 0 for best effort, queue 1&2 for AVB Class A&B. Bandwidth of each
queue 1&2 set in driver is 50%, TX bandwidth fluctuated when selecting
tx queues randomly with FEC_QUIRK_HAS_AVB quirk available.
This patch adds ndo_select_queue callback to select queues for
transmitting to fix this issue. It will always return queue 0 if this is
not a vlan packet, and return queue 1 or 2 based on priority of vlan
packet.
You may complain that in fact we only use single queue for trasmitting
if we are not targeted to VLAN. Yes, but seems we have no choice, since
AVB is enabled when the driver probed, we can't switch this feature
dynamicly. After compare multiple queues to single queue, TX throughput
almost no improvement.
One way we can implemet is to configure the driver to multiple queues
with Round-robin scheme by default. Then add ndo_setup_tc callback to
enable/disable AVB feature for users. Unfortunately, ENET AVB IP seems
not follow the standard 802.1Qav spec. We only can program
DMAnCFG[IDLE_SLOPE] field to calculate bandwidth fraction. And idle
slope is restricted to certain valus (a total of 19). It's far away from
CBS QDisc implemented in Linux TC framework. If you strongly suggest to do
this, I think we only can support limited numbers of bandwidth and reject
others, but it's really urgly and wried.
With this patch, VLAN tagged packets route to queue 0/1/2 based on vlan
priority; VLAN untagged packets route to queue 0.
Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reported-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/fec_main.c | 32 +++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 98cd38379275..8aea707a65a7 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -76,6 +76,8 @@ static void fec_enet_itr_coal_init(struct net_device *ndev);
#define DRIVER_NAME "fec"
+static const u16 fec_enet_vlan_pri_to_queue[8] = {0, 0, 1, 1, 1, 2, 2, 2};
+
/* Pause frame feild and FIFO threshold */
#define FEC_ENET_FCE (1 << 5)
#define FEC_ENET_RSEM_V 0x84
@@ -3240,10 +3242,40 @@ static int fec_set_features(struct net_device *netdev,
return 0;
}
+static u16 fec_enet_get_raw_vlan_tci(struct sk_buff *skb)
+{
+ struct vlan_ethhdr *vhdr;
+ unsigned short vlan_TCI = 0;
+
+ if (skb->protocol == htons(ETH_P_ALL)) {
+ vhdr = (struct vlan_ethhdr *)(skb->data);
+ vlan_TCI = ntohs(vhdr->h_vlan_TCI);
+ }
+
+ return vlan_TCI;
+}
+
+static u16 fec_enet_select_queue(struct net_device *ndev, struct sk_buff *skb,
+ struct net_device *sb_dev)
+{
+ struct fec_enet_private *fep = netdev_priv(ndev);
+ u16 vlan_tag;
+
+ if (!(fep->quirks & FEC_QUIRK_HAS_AVB))
+ return netdev_pick_tx(ndev, skb, NULL);
+
+ vlan_tag = fec_enet_get_raw_vlan_tci(skb);
+ if (!vlan_tag)
+ return vlan_tag;
+
+ return fec_enet_vlan_pri_to_queue[vlan_tag >> 13];
+}
+
static const struct net_device_ops fec_netdev_ops = {
.ndo_open = fec_enet_open,
.ndo_stop = fec_enet_close,
.ndo_start_xmit = fec_enet_start_xmit,
+ .ndo_select_queue = fec_enet_select_queue,
.ndo_set_rx_mode = set_multicast_list,
.ndo_validate_addr = eth_validate_addr,
.ndo_tx_timeout = fec_timeout,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 133/266] atm: nicstar: use dma_free_coherent instead of kfree
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 132/266] net: fec: add ndo_select_queue to fix TX bandwidth fluctuations Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 134/266] atm: nicstar: register the interrupt handler in the right place Greg Kroah-Hartman
` (136 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheyu Ma, David S. Miller, Sasha Levin
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit 6a1e5a4af17e440dd82a58a2c5f40ff17a82b722 ]
When 'nicstar_init_one' fails, 'ns_init_card_error' will be executed for
error handling, but the correct memory free function should be used,
otherwise it will cause an error. Since 'card->rsq.org' and
'card->tsq.org' are allocated using 'dma_alloc_coherent' function, they
should be freed using 'dma_free_coherent'.
Fix this by using 'dma_free_coherent' instead of 'kfree'
This log reveals it:
[ 3.440294] kernel BUG at mm/slub.c:4206!
[ 3.441059] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[ 3.441430] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.12.4-g70e7f0549188-dirty #141
[ 3.441986] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 3.442780] RIP: 0010:kfree+0x26a/0x300
[ 3.443065] Code: e8 3a c3 b9 ff e9 d6 fd ff ff 49 8b 45 00 31 db a9 00 00 01 00 75 4d 49 8b 45 00 a9 00 00 01 00 75 0a 49 8b 45 08 a8 01 75 02 <0f> 0b 89 d9 b8 00 10 00 00 be 06 00 00 00 48 d3 e0 f7 d8 48 63 d0
[ 3.443396] RSP: 0000:ffffc90000017b70 EFLAGS: 00010246
[ 3.443396] RAX: dead000000000100 RBX: 0000000000000000 RCX: 0000000000000000
[ 3.443396] RDX: 0000000000000000 RSI: ffffffff85d3df94 RDI: ffffffff85df38e6
[ 3.443396] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000001
[ 3.443396] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888107dc0000
[ 3.443396] R13: ffffea00001f0100 R14: ffff888101a8bf00 R15: ffff888107dc0160
[ 3.443396] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000
[ 3.443396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.443396] CR2: 0000000000000000 CR3: 000000000642e000 CR4: 00000000000006e0
[ 3.443396] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3.443396] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3.443396] Call Trace:
[ 3.443396] ns_init_card_error+0x12c/0x220
[ 3.443396] nicstar_init_one+0x10d2/0x1130
[ 3.443396] local_pci_probe+0x4a/0xb0
[ 3.443396] pci_device_probe+0x126/0x1d0
[ 3.443396] ? pci_device_remove+0x100/0x100
[ 3.443396] really_probe+0x27e/0x650
[ 3.443396] driver_probe_device+0x84/0x1d0
[ 3.443396] ? mutex_lock_nested+0x16/0x20
[ 3.443396] device_driver_attach+0x63/0x70
[ 3.443396] __driver_attach+0x117/0x1a0
[ 3.443396] ? device_driver_attach+0x70/0x70
[ 3.443396] bus_for_each_dev+0xb6/0x110
[ 3.443396] ? rdinit_setup+0x40/0x40
[ 3.443396] driver_attach+0x22/0x30
[ 3.443396] bus_add_driver+0x1e6/0x2a0
[ 3.443396] driver_register+0xa4/0x180
[ 3.443396] __pci_register_driver+0x77/0x80
[ 3.443396] ? uPD98402_module_init+0xd/0xd
[ 3.443396] nicstar_init+0x1f/0x75
[ 3.443396] do_one_initcall+0x7a/0x3d0
[ 3.443396] ? rdinit_setup+0x40/0x40
[ 3.443396] ? rcu_read_lock_sched_held+0x4a/0x70
[ 3.443396] kernel_init_freeable+0x2a7/0x2f9
[ 3.443396] ? rest_init+0x2c0/0x2c0
[ 3.443396] kernel_init+0x13/0x180
[ 3.443396] ? rest_init+0x2c0/0x2c0
[ 3.443396] ? rest_init+0x2c0/0x2c0
[ 3.443396] ret_from_fork+0x1f/0x30
[ 3.443396] Modules linked in:
[ 3.443396] Dumping ftrace buffer:
[ 3.443396] (ftrace buffer empty)
[ 3.458593] ---[ end trace 3c6f8f0d8ef59bcd ]---
[ 3.458922] RIP: 0010:kfree+0x26a/0x300
[ 3.459198] Code: e8 3a c3 b9 ff e9 d6 fd ff ff 49 8b 45 00 31 db a9 00 00 01 00 75 4d 49 8b 45 00 a9 00 00 01 00 75 0a 49 8b 45 08 a8 01 75 02 <0f> 0b 89 d9 b8 00 10 00 00 be 06 00 00 00 48 d3 e0 f7 d8 48 63 d0
[ 3.460499] RSP: 0000:ffffc90000017b70 EFLAGS: 00010246
[ 3.460870] RAX: dead000000000100 RBX: 0000000000000000 RCX: 0000000000000000
[ 3.461371] RDX: 0000000000000000 RSI: ffffffff85d3df94 RDI: ffffffff85df38e6
[ 3.461873] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000001
[ 3.462372] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888107dc0000
[ 3.462871] R13: ffffea00001f0100 R14: ffff888101a8bf00 R15: ffff888107dc0160
[ 3.463368] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000
[ 3.463949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.464356] CR2: 0000000000000000 CR3: 000000000642e000 CR4: 00000000000006e0
[ 3.464856] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3.465356] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3.465860] Kernel panic - not syncing: Fatal exception
[ 3.466370] Dumping ftrace buffer:
[ 3.466616] (ftrace buffer empty)
[ 3.466871] Kernel Offset: disabled
[ 3.467122] Rebooting in 1 seconds..
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/atm/nicstar.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index b015c3e14336..3a38720acd0e 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -839,10 +839,12 @@ static void ns_init_card_error(ns_dev *card, int error)
dev_kfree_skb_any(hb);
}
if (error >= 12) {
- kfree(card->rsq.org);
+ dma_free_coherent(&card->pcidev->dev, NS_RSQSIZE + NS_RSQ_ALIGNMENT,
+ card->rsq.org, card->rsq.dma);
}
if (error >= 11) {
- kfree(card->tsq.org);
+ dma_free_coherent(&card->pcidev->dev, NS_TSQSIZE + NS_TSQ_ALIGNMENT,
+ card->tsq.org, card->tsq.dma);
}
if (error >= 10) {
free_irq(card->pcidev->irq, card);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 134/266] atm: nicstar: register the interrupt handler in the right place
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 133/266] atm: nicstar: use dma_free_coherent instead of kfree Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 135/266] vsock: notify server to shutdown when client has pending signal Greg Kroah-Hartman
` (135 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheyu Ma, David S. Miller, Sasha Levin
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit 70b639dc41ad499384e41e106fce72e36805c9f2 ]
Because the error handling is sequential, the application of resources
should be carried out in the order of error handling, so the operation
of registering the interrupt handler should be put in front, so as not
to free the unregistered interrupt handler during error handling.
This log reveals it:
[ 3.438724] Trying to free already-free IRQ 23
[ 3.439060] WARNING: CPU: 5 PID: 1 at kernel/irq/manage.c:1825 free_irq+0xfb/0x480
[ 3.440039] Modules linked in:
[ 3.440257] CPU: 5 PID: 1 Comm: swapper/0 Not tainted 5.12.4-g70e7f0549188-dirty #142
[ 3.440793] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 3.441561] RIP: 0010:free_irq+0xfb/0x480
[ 3.441845] Code: 6e 08 74 6f 4d 89 f4 e8 c3 78 09 00 4d 8b 74 24 18 4d 85 f6 75 e3 e8 b4 78 09 00 8b 75 c8 48 c7 c7 a0 ac d5 85 e8 95 d7 f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 87 c5 90 03 48 8b 43 40 4c 8b a0 80
[ 3.443121] RSP: 0000:ffffc90000017b50 EFLAGS: 00010086
[ 3.443483] RAX: 0000000000000000 RBX: ffff888107c6f000 RCX: 0000000000000000
[ 3.443972] RDX: 0000000000000000 RSI: ffffffff8123f301 RDI: 00000000ffffffff
[ 3.444462] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000003
[ 3.444950] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
[ 3.444994] R13: ffff888107dc0000 R14: ffff888104f6bf00 R15: ffff888107c6f0a8
[ 3.444994] FS: 0000000000000000(0000) GS:ffff88817bd40000(0000) knlGS:0000000000000000
[ 3.444994] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.444994] CR2: 0000000000000000 CR3: 000000000642e000 CR4: 00000000000006e0
[ 3.444994] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3.444994] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3.444994] Call Trace:
[ 3.444994] ns_init_card_error+0x18e/0x250
[ 3.444994] nicstar_init_one+0x10d2/0x1130
[ 3.444994] local_pci_probe+0x4a/0xb0
[ 3.444994] pci_device_probe+0x126/0x1d0
[ 3.444994] ? pci_device_remove+0x100/0x100
[ 3.444994] really_probe+0x27e/0x650
[ 3.444994] driver_probe_device+0x84/0x1d0
[ 3.444994] ? mutex_lock_nested+0x16/0x20
[ 3.444994] device_driver_attach+0x63/0x70
[ 3.444994] __driver_attach+0x117/0x1a0
[ 3.444994] ? device_driver_attach+0x70/0x70
[ 3.444994] bus_for_each_dev+0xb6/0x110
[ 3.444994] ? rdinit_setup+0x40/0x40
[ 3.444994] driver_attach+0x22/0x30
[ 3.444994] bus_add_driver+0x1e6/0x2a0
[ 3.444994] driver_register+0xa4/0x180
[ 3.444994] __pci_register_driver+0x77/0x80
[ 3.444994] ? uPD98402_module_init+0xd/0xd
[ 3.444994] nicstar_init+0x1f/0x75
[ 3.444994] do_one_initcall+0x7a/0x3d0
[ 3.444994] ? rdinit_setup+0x40/0x40
[ 3.444994] ? rcu_read_lock_sched_held+0x4a/0x70
[ 3.444994] kernel_init_freeable+0x2a7/0x2f9
[ 3.444994] ? rest_init+0x2c0/0x2c0
[ 3.444994] kernel_init+0x13/0x180
[ 3.444994] ? rest_init+0x2c0/0x2c0
[ 3.444994] ? rest_init+0x2c0/0x2c0
[ 3.444994] ret_from_fork+0x1f/0x30
[ 3.444994] Kernel panic - not syncing: panic_on_warn set ...
[ 3.444994] CPU: 5 PID: 1 Comm: swapper/0 Not tainted 5.12.4-g70e7f0549188-dirty #142
[ 3.444994] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 3.444994] Call Trace:
[ 3.444994] dump_stack+0xba/0xf5
[ 3.444994] ? free_irq+0xfb/0x480
[ 3.444994] panic+0x155/0x3ed
[ 3.444994] ? __warn+0xed/0x150
[ 3.444994] ? free_irq+0xfb/0x480
[ 3.444994] __warn+0x103/0x150
[ 3.444994] ? free_irq+0xfb/0x480
[ 3.444994] report_bug+0x119/0x1c0
[ 3.444994] handle_bug+0x3b/0x80
[ 3.444994] exc_invalid_op+0x18/0x70
[ 3.444994] asm_exc_invalid_op+0x12/0x20
[ 3.444994] RIP: 0010:free_irq+0xfb/0x480
[ 3.444994] Code: 6e 08 74 6f 4d 89 f4 e8 c3 78 09 00 4d 8b 74 24 18 4d 85 f6 75 e3 e8 b4 78 09 00 8b 75 c8 48 c7 c7 a0 ac d5 85 e8 95 d7 f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 87 c5 90 03 48 8b 43 40 4c 8b a0 80
[ 3.444994] RSP: 0000:ffffc90000017b50 EFLAGS: 00010086
[ 3.444994] RAX: 0000000000000000 RBX: ffff888107c6f000 RCX: 0000000000000000
[ 3.444994] RDX: 0000000000000000 RSI: ffffffff8123f301 RDI: 00000000ffffffff
[ 3.444994] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000003
[ 3.444994] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
[ 3.444994] R13: ffff888107dc0000 R14: ffff888104f6bf00 R15: ffff888107c6f0a8
[ 3.444994] ? vprintk_func+0x71/0x110
[ 3.444994] ns_init_card_error+0x18e/0x250
[ 3.444994] nicstar_init_one+0x10d2/0x1130
[ 3.444994] local_pci_probe+0x4a/0xb0
[ 3.444994] pci_device_probe+0x126/0x1d0
[ 3.444994] ? pci_device_remove+0x100/0x100
[ 3.444994] really_probe+0x27e/0x650
[ 3.444994] driver_probe_device+0x84/0x1d0
[ 3.444994] ? mutex_lock_nested+0x16/0x20
[ 3.444994] device_driver_attach+0x63/0x70
[ 3.444994] __driver_attach+0x117/0x1a0
[ 3.444994] ? device_driver_attach+0x70/0x70
[ 3.444994] bus_for_each_dev+0xb6/0x110
[ 3.444994] ? rdinit_setup+0x40/0x40
[ 3.444994] driver_attach+0x22/0x30
[ 3.444994] bus_add_driver+0x1e6/0x2a0
[ 3.444994] driver_register+0xa4/0x180
[ 3.444994] __pci_register_driver+0x77/0x80
[ 3.444994] ? uPD98402_module_init+0xd/0xd
[ 3.444994] nicstar_init+0x1f/0x75
[ 3.444994] do_one_initcall+0x7a/0x3d0
[ 3.444994] ? rdinit_setup+0x40/0x40
[ 3.444994] ? rcu_read_lock_sched_held+0x4a/0x70
[ 3.444994] kernel_init_freeable+0x2a7/0x2f9
[ 3.444994] ? rest_init+0x2c0/0x2c0
[ 3.444994] kernel_init+0x13/0x180
[ 3.444994] ? rest_init+0x2c0/0x2c0
[ 3.444994] ? rest_init+0x2c0/0x2c0
[ 3.444994] ret_from_fork+0x1f/0x30
[ 3.444994] Dumping ftrace buffer:
[ 3.444994] (ftrace buffer empty)
[ 3.444994] Kernel Offset: disabled
[ 3.444994] Rebooting in 1 seconds..
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/atm/nicstar.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 3a38720acd0e..bc5a6ab6fa4b 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -527,6 +527,15 @@ static int ns_init_card(int i, struct pci_dev *pcidev)
/* Set the VPI/VCI MSb mask to zero so we can receive OAM cells */
writel(0x00000000, card->membase + VPM);
+ card->intcnt = 0;
+ if (request_irq
+ (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) {
+ pr_err("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
+ error = 9;
+ ns_init_card_error(card, error);
+ return error;
+ }
+
/* Initialize TSQ */
card->tsq.org = dma_alloc_coherent(&card->pcidev->dev,
NS_TSQSIZE + NS_TSQ_ALIGNMENT,
@@ -753,15 +762,6 @@ static int ns_init_card(int i, struct pci_dev *pcidev)
card->efbie = 1;
- card->intcnt = 0;
- if (request_irq
- (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) {
- printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
- error = 9;
- ns_init_card_error(card, error);
- return error;
- }
-
/* Register device */
card->atmdev = atm_dev_register("nicstar", &card->pcidev->dev, &atm_ops,
-1, NULL);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 135/266] vsock: notify server to shutdown when client has pending signal
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 134/266] atm: nicstar: register the interrupt handler in the right place Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 136/266] drm/amd/display: Fix edp_bootup_bl_level initialization issue Greg Kroah-Hartman
` (134 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David S. Miller, Jakub Kicinski,
Jorgen Hansen, Norbert Slusarek, Andra Paraschiv, Colin Ian King,
David Brazdil, Alexander Popov, Stefano Garzarella, lixianming,
Longpeng(Mike),
Sasha Levin
From: Longpeng(Mike) <longpeng2@huawei.com>
[ Upstream commit c7ff9cff70601ea19245d997bb977344663434c7 ]
The client's sk_state will be set to TCP_ESTABLISHED if the server
replay the client's connect request.
However, if the client has pending signal, its sk_state will be set
to TCP_CLOSE without notify the server, so the server will hold the
corrupt connection.
client server
1. sk_state=TCP_SYN_SENT |
2. call ->connect() |
3. wait reply |
| 4. sk_state=TCP_ESTABLISHED
| 5. insert to connected list
| 6. reply to the client
7. sk_state=TCP_ESTABLISHED |
8. insert to connected list |
9. *signal pending* <--------------------- the user kill client
10. sk_state=TCP_CLOSE |
client is exiting... |
11. call ->release() |
virtio_transport_close
if (!(sk->sk_state == TCP_ESTABLISHED ||
sk->sk_state == TCP_CLOSING))
return true; *return at here, the server cannot notice the connection is corrupt*
So the client should notify the peer in this case.
Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Jorgen Hansen <jhansen@vmware.com>
Cc: Norbert Slusarek <nslusarek@gmx.net>
Cc: Andra Paraschiv <andraprs@amazon.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: David Brazdil <dbrazdil@google.com>
Cc: Alexander Popov <alex.popov@linux.com>
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lkml.org/lkml/2021/5/17/418
Signed-off-by: lixianming <lixianming5@huawei.com>
Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/vmw_vsock/af_vsock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 92a72f0e0d94..ae11311807fd 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1369,7 +1369,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
if (signal_pending(current)) {
err = sock_intr_errno(timeout);
- sk->sk_state = TCP_CLOSE;
+ sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE;
sock->state = SS_UNCONNECTED;
vsock_transport_cancel_pkt(vsk);
goto out_wait;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 136/266] drm/amd/display: Fix edp_bootup_bl_level initialization issue
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 135/266] vsock: notify server to shutdown when client has pending signal Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 137/266] RDMA/rxe: Dont overwrite errno from ib_umem_get() Greg Kroah-Hartman
` (133 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Logush Oliver, Charlene Liu,
Bindu Ramamurthy, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Logush Oliver <ollogush@amd.com>
[ Upstream commit eeb90e26ed05dd44553d557057bf35f08f853af8 ]
[why]
Updating the file to fix the missing line
Signed-off-by: Logush Oliver <ollogush@amd.com>
Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
Acked-by: Bindu Ramamurthy <bindu.r@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
index d79f4fe06c47..4812a72f8aad 100644
--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
@@ -2131,7 +2131,7 @@ static enum bp_result get_integrated_info_v2_1(
info_v2_1->edp1_info.edp_pwr_down_bloff_to_vary_bloff;
info->edp1_info.edp_panel_bpc =
info_v2_1->edp1_info.edp_panel_bpc;
- info->edp1_info.edp_bootup_bl_level =
+ info->edp1_info.edp_bootup_bl_level = info_v2_1->edp1_info.edp_bootup_bl_level;
info->edp2_info.edp_backlight_pwm_hz =
le16_to_cpu(info_v2_1->edp2_info.edp_backlight_pwm_hz);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 137/266] RDMA/rxe: Dont overwrite errno from ib_umem_get()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 136/266] drm/amd/display: Fix edp_bootup_bl_level initialization issue Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 138/266] iwlwifi: mvm: dont change band on bound PHY contexts Greg Kroah-Hartman
` (132 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xiao Yang, Jason Gunthorpe, Sasha Levin
From: Xiao Yang <yangx.jy@fujitsu.com>
[ Upstream commit 20ec0a6d6016aa28b9b3299be18baef1a0f91cd2 ]
rxe_mr_init_user() always returns the fixed -EINVAL when ib_umem_get()
fails so it's hard for user to know which actual error happens in
ib_umem_get(). For example, ib_umem_get() will return -EOPNOTSUPP when
trying to pin pages on a DAX file.
Return actual error as mlx4/mlx5 does.
Link: https://lore.kernel.org/r/20210621071456.4259-1-ice_yangxiao@163.com
Signed-off-by: Xiao Yang <yangx.jy@fujitsu.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_mr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
index 9f63947bab12..fe2b7d223183 100644
--- a/drivers/infiniband/sw/rxe/rxe_mr.c
+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
@@ -135,7 +135,7 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
if (IS_ERR(umem)) {
pr_warn("err %d from rxe_umem_get\n",
(int)PTR_ERR(umem));
- err = -EINVAL;
+ err = PTR_ERR(umem);
goto err1;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 138/266] iwlwifi: mvm: dont change band on bound PHY contexts
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 137/266] RDMA/rxe: Dont overwrite errno from ib_umem_get() Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 139/266] iwlwifi: mvm: apply RX diversity per PHY context Greg Kroah-Hartman
` (131 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 8835a64f74c46baebfc946cd5a2c861b866ebcee ]
When we have a P2P Device active, we attempt to only change the
PHY context it uses when we get a new remain-on-channel, if the
P2P Device is the only user of the PHY context.
This is fine if we're switching within a band, but if we're
switching bands then the switch implies a removal and re-add
of the PHY context, which isn't permitted by the firmware while
it's bound to an interface.
Fix the code to skip the unbind/release/... cycle only if the
band doesn't change (or we have old devices that can switch the
band on the fly as well.)
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210612142637.e9ac313f70f3.I713b9d109957df7e7d9ed0861d5377ce3f8fccd3@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/intel/iwlwifi/mvm/mac80211.c | 24 ++++++++++++++-----
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 607d5d564928..141d9fc299b0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -3800,6 +3800,7 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
struct cfg80211_chan_def chandef;
struct iwl_mvm_phy_ctxt *phy_ctxt;
+ bool band_change_removal;
int ret, i;
IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
@@ -3880,19 +3881,30 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
/*
- * Change the PHY context configuration as it is currently referenced
- * only by the P2P Device MAC
+ * Check if the remain-on-channel is on a different band and that
+ * requires context removal, see iwl_mvm_phy_ctxt_changed(). If
+ * so, we'll need to release and then re-configure here, since we
+ * must not remove a PHY context that's part of a binding.
*/
- if (mvmvif->phy_ctxt->ref == 1) {
+ band_change_removal =
+ fw_has_capa(&mvm->fw->ucode_capa,
+ IWL_UCODE_TLV_CAPA_BINDING_CDB_SUPPORT) &&
+ mvmvif->phy_ctxt->channel->band != chandef.chan->band;
+
+ if (mvmvif->phy_ctxt->ref == 1 && !band_change_removal) {
+ /*
+ * Change the PHY context configuration as it is currently
+ * referenced only by the P2P Device MAC (and we can modify it)
+ */
ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
&chandef, 1, 1);
if (ret)
goto out_unlock;
} else {
/*
- * The PHY context is shared with other MACs. Need to remove the
- * P2P Device from the binding, allocate an new PHY context and
- * create a new binding
+ * The PHY context is shared with other MACs (or we're trying to
+ * switch bands), so remove the P2P Device from the binding,
+ * allocate an new PHY context and create a new binding.
*/
phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
if (!phy_ctxt) {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 139/266] iwlwifi: mvm: apply RX diversity per PHY context
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 138/266] iwlwifi: mvm: dont change band on bound PHY contexts Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 140/266] iwlwifi: mvm: fix error print when session protection ends Greg Kroah-Hartman
` (130 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit a171399fd687a7d2fa56a10c9a2d7084a647677d ]
SMPS requests may differ per interfaces due to e.g. Bluetooth
only interfering on 2.4 GHz, so if that's the case we should,
in the case of multiple PHY contexts, still allow RX diversity
on PHY context that have no interfaces with SMPS requests.
Fix the code to pass through the PHY context in question and
skip interfaces with non-matching PHY context while iterating.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210617100544.123c6b05809d.I992e3d1c6a29850d02eeec01712b5b685b963a87@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 3 +-
.../net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 15 ++++++----
.../net/wireless/intel/iwlwifi/mvm/utils.c | 28 ++++++++++++++-----
3 files changed, 32 insertions(+), 14 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 4d9d4d6892fc..02cf52133857 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1827,7 +1827,8 @@ int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
enum iwl_mvm_smps_type_request req_type,
enum ieee80211_smps_mode smps_request);
-bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm);
+bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm,
+ struct iwl_mvm_phy_ctxt *ctxt);
/* Low latency */
int iwl_mvm_update_low_latency(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
index 0fd51f6aa206..4ed2338027d1 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2012-2014, 2018-2020 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2021 Intel Corporation
* Copyright (C) 2013-2014 Intel Mobile Communications GmbH
* Copyright (C) 2017 Intel Deutschland GmbH
*/
@@ -76,6 +76,7 @@ static void iwl_mvm_phy_ctxt_cmd_hdr(struct iwl_mvm_phy_ctxt *ctxt,
}
static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm,
+ struct iwl_mvm_phy_ctxt *ctxt,
__le32 *rxchain_info,
u8 chains_static,
u8 chains_dynamic)
@@ -93,7 +94,7 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm,
* between the two antennas is sufficiently different to impact
* performance.
*/
- if (active_cnt == 1 && iwl_mvm_rx_diversity_allowed(mvm)) {
+ if (active_cnt == 1 && iwl_mvm_rx_diversity_allowed(mvm, ctxt)) {
idle_cnt = 2;
active_cnt = 2;
}
@@ -113,6 +114,7 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm,
* Add the phy configuration to the PHY context command
*/
static void iwl_mvm_phy_ctxt_cmd_data_v1(struct iwl_mvm *mvm,
+ struct iwl_mvm_phy_ctxt *ctxt,
struct iwl_phy_context_cmd_v1 *cmd,
struct cfg80211_chan_def *chandef,
u8 chains_static, u8 chains_dynamic)
@@ -123,7 +125,7 @@ static void iwl_mvm_phy_ctxt_cmd_data_v1(struct iwl_mvm *mvm,
/* Set the channel info data */
iwl_mvm_set_chan_info_chandef(mvm, &cmd->ci, chandef);
- iwl_mvm_phy_ctxt_set_rxchain(mvm, &tail->rxchain_info,
+ iwl_mvm_phy_ctxt_set_rxchain(mvm, ctxt, &tail->rxchain_info,
chains_static, chains_dynamic);
tail->txchain_info = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
@@ -133,6 +135,7 @@ static void iwl_mvm_phy_ctxt_cmd_data_v1(struct iwl_mvm *mvm,
* Add the phy configuration to the PHY context command
*/
static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
+ struct iwl_mvm_phy_ctxt *ctxt,
struct iwl_phy_context_cmd *cmd,
struct cfg80211_chan_def *chandef,
u8 chains_static, u8 chains_dynamic)
@@ -143,7 +146,7 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
/* Set the channel info data */
iwl_mvm_set_chan_info_chandef(mvm, &cmd->ci, chandef);
- iwl_mvm_phy_ctxt_set_rxchain(mvm, &cmd->rxchain_info,
+ iwl_mvm_phy_ctxt_set_rxchain(mvm, ctxt, &cmd->rxchain_info,
chains_static, chains_dynamic);
}
@@ -170,7 +173,7 @@ static int iwl_mvm_phy_ctxt_apply(struct iwl_mvm *mvm,
iwl_mvm_phy_ctxt_cmd_hdr(ctxt, &cmd, action);
/* Set the command data */
- iwl_mvm_phy_ctxt_cmd_data(mvm, &cmd, chandef,
+ iwl_mvm_phy_ctxt_cmd_data(mvm, ctxt, &cmd, chandef,
chains_static,
chains_dynamic);
@@ -186,7 +189,7 @@ static int iwl_mvm_phy_ctxt_apply(struct iwl_mvm *mvm,
action);
/* Set the command data */
- iwl_mvm_phy_ctxt_cmd_data_v1(mvm, &cmd, chandef,
+ iwl_mvm_phy_ctxt_cmd_data_v1(mvm, ctxt, &cmd, chandef,
chains_static,
chains_dynamic);
ret = iwl_mvm_send_cmd_pdu(mvm, PHY_CONTEXT_CMD,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
index c566be99a4c7..a89eb7c40ee7 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
@@ -683,23 +683,37 @@ void iwl_mvm_accu_radio_stats(struct iwl_mvm *mvm)
mvm->accu_radio_stats.on_time_scan += mvm->radio_stats.on_time_scan;
}
+struct iwl_mvm_diversity_iter_data {
+ struct iwl_mvm_phy_ctxt *ctxt;
+ bool result;
+};
+
static void iwl_mvm_diversity_iter(void *_data, u8 *mac,
struct ieee80211_vif *vif)
{
struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
- bool *result = _data;
+ struct iwl_mvm_diversity_iter_data *data = _data;
int i;
+ if (mvmvif->phy_ctxt != data->ctxt)
+ return;
+
for (i = 0; i < NUM_IWL_MVM_SMPS_REQ; i++) {
if (mvmvif->smps_requests[i] == IEEE80211_SMPS_STATIC ||
- mvmvif->smps_requests[i] == IEEE80211_SMPS_DYNAMIC)
- *result = false;
+ mvmvif->smps_requests[i] == IEEE80211_SMPS_DYNAMIC) {
+ data->result = false;
+ break;
+ }
}
}
-bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
+bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm,
+ struct iwl_mvm_phy_ctxt *ctxt)
{
- bool result = true;
+ struct iwl_mvm_diversity_iter_data data = {
+ .ctxt = ctxt,
+ .result = true,
+ };
lockdep_assert_held(&mvm->mutex);
@@ -711,9 +725,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
ieee80211_iterate_active_interfaces_atomic(
mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
- iwl_mvm_diversity_iter, &result);
+ iwl_mvm_diversity_iter, &data);
- return result;
+ return data.result;
}
void iwl_mvm_send_low_latency_cmd(struct iwl_mvm *mvm,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 140/266] iwlwifi: mvm: fix error print when session protection ends
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 139/266] iwlwifi: mvm: apply RX diversity per PHY context Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 141/266] iwlwifi: pcie: free IML DMA memory allocation Greg Kroah-Hartman
` (129 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shaul Triebitz, Luca Coelho, Sasha Levin
From: Shaul Triebitz <shaul.triebitz@intel.com>
[ Upstream commit 976ac0af7ba2c5424bc305b926c0807d96fdcc83 ]
When the session protection ends and the Driver is not
associated or a beacon was not heard, the Driver
prints "No beacons heard...".
That's confusing for the case where not associated.
Change the print when not associated to "Not associated...".
Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210617100544.41a5a5a894fa.I9eabb76e7a3a7f4abbed8f2ef918f1df8e825726@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 83342a6a6d5b..f19081a6f046 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -310,6 +310,8 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
* and know the dtim period.
*/
iwl_mvm_te_check_disconnect(mvm, te_data->vif,
+ !te_data->vif->bss_conf.assoc ?
+ "Not associated and the time event is over already..." :
"No beacon heard and the time event is over already...");
break;
default:
@@ -808,6 +810,8 @@ void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,
* and know the dtim period.
*/
iwl_mvm_te_check_disconnect(mvm, vif,
+ !vif->bss_conf.assoc ?
+ "Not associated and the session protection is over already..." :
"No beacon heard and the session protection is over already...");
spin_lock_bh(&mvm->time_event_lock);
iwl_mvm_te_clear_data(mvm, te_data);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 141/266] iwlwifi: pcie: free IML DMA memory allocation
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 140/266] iwlwifi: mvm: fix error print when session protection ends Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 142/266] iwlwifi: pcie: fix context info freeing Greg Kroah-Hartman
` (128 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 310f60f53a86eba680d9bc20a371e13b06a5f903 ]
In the case of gen3 devices with image loader (IML) support,
we were leaking the IML DMA allocation and never freeing it.
Fix that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210618105614.07e117dbedb7.I7bb9ebbe0617656986c2a598ea5e827b533bd3b9@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 15 ++++++++++-----
.../net/wireless/intel/iwlwifi/pcie/internal.h | 3 +++
2 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
index cecc32e7dbe8..2dbc51daa2f8 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
@@ -79,7 +79,6 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
struct iwl_prph_scratch *prph_scratch;
struct iwl_prph_scratch_ctrl_cfg *prph_sc_ctrl;
struct iwl_prph_info *prph_info;
- void *iml_img;
u32 control_flags = 0;
int ret;
int cmdq_size = max_t(u32, IWL_CMD_QUEUE_SIZE,
@@ -187,14 +186,15 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
trans_pcie->prph_scratch = prph_scratch;
/* Allocate IML */
- iml_img = dma_alloc_coherent(trans->dev, trans->iml_len,
- &trans_pcie->iml_dma_addr, GFP_KERNEL);
- if (!iml_img) {
+ trans_pcie->iml = dma_alloc_coherent(trans->dev, trans->iml_len,
+ &trans_pcie->iml_dma_addr,
+ GFP_KERNEL);
+ if (!trans_pcie->iml) {
ret = -ENOMEM;
goto err_free_ctxt_info;
}
- memcpy(iml_img, trans->iml, trans->iml_len);
+ memcpy(trans_pcie->iml, trans->iml, trans->iml_len);
iwl_enable_fw_load_int_ctx_info(trans);
@@ -243,6 +243,11 @@ void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans)
trans_pcie->ctxt_info_dma_addr = 0;
trans_pcie->ctxt_info_gen3 = NULL;
+ dma_free_coherent(trans->dev, trans->iml_len, trans_pcie->iml,
+ trans_pcie->iml_dma_addr);
+ trans_pcie->iml_dma_addr = 0;
+ trans_pcie->iml = NULL;
+
iwl_pcie_ctxt_info_free_fw_img(trans);
dma_free_coherent(trans->dev, sizeof(*trans_pcie->prph_scratch),
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index 76a512cd2e5c..3f7cfbf707fd 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -279,6 +279,8 @@ struct cont_rec {
* Context information addresses will be taken from here.
* This is driver's local copy for keeping track of size and
* count for allocating and freeing the memory.
+ * @iml: image loader image virtual address
+ * @iml_dma_addr: image loader image DMA address
* @trans: pointer to the generic transport area
* @scd_base_addr: scheduler sram base address in SRAM
* @kw: keep warm address
@@ -329,6 +331,7 @@ struct iwl_trans_pcie {
};
struct iwl_prph_info *prph_info;
struct iwl_prph_scratch *prph_scratch;
+ void *iml;
dma_addr_t ctxt_info_dma_addr;
dma_addr_t prph_info_dma_addr;
dma_addr_t prph_scratch_dma_addr;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 142/266] iwlwifi: pcie: fix context info freeing
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 141/266] iwlwifi: pcie: free IML DMA memory allocation Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 143/266] rtw88: 8822c: update RF parameter tables to v62 Greg Kroah-Hartman
` (127 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 26d18c75a7496c4c52b0b6789e713dc76ebfbc87 ]
After firmware alive, iwl_trans_pcie_gen2_fw_alive() is called
to free the context info. However, on gen3 that will then free
the context info with the wrong size.
Since we free this allocation later, let it stick around until
the device is stopped for now, freeing some of it earlier is a
separate change.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210618105614.afb63fb8cbc1.If4968db8e09f4ce2a1d27a6d750bca3d132d7d70@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
index 1bcd36e9e008..9ce195d80c51 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
@@ -254,7 +254,8 @@ void iwl_trans_pcie_gen2_fw_alive(struct iwl_trans *trans, u32 scd_addr)
/* now that we got alive we can free the fw image & the context info.
* paging memory cannot be freed included since FW will still use it
*/
- iwl_pcie_ctxt_info_free(trans);
+ if (trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_AX210)
+ iwl_pcie_ctxt_info_free(trans);
/*
* Re-enable all the interrupts, including the RF-Kill one, now that
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 143/266] rtw88: 8822c: update RF parameter tables to v62
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 142/266] iwlwifi: pcie: fix context info freeing Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 144/266] rtw88: add quirks to disable pci capabilities Greg Kroah-Hartman
` (126 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Po-Hao Huang, Ping-Ke Shih,
Kalle Valo, Sasha Levin
From: Po-Hao Huang <phhuang@realtek.com>
[ Upstream commit 7a1baaaee6c866455c9c77bf9b0405941a3678c7 ]
Update RTL8822C devices' RF tables to v62.
This fixes higher than expected spur in 2400 MHz under CCK mask.
Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210506083643.18317-1-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../wireless/realtek/rtw88/rtw8822c_table.c | 1008 ++++++++---------
1 file changed, 504 insertions(+), 504 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c_table.c b/drivers/net/wireless/realtek/rtw88/rtw8822c_table.c
index 822f3da91f1b..f9e3d0779c59 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822c_table.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c_table.c
@@ -16812,53 +16812,53 @@ static const u32 rtw8822c_rf_a[] = {
0x92000002, 0x00000000, 0x40000000, 0x00000000,
0x03F, 0x00010E46,
0x93000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x93000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x93000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x93000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x93000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x93000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x93000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x93000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x94000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x94000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x94000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x94000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x94000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x94000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x94000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x94000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x95000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x95000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x95000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x95000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x95000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x95000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x95000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0x95000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00030246,
+ 0x03F, 0x0003D646,
0xA0000000, 0x00000000,
0x03F, 0x00002A46,
0xB0000000, 0x00000000,
@@ -18762,53 +18762,53 @@ static const u32 rtw8822c_rf_a[] = {
0x92000002, 0x00000000, 0x40000000, 0x00000000,
0x03F, 0x0000EA46,
0x93000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0xA0000000, 0x00000000,
0x03F, 0x00002A46,
0xB0000000, 0x00000000,
@@ -18957,53 +18957,53 @@ static const u32 rtw8822c_rf_a[] = {
0x92000002, 0x00000000, 0x40000000, 0x00000000,
0x03F, 0x0000EA46,
0x93000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0xA0000000, 0x00000000,
0x03F, 0x00002A46,
0xB0000000, 0x00000000,
@@ -19152,53 +19152,53 @@ static const u32 rtw8822c_rf_a[] = {
0x92000002, 0x00000000, 0x40000000, 0x00000000,
0x03F, 0x0000EA46,
0x93000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0xA0000000, 0x00000000,
0x03F, 0x00002A46,
0xB0000000, 0x00000000,
@@ -19347,53 +19347,53 @@ static const u32 rtw8822c_rf_a[] = {
0x92000002, 0x00000000, 0x40000000, 0x00000000,
0x03F, 0x0000EA46,
0x93000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x93000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x94000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000001, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000002, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000003, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000004, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000005, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000006, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000015, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0x95000016, 0x00000000, 0x40000000, 0x00000000,
- 0x03F, 0x00031E46,
+ 0x03F, 0x0003D646,
0xA0000000, 0x00000000,
0x03F, 0x00002A46,
0xB0000000, 0x00000000,
@@ -19610,21 +19610,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000002, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19633,21 +19633,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000003, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19656,21 +19656,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000004, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19679,21 +19679,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000005, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19702,21 +19702,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000006, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19725,21 +19725,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000015, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19748,21 +19748,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000016, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19771,21 +19771,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000001, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19794,21 +19794,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000002, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19817,21 +19817,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000003, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19840,21 +19840,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000004, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19863,21 +19863,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000005, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19886,21 +19886,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000006, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19909,21 +19909,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000015, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19932,21 +19932,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000016, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19955,21 +19955,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000001, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -19978,21 +19978,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000002, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -20001,21 +20001,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000003, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -20024,21 +20024,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000004, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -20047,21 +20047,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000005, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -20070,21 +20070,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000006, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -20093,21 +20093,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000015, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -20116,21 +20116,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000016, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -20139,21 +20139,21 @@ static const u32 rtw8822c_rf_a[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x000008C8,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x000008CB,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x000008CE,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x000008D1,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x000008D4,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000DD1,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0xA0000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000487,
@@ -38484,21 +38484,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000002, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38507,21 +38507,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000003, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38530,21 +38530,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000004, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38553,21 +38553,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000005, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38576,21 +38576,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000006, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38599,21 +38599,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000015, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38622,21 +38622,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x93000016, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38645,21 +38645,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000001, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38668,21 +38668,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000002, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38691,21 +38691,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000003, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38714,21 +38714,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000004, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38737,21 +38737,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000005, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38760,21 +38760,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000006, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38783,21 +38783,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000015, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38806,21 +38806,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x94000016, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38829,21 +38829,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000001, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38852,21 +38852,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000002, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38875,21 +38875,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000003, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38898,21 +38898,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000004, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38921,21 +38921,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000005, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38944,21 +38944,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000006, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38967,21 +38967,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000015, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -38990,21 +38990,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0x95000016, 0x00000000, 0x40000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000467,
@@ -39013,21 +39013,21 @@ static const u32 rtw8822c_rf_b[] = {
0x033, 0x00000062,
0x03F, 0x00000908,
0x033, 0x00000063,
- 0x03F, 0x00000D09,
+ 0x03F, 0x00000CC6,
0x033, 0x00000064,
- 0x03F, 0x00000D49,
+ 0x03F, 0x00000CC9,
0x033, 0x00000065,
- 0x03F, 0x00000D8A,
+ 0x03F, 0x00000CCC,
0x033, 0x00000066,
- 0x03F, 0x00000DEB,
+ 0x03F, 0x00000CCF,
0x033, 0x00000067,
- 0x03F, 0x00000DEE,
+ 0x03F, 0x00000CD2,
0x033, 0x00000068,
- 0x03F, 0x00000DF1,
+ 0x03F, 0x00000CD5,
0x033, 0x00000069,
- 0x03F, 0x00000DF4,
+ 0x03F, 0x00000DD4,
0x033, 0x0000006A,
- 0x03F, 0x00000DF7,
+ 0x03F, 0x00000DD7,
0xA0000000, 0x00000000,
0x033, 0x00000060,
0x03F, 0x00000487,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 144/266] rtw88: add quirks to disable pci capabilities
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 143/266] rtw88: 8822c: update RF parameter tables to v62 Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 145/266] sfc: avoid double pci_remove of VFs Greg Kroah-Hartman
` (125 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Szabo, Ping-Ke Shih, Kalle Valo,
Sasha Levin
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit 956c6d4f20c5446727e0c912dd8f527f2dc7b779 ]
8821CE with ASPM cannot work properly on Protempo Ltd L116HTN6SPW. Add a
quirk to disable the cap.
The reporter describes the symptom is that this module (driver) causes
frequent freezes, randomly but usually within a few minutes of running
(thus very soon after boot): screen display remains frozen, no response
to either keyboard or mouse input. All I can do is to hold the power
button to power off, then reboot.
Reported-by: Paul Szabo <psz2036@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210607012254.6306-1-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/pci.c | 32 ++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
index f59a4c462e3b..e7d17ab8f113 100644
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -2,6 +2,7 @@
/* Copyright(c) 2018-2019 Realtek Corporation
*/
+#include <linux/dmi.h>
#include <linux/module.h>
#include <linux/pci.h>
#include "main.h"
@@ -1673,6 +1674,36 @@ static void rtw_pci_napi_deinit(struct rtw_dev *rtwdev)
netif_napi_del(&rtwpci->napi);
}
+enum rtw88_quirk_dis_pci_caps {
+ QUIRK_DIS_PCI_CAP_MSI,
+ QUIRK_DIS_PCI_CAP_ASPM,
+};
+
+static int disable_pci_caps(const struct dmi_system_id *dmi)
+{
+ uintptr_t dis_caps = (uintptr_t)dmi->driver_data;
+
+ if (dis_caps & BIT(QUIRK_DIS_PCI_CAP_MSI))
+ rtw_disable_msi = true;
+ if (dis_caps & BIT(QUIRK_DIS_PCI_CAP_ASPM))
+ rtw_pci_disable_aspm = true;
+
+ return 1;
+}
+
+static const struct dmi_system_id rtw88_pci_quirks[] = {
+ {
+ .callback = disable_pci_caps,
+ .ident = "Protempo Ltd L116HTN6SPW",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Protempo Ltd"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "L116HTN6SPW"),
+ },
+ .driver_data = (void *)BIT(QUIRK_DIS_PCI_CAP_ASPM),
+ },
+ {}
+};
+
int rtw_pci_probe(struct pci_dev *pdev,
const struct pci_device_id *id)
{
@@ -1723,6 +1754,7 @@ int rtw_pci_probe(struct pci_dev *pdev,
goto err_destroy_pci;
}
+ dmi_check_system(rtw88_pci_quirks);
rtw_pci_phy_cfg(rtwdev);
ret = rtw_register_hw(rtwdev, hw);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 145/266] sfc: avoid double pci_remove of VFs
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 144/266] rtw88: add quirks to disable pci capabilities Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 146/266] sfc: error code if SRIOV cannot be disabled Greg Kroah-Hartman
` (124 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Íñigo Huguet,
David S. Miller, Sasha Levin
From: Íñigo Huguet <ihuguet@redhat.com>
[ Upstream commit 45423cff1db66cf0993e8a9bd0ac93e740149e49 ]
If pci_remove was called for a PF with VFs, the removal of the VFs was
called twice from efx_ef10_sriov_fini: one directly with pci_driver->remove
and another implicit by calling pci_disable_sriov, which also perform
the VFs remove. This was leading to crashing the kernel on the second
attempt.
Given that pci_disable_sriov already calls to pci remove function, get
rid of the direct call to pci_driver->remove from the driver.
2 different ways to trigger the bug:
- Create one or more VFs, then attach the PF to a virtual machine (at
least with qemu/KVM)
- Create one or more VFs, then remove the PF with:
echo 1 > /sys/bus/pci/devices/PF_PCI_ID/remove
Removing sfc module does not trigger the error, at least for me, because
it removes the VF first, and then the PF.
Example of a log with the error:
list_del corruption, ffff967fd20a8ad0->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:47!
[...trimmed...]
RIP: 0010:__list_del_entry_valid.cold.1+0x12/0x4c
[...trimmed...]
Call Trace:
efx_dissociate+0x1f/0x140 [sfc]
efx_pci_remove+0x27/0x150 [sfc]
pci_device_remove+0x3b/0xc0
device_release_driver_internal+0x103/0x1f0
pci_stop_bus_device+0x69/0x90
pci_stop_and_remove_bus_device+0xe/0x20
pci_iov_remove_virtfn+0xba/0x120
sriov_disable+0x2f/0xe0
efx_ef10_pci_sriov_disable+0x52/0x80 [sfc]
? pcie_aer_is_native+0x12/0x40
efx_ef10_sriov_fini+0x72/0x110 [sfc]
efx_pci_remove+0x62/0x150 [sfc]
pci_device_remove+0x3b/0xc0
device_release_driver_internal+0x103/0x1f0
unbind_store+0xf6/0x130
kernfs_fop_write+0x116/0x190
vfs_write+0xa5/0x1a0
ksys_write+0x4f/0xb0
do_syscall_64+0x5b/0x1a0
entry_SYSCALL_64_after_hwframe+0x65/0xca
Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sfc/ef10_sriov.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
index 21fa6c0e8873..a5d28b0f75ba 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.c
+++ b/drivers/net/ethernet/sfc/ef10_sriov.c
@@ -439,7 +439,6 @@ int efx_ef10_sriov_init(struct efx_nic *efx)
void efx_ef10_sriov_fini(struct efx_nic *efx)
{
struct efx_ef10_nic_data *nic_data = efx->nic_data;
- unsigned int i;
int rc;
if (!nic_data->vf) {
@@ -449,14 +448,7 @@ void efx_ef10_sriov_fini(struct efx_nic *efx)
return;
}
- /* Remove any VFs in the host */
- for (i = 0; i < efx->vf_count; ++i) {
- struct efx_nic *vf_efx = nic_data->vf[i].efx;
-
- if (vf_efx)
- vf_efx->pci_dev->driver->remove(vf_efx->pci_dev);
- }
-
+ /* Disable SRIOV and remove any VFs in the host */
rc = efx_ef10_pci_sriov_disable(efx, true);
if (rc)
netif_dbg(efx, drv, efx->net_dev,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 146/266] sfc: error code if SRIOV cannot be disabled
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 145/266] sfc: avoid double pci_remove of VFs Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 147/266] wireless: wext-spy: Fix out-of-bounds warning Greg Kroah-Hartman
` (123 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Íñigo Huguet,
David S. Miller, Sasha Levin
From: Íñigo Huguet <ihuguet@redhat.com>
[ Upstream commit 1ebe4feb8b442884f5a28d2437040096723dd1ea ]
If SRIOV cannot be disabled during device removal or module unloading,
return error code so it can be logged properly in the calling function.
Note that this can only happen if any VF is currently attached to a
guest using Xen, but not with vfio/KVM. Despite that in that case the
VFs won't work properly with PF removed and/or the module unloaded, I
have let it as is because I don't know what side effects may have
changing it, and also it seems to be the same that other drivers are
doing in this situation.
In the case of being called during SRIOV reconfiguration, the behavior
hasn't changed because the function is called with force=false.
Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sfc/ef10_sriov.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
index a5d28b0f75ba..84041cd587d7 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.c
+++ b/drivers/net/ethernet/sfc/ef10_sriov.c
@@ -402,12 +402,17 @@ fail1:
return rc;
}
+/* Disable SRIOV and remove VFs
+ * If some VFs are attached to a guest (using Xen, only) nothing is
+ * done if force=false, and vports are freed if force=true (for the non
+ * attachedc ones, only) but SRIOV is not disabled and VFs are not
+ * removed in either case.
+ */
static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force)
{
struct pci_dev *dev = efx->pci_dev;
- unsigned int vfs_assigned = 0;
-
- vfs_assigned = pci_vfs_assigned(dev);
+ unsigned int vfs_assigned = pci_vfs_assigned(dev);
+ int rc = 0;
if (vfs_assigned && !force) {
netif_info(efx, drv, efx->net_dev, "VFs are assigned to guests; "
@@ -417,10 +422,12 @@ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force)
if (!vfs_assigned)
pci_disable_sriov(dev);
+ else
+ rc = -EBUSY;
efx_ef10_sriov_free_vf_vswitching(efx);
efx->vf_count = 0;
- return 0;
+ return rc;
}
int efx_ef10_sriov_configure(struct efx_nic *efx, int num_vfs)
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 147/266] wireless: wext-spy: Fix out-of-bounds warning
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 146/266] sfc: error code if SRIOV cannot be disabled Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 148/266] cfg80211: fix default HE tx bitrate mask in 2G band Greg Kroah-Hartman
` (122 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot,
Gustavo A. R. Silva, Kees Cook, Johannes Berg, Sasha Levin
From: Gustavo A. R. Silva <gustavoars@kernel.org>
[ Upstream commit e93bdd78406da9ed01554c51e38b2a02c8ef8025 ]
Fix the following out-of-bounds warning:
net/wireless/wext-spy.c:178:2: warning: 'memcpy' offset [25, 28] from the object at 'threshold' is out of the bounds of referenced subobject 'low' with type 'struct iw_quality' at offset 20 [-Warray-bounds]
The problem is that the original code is trying to copy data into a
couple of struct members adjacent to each other in a single call to
memcpy(). This causes a legitimate compiler warning because memcpy()
overruns the length of &threshold.low and &spydata->spy_thr_low. As
these are just a couple of struct members, fix this by using direct
assignments, instead of memcpy().
This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().
Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210422200032.GA168995@embeddedor
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/wext-spy.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
index 33bef22e44e9..b379a0371653 100644
--- a/net/wireless/wext-spy.c
+++ b/net/wireless/wext-spy.c
@@ -120,8 +120,8 @@ int iw_handler_set_thrspy(struct net_device * dev,
return -EOPNOTSUPP;
/* Just do it */
- memcpy(&(spydata->spy_thr_low), &(threshold->low),
- 2 * sizeof(struct iw_quality));
+ spydata->spy_thr_low = threshold->low;
+ spydata->spy_thr_high = threshold->high;
/* Clear flag */
memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
@@ -147,8 +147,8 @@ int iw_handler_get_thrspy(struct net_device * dev,
return -EOPNOTSUPP;
/* Just do it */
- memcpy(&(threshold->low), &(spydata->spy_thr_low),
- 2 * sizeof(struct iw_quality));
+ threshold->low = spydata->spy_thr_low;
+ threshold->high = spydata->spy_thr_high;
return 0;
}
@@ -173,10 +173,10 @@ static void iw_send_thrspy_event(struct net_device * dev,
memcpy(threshold.addr.sa_data, address, ETH_ALEN);
threshold.addr.sa_family = ARPHRD_ETHER;
/* Copy stats */
- memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
+ threshold.qual = *wstats;
/* Copy also thresholds */
- memcpy(&(threshold.low), &(spydata->spy_thr_low),
- 2 * sizeof(struct iw_quality));
+ threshold.low = spydata->spy_thr_low;
+ threshold.high = spydata->spy_thr_high;
/* Send event to user space */
wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 148/266] cfg80211: fix default HE tx bitrate mask in 2G band
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 147/266] wireless: wext-spy: Fix out-of-bounds warning Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 149/266] mac80211: consider per-CPU statistics if present Greg Kroah-Hartman
` (121 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ping-Ke Shih, Johannes Berg, Sasha Levin
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit 9df66d5b9f45c39b3925d16e8947cc10009b186d ]
In 2G band, a HE sta can only supports HT and HE, but not supports VHT.
In this case, default HE tx bitrate mask isn't filled, when we use iw to
set bitrates without any parameter.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://lore.kernel.org/r/20210609075944.51130-1-pkshih@realtek.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/nl80211.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index fc9286afe3c9..912977bf3ec8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4781,11 +4781,10 @@ static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
sband->ht_cap.mcs.rx_mask,
sizeof(mask->control[i].ht_mcs));
- if (!sband->vht_cap.vht_supported)
- continue;
-
- vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
- vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
+ if (sband->vht_cap.vht_supported) {
+ vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
+ vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
+ }
he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
if (!he_cap)
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 149/266] mac80211: consider per-CPU statistics if present
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 148/266] cfg80211: fix default HE tx bitrate mask in 2G band Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 150/266] mac80211_hwsim: add concurrent channels scanning support over virtio Greg Kroah-Hartman
` (120 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thiraviyam Mariyappan, Johannes Berg,
Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit d656a4c6ead6c3f252b2f2532bc9735598f7e317 ]
If we have been keeping per-CPU statistics, consider them
regardless of USES_RSS, because we may not actually fill
those, for example in non-fast-RX cases when the connection
is not compatible with fast-RX. If we didn't fill them, the
additional data will be zero and not affect anything, and
if we did fill them then it's more correct to consider them.
This fixes an issue in mesh mode where some statistics are
not updated due to USES_RSS being set, but fast-RX isn't
used.
Reported-by: Thiraviyam Mariyappan <tmariyap@codeaurora.org>
Link: https://lore.kernel.org/r/20210610220814.13b35f5797c5.I511e9b33c5694e0d6cef4b6ae755c873d7c22124@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/sta_info.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 13250cadb420..e18c3855f616 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2088,10 +2088,9 @@ static struct ieee80211_sta_rx_stats *
sta_get_last_rx_stats(struct sta_info *sta)
{
struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
- struct ieee80211_local *local = sta->local;
int cpu;
- if (!ieee80211_hw_check(&local->hw, USES_RSS))
+ if (!sta->pcpu_rx_stats)
return stats;
for_each_possible_cpu(cpu) {
@@ -2191,9 +2190,7 @@ static void sta_set_tidstats(struct sta_info *sta,
int cpu;
if (!(tidstats->filled & BIT(NL80211_TID_STATS_RX_MSDU))) {
- if (!ieee80211_hw_check(&local->hw, USES_RSS))
- tidstats->rx_msdu +=
- sta_get_tidstats_msdu(&sta->rx_stats, tid);
+ tidstats->rx_msdu += sta_get_tidstats_msdu(&sta->rx_stats, tid);
if (sta->pcpu_rx_stats) {
for_each_possible_cpu(cpu) {
@@ -2272,7 +2269,6 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
sinfo->rx_beacon = sdata->u.mgd.count_beacon_signal;
drv_sta_statistics(local, sdata, &sta->sta, sinfo);
-
sinfo->filled |= BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME) |
BIT_ULL(NL80211_STA_INFO_STA_FLAGS) |
BIT_ULL(NL80211_STA_INFO_BSS_PARAM) |
@@ -2307,8 +2303,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
if (!(sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES64) |
BIT_ULL(NL80211_STA_INFO_RX_BYTES)))) {
- if (!ieee80211_hw_check(&local->hw, USES_RSS))
- sinfo->rx_bytes += sta_get_stats_bytes(&sta->rx_stats);
+ sinfo->rx_bytes += sta_get_stats_bytes(&sta->rx_stats);
if (sta->pcpu_rx_stats) {
for_each_possible_cpu(cpu) {
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 150/266] mac80211_hwsim: add concurrent channels scanning support over virtio
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 149/266] mac80211: consider per-CPU statistics if present Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 151/266] mac80211: Properly WARN on HW scan before restart Greg Kroah-Hartman
` (119 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Weilun Du, Johannes Berg, Sasha Levin
From: Weilun Du <wdu@google.com>
[ Upstream commit 626c30f9e77354301ff9162c3bdddaf92d9b5cf3 ]
This fixed the crash when setting channels to 2 or more when
communicating over virtio.
Signed-off-by: Weilun Du <wdu@google.com>
Link: https://lore.kernel.org/r/20210506180530.3418576-1-wdu@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mac80211_hwsim.c | 48 +++++++++++++++++++++------
1 file changed, 38 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 7a6fd46d0c6e..ceb089e4a136 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -626,6 +626,7 @@ struct mac80211_hwsim_data {
u32 ciphers[ARRAY_SIZE(hwsim_ciphers)];
struct mac_address addresses[2];
+ struct ieee80211_chanctx_conf *chanctx;
int channels, idx;
bool use_chanctx;
bool destroy_on_close;
@@ -1257,7 +1258,8 @@ static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)
static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
struct sk_buff *my_skb,
- int dst_portid)
+ int dst_portid,
+ struct ieee80211_channel *channel)
{
struct sk_buff *skb;
struct mac80211_hwsim_data *data = hw->priv;
@@ -1312,7 +1314,7 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
goto nla_put_failure;
- if (nla_put_u32(skb, HWSIM_ATTR_FREQ, data->channel->center_freq))
+ if (nla_put_u32(skb, HWSIM_ATTR_FREQ, channel->center_freq))
goto nla_put_failure;
/* We get the tx control (rate and retries) info*/
@@ -1659,7 +1661,7 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
_portid = READ_ONCE(data->wmediumd);
if (_portid || hwsim_virtio_enabled)
- return mac80211_hwsim_tx_frame_nl(hw, skb, _portid);
+ return mac80211_hwsim_tx_frame_nl(hw, skb, _portid, channel);
/* NO wmediumd detected, perfect medium simulation */
data->tx_pkts++;
@@ -1775,7 +1777,7 @@ static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
mac80211_hwsim_monitor_rx(hw, skb, chan);
if (_pid || hwsim_virtio_enabled)
- return mac80211_hwsim_tx_frame_nl(hw, skb, _pid);
+ return mac80211_hwsim_tx_frame_nl(hw, skb, _pid, chan);
mac80211_hwsim_tx_frame_no_nl(hw, skb, chan);
dev_kfree_skb(skb);
@@ -2514,6 +2516,11 @@ static int mac80211_hwsim_croc(struct ieee80211_hw *hw,
static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
struct ieee80211_chanctx_conf *ctx)
{
+ struct mac80211_hwsim_data *hwsim = hw->priv;
+
+ mutex_lock(&hwsim->mutex);
+ hwsim->chanctx = ctx;
+ mutex_unlock(&hwsim->mutex);
hwsim_set_chanctx_magic(ctx);
wiphy_dbg(hw->wiphy,
"add channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
@@ -2525,6 +2532,11 @@ static int mac80211_hwsim_add_chanctx(struct ieee80211_hw *hw,
static void mac80211_hwsim_remove_chanctx(struct ieee80211_hw *hw,
struct ieee80211_chanctx_conf *ctx)
{
+ struct mac80211_hwsim_data *hwsim = hw->priv;
+
+ mutex_lock(&hwsim->mutex);
+ hwsim->chanctx = NULL;
+ mutex_unlock(&hwsim->mutex);
wiphy_dbg(hw->wiphy,
"remove channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
ctx->def.chan->center_freq, ctx->def.width,
@@ -2537,6 +2549,11 @@ static void mac80211_hwsim_change_chanctx(struct ieee80211_hw *hw,
struct ieee80211_chanctx_conf *ctx,
u32 changed)
{
+ struct mac80211_hwsim_data *hwsim = hw->priv;
+
+ mutex_lock(&hwsim->mutex);
+ hwsim->chanctx = ctx;
+ mutex_unlock(&hwsim->mutex);
hwsim_check_chanctx_magic(ctx);
wiphy_dbg(hw->wiphy,
"change channel context control: %d MHz/width: %d/cfreqs:%d/%d MHz\n",
@@ -3129,6 +3146,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
hw->wiphy->max_remain_on_channel_duration = 1000;
data->if_combination.radar_detect_widths = 0;
data->if_combination.num_different_channels = data->channels;
+ data->chanctx = NULL;
} else {
data->if_combination.num_different_channels = 1;
data->if_combination.radar_detect_widths =
@@ -3638,6 +3656,7 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
int frame_data_len;
void *frame_data;
struct sk_buff *skb = NULL;
+ struct ieee80211_channel *channel = NULL;
if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
!info->attrs[HWSIM_ATTR_FRAME] ||
@@ -3664,6 +3683,17 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
if (!data2)
goto out;
+ if (data2->use_chanctx) {
+ if (data2->tmp_chan)
+ channel = data2->tmp_chan;
+ else if (data2->chanctx)
+ channel = data2->chanctx->def.chan;
+ } else {
+ channel = data2->channel;
+ }
+ if (!channel)
+ goto out;
+
if (!hwsim_virtio_enabled) {
if (hwsim_net_get_netgroup(genl_info_net(info)) !=
data2->netgroup)
@@ -3675,7 +3705,7 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
/* check if radio is configured properly */
- if (data2->idle || !data2->started)
+ if ((data2->idle && !data2->tmp_chan) || !data2->started)
goto out;
/* A frame is received from user space */
@@ -3688,18 +3718,16 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
mutex_lock(&data2->mutex);
rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
- if (rx_status.freq != data2->channel->center_freq &&
- (!data2->tmp_chan ||
- rx_status.freq != data2->tmp_chan->center_freq)) {
+ if (rx_status.freq != channel->center_freq) {
mutex_unlock(&data2->mutex);
goto out;
}
mutex_unlock(&data2->mutex);
} else {
- rx_status.freq = data2->channel->center_freq;
+ rx_status.freq = channel->center_freq;
}
- rx_status.band = data2->channel->band;
+ rx_status.band = channel->band;
rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 151/266] mac80211: Properly WARN on HW scan before restart
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 150/266] mac80211_hwsim: add concurrent channels scanning support over virtio Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 152/266] IB/isert: Align target max I/O size to initiator size Greg Kroah-Hartman
` (118 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilan Peer, Luca Coelho,
Johannes Berg, Sasha Levin
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 45daaa1318410794de956fb8e9d06aed2dbb23d0 ]
The following race was possible:
1. The device driver requests HW restart.
2. A scan is requested from user space and is propagated
to the driver. During this flow HW_SCANNING flag is set.
3. The thread that handles the HW restart is scheduled,
and before starting the actual reconfiguration it
checks that HW_SCANNING is not set. The flow does so
without acquiring any lock, and thus the WARN fires.
Fix this by checking that HW_SCANNING is on only after RTNL is
acquired, i.e., user space scan request handling is no longer
in transit.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210618133832.8238ab3e19ab.I2693c581c70251472b4f9089e37e06fb2c18268f@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/main.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index f33a3acd7f96..2481bfdfafd0 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -257,14 +257,13 @@ static void ieee80211_restart_work(struct work_struct *work)
/* wait for scan work complete */
flush_workqueue(local->workqueue);
flush_work(&local->sched_scan_stopped_work);
+ flush_work(&local->radar_detected_work);
+
+ rtnl_lock();
WARN(test_bit(SCAN_HW_SCANNING, &local->scanning),
"%s called with hardware scan in progress\n", __func__);
- flush_work(&local->radar_detected_work);
- /* we might do interface manipulations, so need both */
- rtnl_lock();
- wiphy_lock(local->hw.wiphy);
list_for_each_entry(sdata, &local->interfaces, list) {
/*
* XXX: there may be more work for other vif types and even
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 152/266] IB/isert: Align target max I/O size to initiator size
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 151/266] mac80211: Properly WARN on HW scan before restart Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 153/266] media, bpf: Do not copy more entries than user space requested Greg Kroah-Hartman
` (117 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alaa Hleihel, Israel Rukshin,
Max Gurtovoy, Sagi Grimberg, Jason Gunthorpe, Sasha Levin
From: Max Gurtovoy <mgurtovoy@nvidia.com>
[ Upstream commit 109d19a5eb3ddbdb87c43bfd4bcf644f4569da64 ]
Since the Linux iser initiator default max I/O size set to 512KB and since
there is no handshake procedure for this size in iser protocol, set the
default max IO size of the target to 512KB as well.
For changing the default values, there is a module parameter for both
drivers.
Link: https://lore.kernel.org/r/20210524085215.29005-1-mgurtovoy@nvidia.com
Reviewed-by: Alaa Hleihel <alaa@nvidia.com>
Reviewed-by: Israel Rukshin <israelr@nvidia.com>
Signed-off-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 4 ++--
drivers/infiniband/ulp/isert/ib_isert.h | 3 ---
2 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 18266f07c58d..de3fc05fd2e8 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -35,10 +35,10 @@ static const struct kernel_param_ops sg_tablesize_ops = {
.get = param_get_int,
};
-static int isert_sg_tablesize = ISCSI_ISER_DEF_SG_TABLESIZE;
+static int isert_sg_tablesize = ISCSI_ISER_MIN_SG_TABLESIZE;
module_param_cb(sg_tablesize, &sg_tablesize_ops, &isert_sg_tablesize, 0644);
MODULE_PARM_DESC(sg_tablesize,
- "Number of gather/scatter entries in a single scsi command, should >= 128 (default: 256, max: 4096)");
+ "Number of gather/scatter entries in a single scsi command, should >= 128 (default: 128, max: 4096)");
static DEFINE_MUTEX(device_list_mutex);
static LIST_HEAD(device_list);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index 6c5af13db4e0..ca8cfebe26ca 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -65,9 +65,6 @@
*/
#define ISER_RX_SIZE (ISCSI_DEF_MAX_RECV_SEG_LEN + 1024)
-/* Default I/O size is 1MB */
-#define ISCSI_ISER_DEF_SG_TABLESIZE 256
-
/* Minimum I/O size is 512KB */
#define ISCSI_ISER_MIN_SG_TABLESIZE 128
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 153/266] media, bpf: Do not copy more entries than user space requested
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 152/266] IB/isert: Align target max I/O size to initiator size Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 154/266] net: retrieve netns cookie via getsocketopt Greg Kroah-Hartman
` (116 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sean Young, Daniel Borkmann, Sasha Levin
From: Sean Young <sean@mess.org>
[ Upstream commit 647d446d66e493d23ca1047fa8492b0269674530 ]
The syscall bpf(BPF_PROG_QUERY, &attr) should use the prog_cnt field to
see how many entries user space provided and return ENOSPC if there are
more programs than that. Before this patch, this is not checked and
ENOSPC is never returned.
Note that one lirc device is limited to 64 bpf programs, and user space
I'm aware of -- ir-keytable -- always gives enough space for 64 entries
already. However, we should not copy program ids than are requested.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210623213754.632-1-sean@mess.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/bpf-lirc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
index 3fe3edd80876..afae0afe3f81 100644
--- a/drivers/media/rc/bpf-lirc.c
+++ b/drivers/media/rc/bpf-lirc.c
@@ -326,7 +326,8 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
}
if (attr->query.prog_cnt != 0 && prog_ids && cnt)
- ret = bpf_prog_array_copy_to_user(progs, prog_ids, cnt);
+ ret = bpf_prog_array_copy_to_user(progs, prog_ids,
+ attr->query.prog_cnt);
unlock:
mutex_unlock(&ir_raw_handler_lock);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 154/266] net: retrieve netns cookie via getsocketopt
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 153/266] media, bpf: Do not copy more entries than user space requested Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 155/266] net: ip: avoid OOM kills with large UDP sends over loopback Greg Kroah-Hartman
` (115 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lorenz Bauer, Martynas Pumputis,
Eric Dumazet, David S. Miller, Sasha Levin
From: Martynas Pumputis <m@lambda.lt>
[ Upstream commit e8b9eab99232c4e62ada9d7976c80fd5e8118289 ]
It's getting more common to run nested container environments for
testing cloud software. One of such examples is Kind [1] which runs a
Kubernetes cluster in Docker containers on a single host. Each container
acts as a Kubernetes node, and thus can run any Pod (aka container)
inside the former. This approach simplifies testing a lot, as it
eliminates complicated VM setups.
Unfortunately, such a setup breaks some functionality when cgroupv2 BPF
programs are used for load-balancing. The load-balancer BPF program
needs to detect whether a request originates from the host netns or a
container netns in order to allow some access, e.g. to a service via a
loopback IP address. Typically, the programs detect this by comparing
netns cookies with the one of the init ns via a call to
bpf_get_netns_cookie(NULL). However, in nested environments the latter
cannot be used given the Kubernetes node's netns is outside the init ns.
To fix this, we need to pass the Kubernetes node netns cookie to the
program in a different way: by extending getsockopt() with a
SO_NETNS_COOKIE option, the orchestrator which runs in the Kubernetes
node netns can retrieve the cookie and pass it to the program instead.
Thus, this is following up on Eric's commit 3d368ab87cf6 ("net:
initialize net->net_cookie at netns setup") to allow retrieval via
SO_NETNS_COOKIE. This is also in line in how we retrieve socket cookie
via SO_COOKIE.
[1] https://kind.sigs.k8s.io/
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
Cc: Eric Dumazet <edumazet@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/uapi/asm/socket.h | 2 ++
arch/mips/include/uapi/asm/socket.h | 2 ++
arch/parisc/include/uapi/asm/socket.h | 2 ++
arch/sparc/include/uapi/asm/socket.h | 2 ++
include/uapi/asm-generic/socket.h | 2 ++
net/core/sock.c | 7 +++++++
6 files changed, 17 insertions(+)
diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
index 57420356ce4c..6b3daba60987 100644
--- a/arch/alpha/include/uapi/asm/socket.h
+++ b/arch/alpha/include/uapi/asm/socket.h
@@ -127,6 +127,8 @@
#define SO_PREFER_BUSY_POLL 69
#define SO_BUSY_POLL_BUDGET 70
+#define SO_NETNS_COOKIE 71
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
index 2d949969313b..cdf404a831b2 100644
--- a/arch/mips/include/uapi/asm/socket.h
+++ b/arch/mips/include/uapi/asm/socket.h
@@ -138,6 +138,8 @@
#define SO_PREFER_BUSY_POLL 69
#define SO_BUSY_POLL_BUDGET 70
+#define SO_NETNS_COOKIE 71
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index f60904329bbc..5b5351cdcb33 100644
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h
@@ -119,6 +119,8 @@
#define SO_PREFER_BUSY_POLL 0x4043
#define SO_BUSY_POLL_BUDGET 0x4044
+#define SO_NETNS_COOKIE 0x4045
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
index 848a22fbac20..92675dc380fa 100644
--- a/arch/sparc/include/uapi/asm/socket.h
+++ b/arch/sparc/include/uapi/asm/socket.h
@@ -120,6 +120,8 @@
#define SO_PREFER_BUSY_POLL 0x0048
#define SO_BUSY_POLL_BUDGET 0x0049
+#define SO_NETNS_COOKIE 0x0050
+
#if !defined(__KERNEL__)
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index 4dcd13d097a9..d588c244ec2f 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -122,6 +122,8 @@
#define SO_PREFER_BUSY_POLL 69
#define SO_BUSY_POLL_BUDGET 70
+#define SO_NETNS_COOKIE 71
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))
diff --git a/net/core/sock.c b/net/core/sock.c
index 946888afef88..2003c5ebb4c2 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1622,6 +1622,13 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
v.val = sk->sk_bound_dev_if;
break;
+ case SO_NETNS_COOKIE:
+ lv = sizeof(u64);
+ if (len != lv)
+ return -EINVAL;
+ v.val64 = sock_net(sk)->net_cookie;
+ break;
+
default:
/* We implement the SO_SNDLOWAT etc to not be settable
* (1003.1g 7).
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 155/266] net: ip: avoid OOM kills with large UDP sends over loopback
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 154/266] net: retrieve netns cookie via getsocketopt Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 156/266] RDMA/cma: Fix rdma_resolve_route() memory leak Greg Kroah-Hartman
` (114 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Jones, Jakub Kicinski,
David S. Miller, Sasha Levin
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 6d123b81ac615072a8525c13c6c41b695270a15d ]
Dave observed number of machines hitting OOM on the UDP send
path. The workload seems to be sending large UDP packets over
loopback. Since loopback has MTU of 64k kernel will try to
allocate an skb with up to 64k of head space. This has a good
chance of failing under memory pressure. What's worse if
the message length is <32k the allocation may trigger an
OOM killer.
This is entirely avoidable, we can use an skb with page frags.
af_unix solves a similar problem by limiting the head
length to SKB_MAX_ALLOC. This seems like a good and simple
approach. It means that UDP messages > 16kB will now
use fragments if underlying device supports SG, if extra
allocator pressure causes regressions in real workloads
we can switch to trying the large allocation first and
falling back.
v4: pre-calculate all the additions to alloclen so
we can be sure it won't go over order-2
Reported-by: Dave Jones <dsj@fb.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/ip_output.c | 32 ++++++++++++++++++--------------
net/ipv6/ip6_output.c | 32 +++++++++++++++++---------------
2 files changed, 35 insertions(+), 29 deletions(-)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index c3efc7d658f6..8d8a8da3ae7e 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1054,7 +1054,7 @@ static int __ip_append_data(struct sock *sk,
unsigned int datalen;
unsigned int fraglen;
unsigned int fraggap;
- unsigned int alloclen;
+ unsigned int alloclen, alloc_extra;
unsigned int pagedlen;
struct sk_buff *skb_prev;
alloc_new_skb:
@@ -1074,35 +1074,39 @@ alloc_new_skb:
fraglen = datalen + fragheaderlen;
pagedlen = 0;
+ alloc_extra = hh_len + 15;
+ alloc_extra += exthdrlen;
+
+ /* The last fragment gets additional space at tail.
+ * Note, with MSG_MORE we overallocate on fragments,
+ * because we have no idea what fragment will be
+ * the last.
+ */
+ if (datalen == length + fraggap)
+ alloc_extra += rt->dst.trailer_len;
+
if ((flags & MSG_MORE) &&
!(rt->dst.dev->features&NETIF_F_SG))
alloclen = mtu;
- else if (!paged)
+ else if (!paged &&
+ (fraglen + alloc_extra < SKB_MAX_ALLOC ||
+ !(rt->dst.dev->features & NETIF_F_SG)))
alloclen = fraglen;
else {
alloclen = min_t(int, fraglen, MAX_HEADER);
pagedlen = fraglen - alloclen;
}
- alloclen += exthdrlen;
-
- /* The last fragment gets additional space at tail.
- * Note, with MSG_MORE we overallocate on fragments,
- * because we have no idea what fragment will be
- * the last.
- */
- if (datalen == length + fraggap)
- alloclen += rt->dst.trailer_len;
+ alloclen += alloc_extra;
if (transhdrlen) {
- skb = sock_alloc_send_skb(sk,
- alloclen + hh_len + 15,
+ skb = sock_alloc_send_skb(sk, alloclen,
(flags & MSG_DONTWAIT), &err);
} else {
skb = NULL;
if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <=
2 * sk->sk_sndbuf)
- skb = alloc_skb(alloclen + hh_len + 15,
+ skb = alloc_skb(alloclen,
sk->sk_allocation);
if (unlikely(!skb))
err = -ENOBUFS;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ff4f9ebcf7f6..497974b4372a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1555,7 +1555,7 @@ emsgsize:
unsigned int datalen;
unsigned int fraglen;
unsigned int fraggap;
- unsigned int alloclen;
+ unsigned int alloclen, alloc_extra;
unsigned int pagedlen;
alloc_new_skb:
/* There's no room in the current skb */
@@ -1582,17 +1582,28 @@ alloc_new_skb:
fraglen = datalen + fragheaderlen;
pagedlen = 0;
+ alloc_extra = hh_len;
+ alloc_extra += dst_exthdrlen;
+ alloc_extra += rt->dst.trailer_len;
+
+ /* We just reserve space for fragment header.
+ * Note: this may be overallocation if the message
+ * (without MSG_MORE) fits into the MTU.
+ */
+ alloc_extra += sizeof(struct frag_hdr);
+
if ((flags & MSG_MORE) &&
!(rt->dst.dev->features&NETIF_F_SG))
alloclen = mtu;
- else if (!paged)
+ else if (!paged &&
+ (fraglen + alloc_extra < SKB_MAX_ALLOC ||
+ !(rt->dst.dev->features & NETIF_F_SG)))
alloclen = fraglen;
else {
alloclen = min_t(int, fraglen, MAX_HEADER);
pagedlen = fraglen - alloclen;
}
-
- alloclen += dst_exthdrlen;
+ alloclen += alloc_extra;
if (datalen != length + fraggap) {
/*
@@ -1602,30 +1613,21 @@ alloc_new_skb:
datalen += rt->dst.trailer_len;
}
- alloclen += rt->dst.trailer_len;
fraglen = datalen + fragheaderlen;
- /*
- * We just reserve space for fragment header.
- * Note: this may be overallocation if the message
- * (without MSG_MORE) fits into the MTU.
- */
- alloclen += sizeof(struct frag_hdr);
-
copy = datalen - transhdrlen - fraggap - pagedlen;
if (copy < 0) {
err = -EINVAL;
goto error;
}
if (transhdrlen) {
- skb = sock_alloc_send_skb(sk,
- alloclen + hh_len,
+ skb = sock_alloc_send_skb(sk, alloclen,
(flags & MSG_DONTWAIT), &err);
} else {
skb = NULL;
if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <=
2 * sk->sk_sndbuf)
- skb = alloc_skb(alloclen + hh_len,
+ skb = alloc_skb(alloclen,
sk->sk_allocation);
if (unlikely(!skb))
err = -ENOBUFS;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 156/266] RDMA/cma: Fix rdma_resolve_route() memory leak
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 155/266] net: ip: avoid OOM kills with large UDP sends over loopback Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 157/266] Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip Greg Kroah-Hartman
` (113 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gerd Rausch, Jason Gunthorpe, Sasha Levin
From: Gerd Rausch <gerd.rausch@oracle.com>
[ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ]
Fix a memory leak when "mda_resolve_route() is called more than once on
the same "rdma_cm_id".
This is possible if cma_query_handler() triggers the
RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and
allows rdma_resolve_route() to be called again.
Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com
Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/cma.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index ad9a9ba5f00d..5d3b8b8d163d 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2829,7 +2829,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv,
cma_init_resolve_route_work(work, id_priv);
- route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL);
+ if (!route->path_rec)
+ route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL);
if (!route->path_rec) {
ret = -ENOMEM;
goto err1;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 157/266] Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip.
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 156/266] RDMA/cma: Fix rdma_resolve_route() memory leak Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 158/266] Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails Greg Kroah-Hartman
` (112 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, mark-yw.chen, Marcel Holtmann, Sasha Levin
From: mark-yw.chen <mark-yw.chen@mediatek.com>
[ Upstream commit 8454ed9ff9647e31e061fb5eb2e39ce79bc5e960 ]
This patch reduce in-token during download patch procedure.
Don't submit urb for polling event before sending hci command.
Signed-off-by: mark-yw.chen <mark-yw.chen@mediatek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7f6ba2c975ed..99fd88f7653d 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3312,11 +3312,6 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
struct btmtk_wmt_hdr *hdr;
int err;
- /* Submit control IN URB on demand to process the WMT event */
- err = btusb_mtk_submit_wmt_recv_urb(hdev);
- if (err < 0)
- return err;
-
/* Send the WMT command and wait until the WMT event returns */
hlen = sizeof(*hdr) + wmt_params->dlen;
if (hlen > 255)
@@ -3342,6 +3337,11 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
goto err_free_wc;
}
+ /* Submit control IN URB on demand to process the WMT event */
+ err = btusb_mtk_submit_wmt_recv_urb(hdev);
+ if (err < 0)
+ return err;
+
/* The vendor specific WMT commands are all answered by a vendor
* specific event and will have the Command Status or Command
* Complete as with usual HCI command flow control.
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 158/266] Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 157/266] Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 159/266] Bluetooth: Fix the HCI to MGMT status conversion table Greg Kroah-Hartman
` (111 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thadeu Lima de Souza Cascardo,
Marcel Holtmann, Sasha Levin
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
[ Upstream commit 3cfdf8fcaafa62a4123f92eb0f4a72650da3a479 ]
When cmtp_attach_device fails, cmtp_add_connection returns the error value
which leads to the caller to doing fput through sockfd_put. But
cmtp_session kthread, which is stopped in this path will also call fput,
leading to a potential refcount underflow or a use-after-free.
Add a refcount before we signal the kthread to stop. The kthread will try
to grab the cmtp_session_sem mutex before doing the fput, which is held
when get_file is called, so there should be no races there.
Reported-by: Ryota Shiga
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/cmtp/core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 07cfa3249f83..0a2d78e811cf 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -392,6 +392,11 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
if (!(session->flags & BIT(CMTP_LOOPBACK))) {
err = cmtp_attach_device(session);
if (err < 0) {
+ /* Caller will call fput in case of failure, and so
+ * will cmtp_session kthread.
+ */
+ get_file(session->sock->file);
+
atomic_inc(&session->terminate);
wake_up_interruptible(sk_sleep(session->sock->sk));
up_write(&cmtp_session_sem);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 159/266] Bluetooth: Fix the HCI to MGMT status conversion table
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 158/266] Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 160/266] Bluetooth: Fix alt settings for incoming SCO with transparent coding format Greg Kroah-Hartman
` (110 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Miao-chen Chou, Yu Liu,
Marcel Holtmann, Sasha Levin
From: Yu Liu <yudiliu@google.com>
[ Upstream commit 4ef36a52b0e47c80bbfd69c0cce61c7ae9f541ed ]
0x2B, 0x31 and 0x33 are reserved for future use but were not present in
the HCI to MGMT conversion table, this caused the conversion to be
incorrect for the HCI status code greater than 0x2A.
Reviewed-by: Miao-chen Chou <mcchou@chromium.org>
Signed-off-by: Yu Liu <yudiliu@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 023a98f7c992..0d86a62765d4 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -252,12 +252,15 @@ static const u8 mgmt_status_table[] = {
MGMT_STATUS_TIMEOUT, /* Instant Passed */
MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
MGMT_STATUS_FAILED, /* Transaction Collision */
+ MGMT_STATUS_FAILED, /* Reserved for future use */
MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
MGMT_STATUS_REJECTED, /* QoS Rejected */
MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
MGMT_STATUS_REJECTED, /* Insufficient Security */
MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
+ MGMT_STATUS_FAILED, /* Reserved for future use */
MGMT_STATUS_BUSY, /* Role Switch Pending */
+ MGMT_STATUS_FAILED, /* Reserved for future use */
MGMT_STATUS_FAILED, /* Slot Violation */
MGMT_STATUS_FAILED, /* Role Switch Failed */
MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 160/266] Bluetooth: Fix alt settings for incoming SCO with transparent coding format
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 159/266] Bluetooth: Fix the HCI to MGMT status conversion table Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 161/266] Bluetooth: Shutdown controller after workqueues are flushed or cancelled Greg Kroah-Hartman
` (109 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kiran K, Lokendra Singh,
Marcel Holtmann, Sasha Levin
From: Kiran K <kiran.k@intel.com>
[ Upstream commit 06d213d8a89a6f55b708422c3dda2b22add10748 ]
For incoming SCO connection with transparent coding format, alt setting
of CVSD is getting applied instead of Transparent.
Before fix:
< HCI Command: Accept Synchron.. (0x01|0x0029) plen 21 #2196 [hci0] 321.342548
Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd)
Transmit bandwidth: 8000
Receive bandwidth: 8000
Max latency: 13
Setting: 0x0003
Input Coding: Linear
Input Data Format: 1's complement
Input Sample Size: 8-bit
# of bits padding at MSB: 0
Air Coding Format: Transparent Data
Retransmission effort: Optimize for link quality (0x02)
Packet type: 0x003f
HV1 may be used
HV2 may be used
HV3 may be used
EV3 may be used
EV4 may be used
EV5 may be used
> HCI Event: Command Status (0x0f) plen 4 #2197 [hci0] 321.343585
Accept Synchronous Connection Request (0x01|0x0029) ncmd 1
Status: Success (0x00)
> HCI Event: Synchronous Connect Comp.. (0x2c) plen 17 #2198 [hci0] 321.351666
Status: Success (0x00)
Handle: 257
Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd)
Link type: eSCO (0x02)
Transmission interval: 0x0c
Retransmission window: 0x04
RX packet length: 60
TX packet length: 60
Air mode: Transparent (0x03)
........
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2336 [hci0] 321.383655
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2337 [hci0] 321.389558
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2338 [hci0] 321.393615
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2339 [hci0] 321.393618
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2340 [hci0] 321.393618
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2341 [hci0] 321.397070
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2342 [hci0] 321.403622
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2343 [hci0] 321.403625
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2344 [hci0] 321.403625
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2345 [hci0] 321.403625
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2346 [hci0] 321.404569
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2347 [hci0] 321.412091
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2348 [hci0] 321.413626
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2349 [hci0] 321.413630
> SCO Data RX: Handle 257 flags 0x00 dlen 48 #2350 [hci0] 321.413630
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #2351 [hci0] 321.419674
After fix:
< HCI Command: Accept Synchronou.. (0x01|0x0029) plen 21 #309 [hci0] 49.439693
Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd)
Transmit bandwidth: 8000
Receive bandwidth: 8000
Max latency: 13
Setting: 0x0003
Input Coding: Linear
Input Data Format: 1's complement
Input Sample Size: 8-bit
# of bits padding at MSB: 0
Air Coding Format: Transparent Data
Retransmission effort: Optimize for link quality (0x02)
Packet type: 0x003f
HV1 may be used
HV2 may be used
HV3 may be used
EV3 may be used
EV4 may be used
EV5 may be used
> HCI Event: Command Status (0x0f) plen 4 #310 [hci0] 49.440308
Accept Synchronous Connection Request (0x01|0x0029) ncmd 1
Status: Success (0x00)
> HCI Event: Synchronous Connect Complete (0x2c) plen 17 #311 [hci0] 49.449308
Status: Success (0x00)
Handle: 257
Address: 1C:CC:D6:E2:EA:80 (Xiaomi Communications Co Ltd)
Link type: eSCO (0x02)
Transmission interval: 0x0c
Retransmission window: 0x04
RX packet length: 60
TX packet length: 60
Air mode: Transparent (0x03)
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #312 [hci0] 49.450421
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #313 [hci0] 49.457927
> HCI Event: Max Slots Change (0x1b) plen 3 #314 [hci0] 49.460345
Handle: 256
Max slots: 5
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #315 [hci0] 49.465453
> SCO Data RX: Handle 257 flags 0x00 dlen 60 #316 [hci0] 49.470502
> SCO Data RX: Handle 257 flags 0x00 dlen 60 #317 [hci0] 49.470519
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #318 [hci0] 49.472996
> SCO Data RX: Handle 257 flags 0x00 dlen 60 #319 [hci0] 49.480412
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #320 [hci0] 49.480492
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #321 [hci0] 49.487989
> SCO Data RX: Handle 257 flags 0x00 dlen 60 #322 [hci0] 49.490303
< SCO Data TX: Handle 257 flags 0x00 dlen 60 #323 [hci0] 49.495496
> SCO Data RX: Handle 257 flags 0x00 dlen 60 #324 [hci0] 49.500304
> SCO Data RX: Handle 257 flags 0x00 dlen 60 #325 [hci0] 49.500311
Signed-off-by: Kiran K <kiran.k@intel.com>
Signed-off-by: Lokendra Singh <lokendra.singh@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b077d150ac52..62c99e015609 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4404,12 +4404,12 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
- switch (conn->setting & SCO_AIRMODE_MASK) {
- case SCO_AIRMODE_CVSD:
+ switch (ev->air_mode) {
+ case 0x02:
if (hdev->notify)
hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
break;
- case SCO_AIRMODE_TRANSP:
+ case 0x03:
if (hdev->notify)
hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
break;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 161/266] Bluetooth: Shutdown controller after workqueues are flushed or cancelled
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 160/266] Bluetooth: Fix alt settings for incoming SCO with transparent coding format Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 162/266] Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500) Greg Kroah-Hartman
` (108 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Marcel Holtmann, Sasha Levin
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
[ Upstream commit 0ea9fd001a14ebc294f112b0361a4e601551d508 ]
Rfkill block and unblock Intel USB Bluetooth [8087:0026] may make it
stops working:
[ 509.691509] Bluetooth: hci0: HCI reset during shutdown failed
[ 514.897584] Bluetooth: hci0: MSFT filter_enable is already on
[ 530.044751] usb 3-10: reset full-speed USB device number 5 using xhci_hcd
[ 545.660350] usb 3-10: device descriptor read/64, error -110
[ 561.283530] usb 3-10: device descriptor read/64, error -110
[ 561.519682] usb 3-10: reset full-speed USB device number 5 using xhci_hcd
[ 566.686650] Bluetooth: hci0: unexpected event for opcode 0x0500
[ 568.752452] Bluetooth: hci0: urb 0000000096cd309b failed to resubmit (113)
[ 578.797955] Bluetooth: hci0: Failed to read MSFT supported features (-110)
[ 586.286565] Bluetooth: hci0: urb 00000000c522f633 failed to resubmit (113)
[ 596.215302] Bluetooth: hci0: Failed to read MSFT supported features (-110)
Or kernel panics because other workqueues already freed skb:
[ 2048.663763] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 2048.663775] #PF: supervisor read access in kernel mode
[ 2048.663779] #PF: error_code(0x0000) - not-present page
[ 2048.663782] PGD 0 P4D 0
[ 2048.663787] Oops: 0000 [#1] SMP NOPTI
[ 2048.663793] CPU: 3 PID: 4491 Comm: rfkill Tainted: G W 5.13.0-rc1-next-20210510+ #20
[ 2048.663799] Hardware name: HP HP EliteBook 850 G8 Notebook PC/8846, BIOS T76 Ver. 01.01.04 12/02/2020
[ 2048.663801] RIP: 0010:__skb_ext_put+0x6/0x50
[ 2048.663814] Code: 8b 1b 48 85 db 75 db 5b 41 5c 5d c3 be 01 00 00 00 e8 de 13 c0 ff eb e7 be 02 00 00 00 e8 d2 13 c0 ff eb db 0f 1f 44 00 00 55 <8b> 07 48 89 e5 83 f8 01 74 14 b8 ff ff ff ff f0 0f c1
07 83 f8 01
[ 2048.663819] RSP: 0018:ffffc1d105b6fd80 EFLAGS: 00010286
[ 2048.663824] RAX: 0000000000000000 RBX: ffff9d9ac5649000 RCX: 0000000000000000
[ 2048.663827] RDX: ffffffffc0d1daf6 RSI: 0000000000000206 RDI: 0000000000000000
[ 2048.663830] RBP: ffffc1d105b6fd98 R08: 0000000000000001 R09: ffff9d9ace8ceac0
[ 2048.663834] R10: ffff9d9ace8ceac0 R11: 0000000000000001 R12: ffff9d9ac5649000
[ 2048.663838] R13: 0000000000000000 R14: 00007ffe0354d650 R15: 0000000000000000
[ 2048.663843] FS: 00007fe02ab19740(0000) GS:ffff9d9e5f8c0000(0000) knlGS:0000000000000000
[ 2048.663849] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2048.663853] CR2: 0000000000000000 CR3: 0000000111a52004 CR4: 0000000000770ee0
[ 2048.663856] PKRU: 55555554
[ 2048.663859] Call Trace:
[ 2048.663865] ? skb_release_head_state+0x5e/0x80
[ 2048.663873] kfree_skb+0x2f/0xb0
[ 2048.663881] btusb_shutdown_intel_new+0x36/0x60 [btusb]
[ 2048.663905] hci_dev_do_close+0x48c/0x5e0 [bluetooth]
[ 2048.663954] ? __cond_resched+0x1a/0x50
[ 2048.663962] hci_rfkill_set_block+0x56/0xa0 [bluetooth]
[ 2048.664007] rfkill_set_block+0x98/0x170
[ 2048.664016] rfkill_fop_write+0x136/0x1e0
[ 2048.664022] vfs_write+0xc7/0x260
[ 2048.664030] ksys_write+0xb1/0xe0
[ 2048.664035] ? exit_to_user_mode_prepare+0x37/0x1c0
[ 2048.664042] __x64_sys_write+0x1a/0x20
[ 2048.664048] do_syscall_64+0x40/0xb0
[ 2048.664055] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2048.664060] RIP: 0033:0x7fe02ac23c27
[ 2048.664066] Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
[ 2048.664070] RSP: 002b:00007ffe0354d638 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 2048.664075] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fe02ac23c27
[ 2048.664078] RDX: 0000000000000008 RSI: 00007ffe0354d650 RDI: 0000000000000003
[ 2048.664081] RBP: 0000000000000000 R08: 0000559b05998440 R09: 0000559b05998440
[ 2048.664084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
[ 2048.664086] R13: 0000000000000000 R14: ffffffff00000000 R15: 00000000ffffffff
So move the shutdown callback to a place where workqueues are either
flushed or cancelled to resolve the issue.
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_core.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 7d71d104fdfd..ded55f54d9c8 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1721,14 +1721,6 @@ int hci_dev_do_close(struct hci_dev *hdev)
BT_DBG("%s %p", hdev->name, hdev);
- if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
- test_bit(HCI_UP, &hdev->flags)) {
- /* Execute vendor specific shutdown routine */
- if (hdev->shutdown)
- hdev->shutdown(hdev);
- }
-
cancel_delayed_work(&hdev->power_off);
hci_request_cancel_all(hdev);
@@ -1805,6 +1797,14 @@ int hci_dev_do_close(struct hci_dev *hdev)
clear_bit(HCI_INIT, &hdev->flags);
}
+ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
+ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
+ test_bit(HCI_UP, &hdev->flags)) {
+ /* Execute vendor specific shutdown routine */
+ if (hdev->shutdown)
+ hdev->shutdown(hdev);
+ }
+
/* flush cmd work */
flush_work(&hdev->cmd_work);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 162/266] Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500)
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 161/266] Bluetooth: Shutdown controller after workqueues are flushed or cancelled Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 163/266] Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails Greg Kroah-Hartman
` (107 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Lenski, Marcel Holtmann, Sasha Levin
From: Daniel Lenski <dlenski@gmail.com>
[ Upstream commit 0324d19cb99804d99e42c990b8b1e191575a091b ]
This patch adds the 0cf3:e500 Bluetooth device (from a QCA9377 board) as a
QCA_ROME device. It appears to be functionally identical to another device
ID, also from a QCA9377 board, which was previously marked as QCA_ROME in
0a03f98b98c201191e3ba15a0e33f46d8660e1fd
("Bluetooth: Add a new 04ca:3015 QCA_ROME device").
Without this patch, the WiFi side of the QCA9377 board is slow or unusable
when the Bluetooth side is in use.
See https://askubuntu.com/a/1137852 for another report of QCA_ROME fixing
this issue for this device ID.
/sys/kernel/debug/usb/devices:
T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0cf3 ProdID=e500 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Daniel Lenski <dlenski@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 99fd88f7653d..90872099d9c3 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -270,6 +270,8 @@ static const struct usb_device_id blacklist_table[] = {
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME |
+ BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME |
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 163/266] Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 162/266] Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500) Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 164/266] Bluetooth: L2CAP: Fix invalid access on ECRED Connection response Greg Kroah-Hartman
` (106 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter,
Luiz Augusto von Dentz, Marcel Holtmann, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 1fa20d7d4aad02206e84b74915819fbe9f81dab3 ]
The use of l2cap_chan_del is not safe under a loop using
list_for_each_entry.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b6a88b8256c7..9b6e57204f51 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6248,7 +6248,7 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
struct l2cap_cmd_hdr *cmd, u16 cmd_len,
u8 *data)
{
- struct l2cap_chan *chan;
+ struct l2cap_chan *chan, *tmp;
struct l2cap_ecred_conn_rsp *rsp = (void *) data;
u16 result;
@@ -6262,7 +6262,7 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
if (!result)
return 0;
- list_for_each_entry(chan, &conn->chan_l, list) {
+ list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
if (chan->ident != cmd->ident)
continue;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 164/266] Bluetooth: L2CAP: Fix invalid access on ECRED Connection response
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 163/266] Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 165/266] Bluetooth: btusb: Add support USB ALT 3 for WBS Greg Kroah-Hartman
` (105 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luiz Augusto von Dentz,
Marcel Holtmann, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit de895b43932cb47e69480540be7eca289af24f23 ]
The use of l2cap_chan_del is not safe under a loop using
list_for_each_entry.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9b6e57204f51..9908aa53a682 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6066,7 +6066,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
struct l2cap_ecred_conn_rsp *rsp = (void *) data;
struct hci_conn *hcon = conn->hcon;
u16 mtu, mps, credits, result;
- struct l2cap_chan *chan;
+ struct l2cap_chan *chan, *tmp;
int err = 0, sec_level;
int i = 0;
@@ -6085,7 +6085,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
cmd_len -= sizeof(*rsp);
- list_for_each_entry(chan, &conn->chan_l, list) {
+ list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
u16 dcid;
if (chan->ident != cmd->ident ||
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 165/266] Bluetooth: btusb: Add support USB ALT 3 for WBS
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 164/266] Bluetooth: L2CAP: Fix invalid access on ECRED Connection response Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 166/266] Bluetooth: mgmt: Fix the command returns garbage parameter value Greg Kroah-Hartman
` (104 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hilda Wu, Marcel Holtmann, Sasha Levin
From: Hilda Wu <hildawu@realtek.com>
[ Upstream commit e848dbd364aca44c9d23c04bef964fab79e2b34f ]
Because mSBC frames do not need to be aligned to the SCO packet
boundary. Using USB ALT 3 let HCI payload >= 60 bytes, let mSBC
data satisfy 60 Bytes avoid payload unaligned situation and fixed
some headset no voise issue.
USB Alt 3 supported also need HFP support transparent MTU in 72 Bytes.
Signed-off-by: Hilda Wu <hildawu@realtek.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 90872099d9c3..4c18a85a1070 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -1751,6 +1751,13 @@ static void btusb_work(struct work_struct *work)
* which work with WBS at all.
*/
new_alts = btusb_find_altsetting(data, 6) ? 6 : 1;
+ /* Because mSBC frames do not need to be aligned to the
+ * SCO packet boundary. If support the Alt 3, use the
+ * Alt 3 for HCI payload >= 60 Bytes let air packet
+ * data satisfy 60 bytes.
+ */
+ if (new_alts == 1 && btusb_find_altsetting(data, 3))
+ new_alts = 3;
}
if (btusb_switch_alt_setting(hdev, new_alts) < 0)
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 166/266] Bluetooth: mgmt: Fix the command returns garbage parameter value
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 165/266] Bluetooth: btusb: Add support USB ALT 3 for WBS Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 167/266] Bluetooth: btusb: use default nvm if boardID is 0 for wcn6855 Greg Kroah-Hartman
` (103 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tedd Ho-Jeong An, Marcel Holtmann,
Sasha Levin
From: Tedd Ho-Jeong An <tedd.an@intel.com>
[ Upstream commit 02ce2c2c24024aade65a8d91d6a596651eaf2d0a ]
When the Get Device Flags command fails, it returns the error status
with the parameters filled with the garbage values. Although the
parameters are not used, it is better to fill with zero than the random
values.
Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 0d86a62765d4..470eaabb021f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -4061,6 +4061,8 @@ static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
hci_dev_lock(hdev);
+ memset(&rp, 0, sizeof(rp));
+
if (cp->addr.type == BDADDR_BREDR) {
br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
&cp->addr.bdaddr,
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 167/266] Bluetooth: btusb: use default nvm if boardID is 0 for wcn6855.
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 166/266] Bluetooth: mgmt: Fix the command returns garbage parameter value Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 168/266] Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc Greg Kroah-Hartman
` (102 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tim Jiang, Marcel Holtmann, Sasha Levin
From: Tim Jiang <tjiang@codeaurora.org>
[ Upstream commit ca17a5cccf8b6d35dab4729bea8f4350bc0b4caf ]
if boardID is 0, will use the default nvm file without surfix.
Signed-off-by: Tim Jiang <tjiang@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 4c18a85a1070..1cec9b2353c6 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4163,9 +4163,15 @@ static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
int err;
if (((ver->flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) {
- snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x_%04x.bin",
- le32_to_cpu(ver->rom_version),
- le16_to_cpu(ver->board_id));
+ /* if boardid equal 0, use default nvm without surfix */
+ if (le16_to_cpu(ver->board_id) == 0x0) {
+ snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
+ le32_to_cpu(ver->rom_version));
+ } else {
+ snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x_%04x.bin",
+ le32_to_cpu(ver->rom_version),
+ le16_to_cpu(ver->board_id));
+ }
} else {
snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
le32_to_cpu(ver->rom_version));
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 168/266] Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 167/266] Bluetooth: btusb: use default nvm if boardID is 0 for wcn6855 Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 169/266] sched/fair: Ensure _sum and _avg values stay consistent Greg Kroah-Hartman
` (101 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tim Jiang, Marcel Holtmann, Sasha Levin
From: Tim Jiang <tjiang@codeaurora.org>
[ Upstream commit 4f00bfb372674d586c4a261bfc595cbce101fbb6 ]
This is btsoc timing issue, after host start to downloading bt firmware,
ep2 need time to switch from function acl to function dfu, so host add
20ms delay as workaround.
Signed-off-by: Tim Jiang <tjiang@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 1cec9b2353c6..6d23308119d1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4071,6 +4071,11 @@ static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
sent += size;
count -= size;
+ /* ep2 need time to switch from function acl to function dfu,
+ * so we add 20ms delay here.
+ */
+ msleep(20);
+
while (count) {
size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 169/266] sched/fair: Ensure _sum and _avg values stay consistent
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 168/266] Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 170/266] bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc() Greg Kroah-Hartman
` (100 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sachin Sant, Naresh Kamboju,
Odin Ugedal, Peter Zijlstra (Intel),
Vincent Guittot, Sasha Levin
From: Odin Ugedal <odin@uged.al>
[ Upstream commit 1c35b07e6d3986474e5635be566e7bc79d97c64d ]
The _sum and _avg values are in general sync together with the PELT
divider. They are however not always completely in perfect sync,
resulting in situations where _sum gets to zero while _avg stays
positive. Such situations are undesirable.
This comes from the fact that PELT will increase period_contrib, also
increasing the PELT divider, without updating _sum and _avg values to
stay in perfect sync where (_sum == _avg * divider). However, such PELT
change will never lower _sum, making it impossible to end up in a
situation where _sum is zero and _avg is not.
Therefore, we need to ensure that when subtracting load outside PELT,
that when _sum is zero, _avg is also set to zero. This occurs when
(_sum < _avg * divider), and the subtracted (_avg * divider) is bigger
or equal to the current _sum, while the subtracted _avg is smaller than
the current _avg.
Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Odin Ugedal <odin@uged.al>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Link: https://lore.kernel.org/r/20210624111815.57937-1-odin@uged.al
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index e807b743353d..7dd0d859d95b 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3716,15 +3716,15 @@ update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
r = removed_load;
sub_positive(&sa->load_avg, r);
- sub_positive(&sa->load_sum, r * divider);
+ sa->load_sum = sa->load_avg * divider;
r = removed_util;
sub_positive(&sa->util_avg, r);
- sub_positive(&sa->util_sum, r * divider);
+ sa->util_sum = sa->util_avg * divider;
r = removed_runnable;
sub_positive(&sa->runnable_avg, r);
- sub_positive(&sa->runnable_sum, r * divider);
+ sa->runnable_sum = sa->runnable_avg * divider;
/*
* removed_runnable is the unweighted version of removed_load so we
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 170/266] bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 169/266] sched/fair: Ensure _sum and _avg values stay consistent Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 171/266] flow_offload: action should not be NULL when it is referenced Greg Kroah-Hartman
` (99 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+5d895828587f49e7fe9b,
Rustam Kovhaev, Daniel Borkmann, Dmitry Vyukov, Andrii Nakryiko,
Sasha Levin
From: Rustam Kovhaev <rkovhaev@gmail.com>
[ Upstream commit ccff81e1d028bbbf8573d3364a87542386c707bf ]
kmemleak scans struct page, but it does not scan the page content. If we
allocate some memory with kmalloc(), then allocate page with alloc_page(),
and if we put kmalloc pointer somewhere inside that page, kmemleak will
report kmalloc pointer as a false positive.
We can instruct kmemleak to scan the memory area by calling kmemleak_alloc()
and kmemleak_free(), but part of struct bpf_ringbuf is mmaped to user space,
and if struct bpf_ringbuf changes we would have to revisit and review size
argument in kmemleak_alloc(), because we do not want kmemleak to scan the
user space memory. Let's simplify things and use kmemleak_not_leak() here.
For posterity, also adding additional prior analysis from Andrii:
I think either kmemleak or syzbot are misreporting this. I've added a
bunch of printks around all allocations performed by BPF ringbuf. [...]
On repro side I get these two warnings:
[vmuser@archvm bpf]$ sudo ./repro
BUG: memory leak
unreferenced object 0xffff88810d538c00 (size 64):
comm "repro", pid 2140, jiffies 4294692933 (age 14.540s)
hex dump (first 32 bytes):
00 af 19 04 00 ea ff ff c0 ae 19 04 00 ea ff ff ................
80 ae 19 04 00 ea ff ff c0 29 2e 04 00 ea ff ff .........)......
backtrace:
[<0000000077bfbfbd>] __bpf_map_area_alloc+0x31/0xc0
[<00000000587fa522>] ringbuf_map_alloc.cold.4+0x48/0x218
[<0000000044d49e96>] __do_sys_bpf+0x359/0x1d90
[<00000000f601d565>] do_syscall_64+0x2d/0x40
[<0000000043d3112a>] entry_SYSCALL_64_after_hwframe+0x44/0xae
BUG: memory leak
unreferenced object 0xffff88810d538c80 (size 64):
comm "repro", pid 2143, jiffies 4294699025 (age 8.448s)
hex dump (first 32 bytes):
80 aa 19 04 00 ea ff ff 00 ab 19 04 00 ea ff ff ................
c0 ab 19 04 00 ea ff ff 80 44 28 04 00 ea ff ff .........D(.....
backtrace:
[<0000000077bfbfbd>] __bpf_map_area_alloc+0x31/0xc0
[<00000000587fa522>] ringbuf_map_alloc.cold.4+0x48/0x218
[<0000000044d49e96>] __do_sys_bpf+0x359/0x1d90
[<00000000f601d565>] do_syscall_64+0x2d/0x40
[<0000000043d3112a>] entry_SYSCALL_64_after_hwframe+0x44/0xae
Note that both reported leaks (ffff88810d538c80 and ffff88810d538c00)
correspond to pages array bpf_ringbuf is allocating and tracking properly
internally. Note also that syzbot repro doesn't close FD of created BPF
ringbufs, and even when ./repro itself exits with error, there are still
two forked processes hanging around in my system. So clearly ringbuf maps
are alive at that point. So reporting any memory leak looks weird at that
point, because that memory is being used by active referenced BPF ringbuf.
It's also a question why repro doesn't clean up its forks. But if I do a
`pkill repro`, I do see that all the allocated memory is /properly/ cleaned
up [and the] "leaks" are deallocated properly.
BTW, if I add close() right after bpf() syscall in syzbot repro, I see that
everything is immediately deallocated, like designed. And no memory leak
is reported. So I don't think the problem is anywhere in bpf_ringbuf code,
rather in the leak detection and/or repro itself.
Reported-by: syzbot+5d895828587f49e7fe9b@syzkaller.appspotmail.com
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
[ Daniel: also included analysis from Andrii to the commit log ]
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: syzbot+5d895828587f49e7fe9b@syzkaller.appspotmail.com
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/CAEf4BzYk+dqs+jwu6VKXP-RttcTEGFe+ySTGWT9CRNkagDiJVA@mail.gmail.com
Link: https://lore.kernel.org/lkml/YNTAqiE7CWJhOK2M@nuc10
Link: https://lore.kernel.org/lkml/20210615101515.GC26027@arm.com
Link: https://syzkaller.appspot.com/bug?extid=5d895828587f49e7fe9b
Link: https://lore.kernel.org/bpf/20210626181156.1873604-1-rkovhaev@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/ringbuf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c
index 84b3b35fc0d0..9e0c10c6892a 100644
--- a/kernel/bpf/ringbuf.c
+++ b/kernel/bpf/ringbuf.c
@@ -8,6 +8,7 @@
#include <linux/vmalloc.h>
#include <linux/wait.h>
#include <linux/poll.h>
+#include <linux/kmemleak.h>
#include <uapi/linux/btf.h>
#define RINGBUF_CREATE_FLAG_MASK (BPF_F_NUMA_NODE)
@@ -105,6 +106,7 @@ static struct bpf_ringbuf *bpf_ringbuf_area_alloc(size_t data_sz, int numa_node)
rb = vmap(pages, nr_meta_pages + 2 * nr_data_pages,
VM_ALLOC | VM_USERMAP, PAGE_KERNEL);
if (rb) {
+ kmemleak_not_leak(pages);
rb->pages = pages;
rb->nr_pages = nr_pages;
return rb;
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 171/266] flow_offload: action should not be NULL when it is referenced
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 170/266] bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc() Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 172/266] sctp: validate from_addr_param return Greg Kroah-Hartman
` (98 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, gushengxian, gushengxian,
David S. Miller, Sasha Levin
From: gushengxian <gushengxian@yulong.com>
[ Upstream commit 9ea3e52c5bc8bb4a084938dc1e3160643438927a ]
"action" should not be NULL when it is referenced.
Signed-off-by: gushengxian <13145886936@163.com>
Signed-off-by: gushengxian <gushengxian@yulong.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/flow_offload.h | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h
index dc5c1e69cd9f..69c9eabf8325 100644
--- a/include/net/flow_offload.h
+++ b/include/net/flow_offload.h
@@ -319,12 +319,14 @@ flow_action_mixed_hw_stats_check(const struct flow_action *action,
if (flow_offload_has_one_action(action))
return true;
- flow_action_for_each(i, action_entry, action) {
- if (i && action_entry->hw_stats != last_hw_stats) {
- NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported");
- return false;
+ if (action) {
+ flow_action_for_each(i, action_entry, action) {
+ if (i && action_entry->hw_stats != last_hw_stats) {
+ NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported");
+ return false;
+ }
+ last_hw_stats = action_entry->hw_stats;
}
- last_hw_stats = action_entry->hw_stats;
}
return true;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 172/266] sctp: validate from_addr_param return
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 171/266] flow_offload: action should not be NULL when it is referenced Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 173/266] sctp: add size validation when walking chunks Greg Kroah-Hartman
` (97 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilja Van Sprundel,
Marcelo Ricardo Leitner, David S. Miller, Sasha Levin
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
[ Upstream commit 0c5dc070ff3d6246d22ddd931f23a6266249e3db ]
Ilja reported that, simply putting it, nothing was validating that
from_addr_param functions were operating on initialized memory. That is,
the parameter itself was being validated by sctp_walk_params, but it
doesn't check for types and their specific sizes and it could be a 0-length
one, causing from_addr_param to potentially work over the next parameter or
even uninitialized memory.
The fix here is to, in all calls to from_addr_param, check if enough space
is there for the wanted IP address type.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sctp/structs.h | 2 +-
net/sctp/bind_addr.c | 19 +++++++++++--------
net/sctp/input.c | 6 ++++--
net/sctp/ipv6.c | 7 ++++++-
net/sctp/protocol.c | 7 ++++++-
net/sctp/sm_make_chunk.c | 29 ++++++++++++++++-------------
6 files changed, 44 insertions(+), 26 deletions(-)
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 1aa585216f34..d49593c72a55 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -461,7 +461,7 @@ struct sctp_af {
int saddr);
void (*from_sk) (union sctp_addr *,
struct sock *sk);
- void (*from_addr_param) (union sctp_addr *,
+ bool (*from_addr_param) (union sctp_addr *,
union sctp_addr_param *,
__be16 port, int iif);
int (*to_addr_param) (const union sctp_addr *,
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 53e5ed79f63f..59e653b528b1 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -270,22 +270,19 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
rawaddr = (union sctp_addr_param *)raw_addr_list;
af = sctp_get_af_specific(param_type2af(param->type));
- if (unlikely(!af)) {
+ if (unlikely(!af) ||
+ !af->from_addr_param(&addr, rawaddr, htons(port), 0)) {
retval = -EINVAL;
- sctp_bind_addr_clean(bp);
- break;
+ goto out_err;
}
- af->from_addr_param(&addr, rawaddr, htons(port), 0);
if (sctp_bind_addr_state(bp, &addr) != -1)
goto next;
retval = sctp_add_bind_addr(bp, &addr, sizeof(addr),
SCTP_ADDR_SRC, gfp);
- if (retval) {
+ if (retval)
/* Can't finish building the list, clean up. */
- sctp_bind_addr_clean(bp);
- break;
- }
+ goto out_err;
next:
len = ntohs(param->length);
@@ -294,6 +291,12 @@ next:
}
return retval;
+
+out_err:
+ if (retval)
+ sctp_bind_addr_clean(bp);
+
+ return retval;
}
/********************************************************************
diff --git a/net/sctp/input.c b/net/sctp/input.c
index d508f6f3dd08..8924e2e142c8 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -1131,7 +1131,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
if (!af)
continue;
- af->from_addr_param(paddr, params.addr, sh->source, 0);
+ if (!af->from_addr_param(paddr, params.addr, sh->source, 0))
+ continue;
asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
if (asoc)
@@ -1174,7 +1175,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
if (unlikely(!af))
return NULL;
- af->from_addr_param(&paddr, param, peer_port, 0);
+ if (af->from_addr_param(&paddr, param, peer_port, 0))
+ return NULL;
return __sctp_lookup_association(net, laddr, &paddr, transportp);
}
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index bd08807c9e44..5c6f5ced9cfa 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -551,15 +551,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
}
/* Initialize a sctp_addr from an address parameter. */
-static void sctp_v6_from_addr_param(union sctp_addr *addr,
+static bool sctp_v6_from_addr_param(union sctp_addr *addr,
union sctp_addr_param *param,
__be16 port, int iif)
{
+ if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param))
+ return false;
+
addr->v6.sin6_family = AF_INET6;
addr->v6.sin6_port = port;
addr->v6.sin6_flowinfo = 0; /* BUG */
addr->v6.sin6_addr = param->v6.addr;
addr->v6.sin6_scope_id = iif;
+
+ return true;
}
/* Initialize an address parameter from a sctp_addr and return the length
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 6f2bbfeec3a4..25192b378e2e 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -254,14 +254,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
}
/* Initialize a sctp_addr from an address parameter. */
-static void sctp_v4_from_addr_param(union sctp_addr *addr,
+static bool sctp_v4_from_addr_param(union sctp_addr *addr,
union sctp_addr_param *param,
__be16 port, int iif)
{
+ if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param))
+ return false;
+
addr->v4.sin_family = AF_INET;
addr->v4.sin_port = port;
addr->v4.sin_addr.s_addr = param->v4.addr.s_addr;
memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+
+ return true;
}
/* Initialize an address parameter from a sctp_addr and return the length
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 5b44d228b6ca..f33a870b483d 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2346,11 +2346,13 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
/* Process the initialization parameters. */
sctp_walk_params(param, peer_init, init_hdr.params) {
- if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
- param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
+ if (!src_match &&
+ (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
+ param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
af = sctp_get_af_specific(param_type2af(param.p->type));
- af->from_addr_param(&addr, param.addr,
- chunk->sctp_hdr->source, 0);
+ if (!af->from_addr_param(&addr, param.addr,
+ chunk->sctp_hdr->source, 0))
+ continue;
if (sctp_cmp_addr_exact(sctp_source(chunk), &addr))
src_match = 1;
}
@@ -2531,7 +2533,8 @@ static int sctp_process_param(struct sctp_association *asoc,
break;
do_addr_param:
af = sctp_get_af_specific(param_type2af(param.p->type));
- af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0);
+ if (!af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0))
+ break;
scope = sctp_scope(peer_addr);
if (sctp_in_scope(net, &addr, scope))
if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED))
@@ -2632,15 +2635,13 @@ do_addr_param:
addr_param = param.v + sizeof(struct sctp_addip_param);
af = sctp_get_af_specific(param_type2af(addr_param->p.type));
- if (af == NULL)
+ if (!af)
break;
- af->from_addr_param(&addr, addr_param,
- htons(asoc->peer.port), 0);
+ if (!af->from_addr_param(&addr, addr_param,
+ htons(asoc->peer.port), 0))
+ break;
- /* if the address is invalid, we can't process it.
- * XXX: see spec for what to do.
- */
if (!af->addr_valid(&addr, NULL, NULL))
break;
@@ -3054,7 +3055,8 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
if (unlikely(!af))
return SCTP_ERROR_DNS_FAILED;
- af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0);
+ if (!af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0))
+ return SCTP_ERROR_DNS_FAILED;
/* ADDIP 4.2.1 This parameter MUST NOT contain a broadcast
* or multicast address.
@@ -3331,7 +3333,8 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,
/* We have checked the packet before, so we do not check again. */
af = sctp_get_af_specific(param_type2af(addr_param->p.type));
- af->from_addr_param(&addr, addr_param, htons(bp->port), 0);
+ if (!af->from_addr_param(&addr, addr_param, htons(bp->port), 0))
+ return;
switch (asconf_param->param_hdr.type) {
case SCTP_PARAM_ADD_IP:
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 173/266] sctp: add size validation when walking chunks
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 172/266] sctp: validate from_addr_param return Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 174/266] MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops Greg Kroah-Hartman
` (96 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilja Van Sprundel,
Marcelo Ricardo Leitner, David S. Miller, Sasha Levin
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
[ Upstream commit 50619dbf8db77e98d821d615af4f634d08e22698 ]
The first chunk in a packet is ensured to be present at the beginning of
sctp_rcv(), as a packet needs to have at least 1 chunk. But the second
one, may not be completely available and ch->length can be over
uninitialized memory.
Fix here is by only trying to walk on the next chunk if there is enough to
hold at least the header, and then proceed with the ch->length validation
that is already there.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 8924e2e142c8..f72bff93745c 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -1247,7 +1247,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
ch = (struct sctp_chunkhdr *)ch_end;
chunk_num++;
- } while (ch_end < skb_tail_pointer(skb));
+ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
return asoc;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 174/266] MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 173/266] sctp: add size validation when walking chunks Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 175/266] MIPS: set mips32r5 for virt extensions Greg Kroah-Hartman
` (95 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, zhanglianjie, Thomas Bogendoerfer,
Sasha Levin
From: zhanglianjie <zhanglianjie@uniontech.com>
[ Upstream commit 6817c944430d00f71ccaa9c99ff5b0096aeb7873 ]
The cause of the problem is as follows:
1. when cat /sys/devices/system/memory/memory0/valid_zones,
test_pages_in_a_zone() will be called.
2. test_pages_in_a_zone() finds the zone according to stat_pfn = 0.
The smallest pfn of the numa node in the mips architecture is 128,
and the page corresponding to the previous 0~127 pfn is not
initialized (page->flags is 0xFFFFFFFF)
3. The nid and zonenum obtained using page_zone(pfn_to_page(0)) are out
of bounds in the corresponding array,
&NODE_DATA(page_to_nid(page))->node_zones[page_zonenum(page)],
access to the out-of-bounds zone member variables appear abnormal,
resulting in Oops.
Therefore, it is necessary to keep the page between 0 and the minimum
pfn to prevent Oops from appearing.
Signed-off-by: zhanglianjie <zhanglianjie@uniontech.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/loongson64/numa.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/mips/loongson64/numa.c b/arch/mips/loongson64/numa.c
index fa9b4a487a47..e8e3e48c5333 100644
--- a/arch/mips/loongson64/numa.c
+++ b/arch/mips/loongson64/numa.c
@@ -129,6 +129,9 @@ static void __init node_mem_init(unsigned int node)
if (node_end_pfn(0) >= (0xffffffff >> PAGE_SHIFT))
memblock_reserve((node_addrspace_offset | 0xfe000000),
32 << 20);
+
+ /* Reserve pfn range 0~node[0]->node_start_pfn */
+ memblock_reserve(0, PAGE_SIZE * start_pfn);
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 175/266] MIPS: set mips32r5 for virt extensions
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 174/266] MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 176/266] MIPS: CI20: Reduce clocksource to 750 kHz Greg Kroah-Hartman
` (94 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Golovin, Nick Desaulniers,
Thomas Bogendoerfer, Sasha Levin
From: Nick Desaulniers <ndesaulniers@google.com>
[ Upstream commit c994a3ec7ecc8bd2a837b2061e8a76eb8efc082b ]
Clang's integrated assembler only accepts these instructions when the
cpu is set to mips32r5. With this change, we can assemble
malta_defconfig with Clang via `make LLVM_IAS=1`.
Link: https://github.com/ClangBuiltLinux/linux/issues/763
Reported-by: Dmitry Golovin <dima@golovin.in>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/asm/mipsregs.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 9c8099a6ffed..acdf8c69220b 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -2077,7 +2077,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c)
({ int __res; \
__asm__ __volatile__( \
".set\tpush\n\t" \
- ".set\tmips32r2\n\t" \
+ ".set\tmips32r5\n\t" \
_ASM_SET_VIRT \
"mfgc0\t%0, " #source ", %1\n\t" \
".set\tpop" \
@@ -2090,7 +2090,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c)
({ unsigned long long __res; \
__asm__ __volatile__( \
".set\tpush\n\t" \
- ".set\tmips64r2\n\t" \
+ ".set\tmips64r5\n\t" \
_ASM_SET_VIRT \
"dmfgc0\t%0, " #source ", %1\n\t" \
".set\tpop" \
@@ -2103,7 +2103,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c)
do { \
__asm__ __volatile__( \
".set\tpush\n\t" \
- ".set\tmips32r2\n\t" \
+ ".set\tmips32r5\n\t" \
_ASM_SET_VIRT \
"mtgc0\t%z0, " #register ", %1\n\t" \
".set\tpop" \
@@ -2115,7 +2115,7 @@ do { \
do { \
__asm__ __volatile__( \
".set\tpush\n\t" \
- ".set\tmips64r2\n\t" \
+ ".set\tmips64r5\n\t" \
_ASM_SET_VIRT \
"dmtgc0\t%z0, " #register ", %1\n\t" \
".set\tpop" \
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 176/266] MIPS: CI20: Reduce clocksource to 750 kHz.
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 175/266] MIPS: set mips32r5 for virt extensions Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 177/266] PCI: tegra194: Fix host initialization during resume Greg Kroah-Hartman
` (93 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikolaus Schaller,
周琰杰 ,
Paul Cercueil, Thomas Bogendoerfer, Sasha Levin
From: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
[ Upstream commit 23c64447b3538a6f34cb38aae3bc19dc1ec53436 ]
The original clock (3 MHz) is too fast for the clocksource,
there will be a chance that the system may get stuck.
Reported-by: Nikolaus Schaller <hns@goldelico.com>
Tested-by: Nikolaus Schaller <hns@goldelico.com> # on CI20
Signed-off-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
Acked-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/ingenic/ci20.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
index 8877c62609de..3a4eaf1f3f48 100644
--- a/arch/mips/boot/dts/ingenic/ci20.dts
+++ b/arch/mips/boot/dts/ingenic/ci20.dts
@@ -525,10 +525,10 @@
&tcu {
/*
- * 750 kHz for the system timer and 3 MHz for the clocksource,
+ * 750 kHz for the system timer and clocksource,
* use channel #0 for the system timer, #1 for the clocksource.
*/
assigned-clocks = <&tcu TCU_CLK_TIMER0>, <&tcu TCU_CLK_TIMER1>,
<&tcu TCU_CLK_OST>;
- assigned-clock-rates = <750000>, <3000000>, <3000000>;
+ assigned-clock-rates = <750000>, <750000>, <3000000>;
};
--
2.30.2
^ permalink raw reply related [flat|nested] 277+ messages in thread* [PATCH 5.13 177/266] PCI: tegra194: Fix host initialization during resume
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 176/266] MIPS: CI20: Reduce clocksource to 750 kHz Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 178/266] MIPS: MT extensions are not available on MIPS32r1 Greg Kroah-Hartman
` (92 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jon Hunter, Vidya Sagar,
Lorenzo Pieralisi, Bjorn Helgaas
From: Vidya Sagar <vidyas@nvidia.com>
commit c4bf1f25c6c187864681d5ad4dd1fa92f62d5d32 upstream.
Commit 275e88b06a27 ("PCI: tegra: Fix host link initialization") broke
host initialization during resume as it misses out calling the API
dw_pcie_setup_rc() which is required for host and MSI initialization.
Link: https://lore.kernel.org/r/20210504172157.29712-1-vidyas@nvidia.com
Fixes: 275e88b06a27 ("PCI: tegra: Fix host link initialization")
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pcie-tegra194.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -2214,6 +2214,8 @@ static int tegra_pcie_dw_resume_noirq(st
goto fail_host_init;
}
+ dw_pcie_setup_rc(&pcie->pci.pp);
+
ret = tegra_pcie_dw_start_link(&pcie->pci);
if (ret < 0)
goto fail_host_init;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 178/266] MIPS: MT extensions are not available on MIPS32r1
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 177/266] PCI: tegra194: Fix host initialization during resume Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 179/266] mm/mremap: hold the rmap lock in write mode when moving page table entries Greg Kroah-Hartman
` (91 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Thomas Bogendoerfer
From: Paul Cercueil <paul@crapouillou.net>
commit cad065ed8d8831df67b9754cc4437ed55d8b48c0 upstream.
MIPS MT extensions were added with the MIPS 34K processor, which was
based on the MIPS32r2 ISA.
This fixes a build error when building a generic kernel for a MIPS32r1
CPU.
Fixes: c434b9f80b09 ("MIPS: Kconfig: add MIPS_GENERIC_KERNEL symbol")
Cc: stable@vger.kernel.org # v5.9
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/include/asm/cpu-features.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -64,6 +64,8 @@
((MIPS_ISA_REV >= (ge)) && (MIPS_ISA_REV < (lt)))
#define __isa_range_or_flag(ge, lt, flag) \
(__isa_range(ge, lt) || ((MIPS_ISA_REV < (lt)) && __isa(flag)))
+#define __isa_range_and_ase(ge, lt, ase) \
+ (__isa_range(ge, lt) && __ase(ase))
/*
* SMP assumption: Options of CPU 0 are a superset of all processors.
@@ -421,7 +423,7 @@
#endif
#ifndef cpu_has_mipsmt
-#define cpu_has_mipsmt __isa_lt_and_ase(6, MIPS_ASE_MIPSMT)
+#define cpu_has_mipsmt __isa_range_and_ase(2, 6, MIPS_ASE_MIPSMT)
#endif
#ifndef cpu_has_vp
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 179/266] mm/mremap: hold the rmap lock in write mode when moving page table entries.
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 178/266] MIPS: MT extensions are not available on MIPS32r1 Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 180/266] powerpc/mm: Fix lockup on kernel exec fault Greg Kroah-Hartman
` (90 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Hugh Dickins,
Kirill A. Shutemov, Christophe Leroy, Joel Fernandes,
Kalesh Singh, Kirill A. Shutemov, Michael Ellerman,
Nicholas Piggin, Stephen Rothwell, Andrew Morton, Linus Torvalds
From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
commit 97113eb39fa7972722ff490b947d8af023e1f6a2 upstream.
To avoid a race between rmap walk and mremap, mremap does
take_rmap_locks(). The lock was taken to ensure that rmap walk don't miss
a page table entry due to PTE moves via move_pagetables(). The kernel
does further optimization of this lock such that if we are going to find
the newly added vma after the old vma, the rmap lock is not taken. This
is because rmap walk would find the vmas in the same order and if we don't
find the page table attached to older vma we would find it with the new
vma which we would iterate later.
As explained in commit eb66ae030829 ("mremap: properly flush TLB before
releasing the page") mremap is special in that it doesn't take ownership
of the page. The optimized version for PUD/PMD aligned mremap also
doesn't hold the ptl lock. This can result in stale TLB entries as show
below.
This patch updates the rmap locking requirement in mremap to handle the race condition
explained below with optimized mremap::
Optmized PMD move
CPU 1 CPU 2 CPU 3
mremap(old_addr, new_addr) page_shrinker/try_to_unmap_one
mmap_write_lock_killable()
addr = old_addr
lock(pte_ptl)
lock(pmd_ptl)
pmd = *old_pmd
pmd_clear(old_pmd)
flush_tlb_range(old_addr)
*new_pmd = pmd
*new_addr = 10; and fills
TLB with new addr
and old pfn
unlock(pmd_ptl)
ptep_clear_flush()
old pfn is free.
Stale TLB entry
Optimized PUD move also suffers from a similar race. Both the above race
condition can be fixed if we force mremap path to take rmap lock.
Link: https://lkml.kernel.org/r/20210616045239.370802-7-aneesh.kumar@linux.ibm.com
Fixes: 2c91bd4a4e2e ("mm: speed up mremap by 20x on large regions")
Fixes: c49dd3401802 ("mm: speedup mremap on 1GB or larger regions")
Link: https://lore.kernel.org/linux-mm/CAHk-=wgXVR04eBNtxQfevontWnP6FDm+oj5vauQXP3S-huwbPw@mail.gmail.com
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Acked-by: Hugh Dickins <hughd@google.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mremap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -439,7 +439,7 @@ unsigned long move_page_tables(struct vm
if (!new_pud)
break;
if (move_pgt_entry(NORMAL_PUD, vma, old_addr, new_addr,
- old_pud, new_pud, need_rmap_locks))
+ old_pud, new_pud, true))
continue;
}
@@ -466,7 +466,7 @@ unsigned long move_page_tables(struct vm
* moving at the PMD level if possible.
*/
if (move_pgt_entry(NORMAL_PMD, vma, old_addr, new_addr,
- old_pmd, new_pmd, need_rmap_locks))
+ old_pmd, new_pmd, true))
continue;
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 180/266] powerpc/mm: Fix lockup on kernel exec fault
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 179/266] mm/mremap: hold the rmap lock in write mode when moving page table entries Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 181/266] powerpc/bpf: Reject atomic ops in ppc32 JIT Greg Kroah-Hartman
` (89 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Nicholas Piggin,
Michael Ellerman
From: Christophe Leroy <christophe.leroy@csgroup.eu>
commit cd5d5e602f502895e47e18cd46804d6d7014e65c upstream.
The powerpc kernel is not prepared to handle exec faults from kernel.
Especially, the function is_exec_fault() will return 'false' when an
exec fault is taken by kernel, because the check is based on reading
current->thread.regs->trap which contains the trap from user.
For instance, when provoking a LKDTM EXEC_USERSPACE test,
current->thread.regs->trap is set to SYSCALL trap (0xc00), and
the fault taken by the kernel is not seen as an exec fault by
set_access_flags_filter().
Commit d7df2443cd5f ("powerpc/mm: Fix spurious segfaults on radix
with autonuma") made it clear and handled it properly. But later on
commit d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute
faults") removed that handling, introducing test based on error_code.
And here is the problem, because on the 603 all upper bits of SRR1
get cleared when the TLB instruction miss handler bails out to ISI.
Until commit cbd7e6ca0210 ("powerpc/fault: Avoid heavy
search_exception_tables() verification"), an exec fault from kernel
at a userspace address was indirectly caught by the lack of entry for
that address in the exception tables. But after that commit the
kernel mainly relies on KUAP or on core mm handling to catch wrong
user accesses. Here the access is not wrong, so mm handles it.
It is a minor fault because PAGE_EXEC is not set,
set_access_flags_filter() should set PAGE_EXEC and voila.
But as is_exec_fault() returns false as explained in the beginning,
set_access_flags_filter() bails out without setting PAGE_EXEC flag,
which leads to a forever minor exec fault.
As the kernel is not prepared to handle such exec faults, the thing to
do is to fire in bad_kernel_fault() for any exec fault taken by the
kernel, as it was prior to commit d3ca587404b3.
Fixes: d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults")
Cc: stable@vger.kernel.org # v4.14+
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/024bb05105050f704743a0083fe3548702be5706.1625138205.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/fault.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -199,9 +199,7 @@ static bool bad_kernel_fault(struct pt_r
{
int is_exec = TRAP(regs) == INTERRUPT_INST_STORAGE;
- /* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */
- if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT |
- DSISR_PROTFAULT))) {
+ if (is_exec) {
pr_crit_ratelimited("kernel tried to execute %s page (%lx) - exploit attempt? (uid: %d)\n",
address >= TASK_SIZE ? "exec-protected" : "user",
address,
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 181/266] powerpc/bpf: Reject atomic ops in ppc32 JIT
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 180/266] powerpc/mm: Fix lockup on kernel exec fault Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 182/266] powerpc/xive: Fix error handling when allocating an IPI Greg Kroah-Hartman
` (88 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Naveen N. Rao, Michael Ellerman
From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
commit 307e5042c7bdae15308ef2e9b848833b84122eb0 upstream.
Commit 91c960b0056672 ("bpf: Rename BPF_XADD and prepare to encode other
atomics in .imm") converted BPF_XADD to BPF_ATOMIC and updated all JIT
implementations to reject JIT'ing instructions with an immediate value
different from BPF_ADD. However, ppc32 BPF JIT was implemented around
the same time and didn't include the same change. Update the ppc32 JIT
accordingly.
Fixes: 51c66ad849a7 ("powerpc/bpf: Implement extended BPF on PPC32")
Cc: stable@vger.kernel.org # v5.13+
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/426699046d89fe50f66ecf74bd31c01eda976ba5.1625145429.git.naveen.n.rao@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/net/bpf_jit_comp32.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
--- a/arch/powerpc/net/bpf_jit_comp32.c
+++ b/arch/powerpc/net/bpf_jit_comp32.c
@@ -773,9 +773,17 @@ int bpf_jit_build_body(struct bpf_prog *
break;
/*
- * BPF_STX XADD (atomic_add)
+ * BPF_STX ATOMIC (atomic ops)
*/
- case BPF_STX | BPF_XADD | BPF_W: /* *(u32 *)(dst + off) += src */
+ case BPF_STX | BPF_ATOMIC | BPF_W:
+ if (imm != BPF_ADD) {
+ pr_err_ratelimited("eBPF filter atomic op code %02x (@%d) unsupported\n",
+ code, i);
+ return -ENOTSUPP;
+ }
+
+ /* *(u32 *)(dst + off) += src */
+
bpf_set_seen_register(ctx, tmp_reg);
/* Get offset into TMP_REG */
EMIT(PPC_RAW_LI(tmp_reg, off));
@@ -789,7 +797,7 @@ int bpf_jit_build_body(struct bpf_prog *
PPC_BCC_SHORT(COND_NE, (ctx->idx - 3) * 4);
break;
- case BPF_STX | BPF_XADD | BPF_DW: /* *(u64 *)(dst + off) += src */
+ case BPF_STX | BPF_ATOMIC | BPF_DW: /* *(u64 *)(dst + off) += src */
return -EOPNOTSUPP;
/*
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 182/266] powerpc/xive: Fix error handling when allocating an IPI
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 181/266] powerpc/bpf: Reject atomic ops in ppc32 JIT Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 183/266] powerpc/barrier: Avoid collision with clangs __lwsync macro Greg Kroah-Hartman
` (87 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot,
Cédric Le Goater, Michael Ellerman
From: Cédric Le Goater <clg@kaod.org>
commit 3f601608b71c3ca1e199898cd16f09d707fedb56 upstream.
This is a smatch warning:
arch/powerpc/sysdev/xive/common.c:1161 xive_request_ipi() warn: unsigned 'xid->irq' is never less than zero.
Fixes: fd6db2892eba ("powerpc/xive: Modernize XIVE-IPI domain with an 'alloc' handler")
Cc: stable@vger.kernel.org # v5.13
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210701152412.1507612-1-clg@kaod.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/sysdev/xive/common.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -1153,11 +1153,10 @@ static int __init xive_request_ipi(void)
* Since the HW interrupt number doesn't have any meaning,
* simply use the node number.
*/
- xid->irq = irq_domain_alloc_irqs(ipi_domain, 1, node, &info);
- if (xid->irq < 0) {
- ret = xid->irq;
+ ret = irq_domain_alloc_irqs(ipi_domain, 1, node, &info);
+ if (ret < 0)
goto out_free_xive_ipis;
- }
+ xid->irq = ret;
snprintf(xid->name, sizeof(xid->name), "IPI-%d", node);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 183/266] powerpc/barrier: Avoid collision with clangs __lwsync macro
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 182/266] powerpc/xive: Fix error handling when allocating an IPI Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:38 ` [PATCH 5.13 184/266] powerpc/powernv/vas: Release reference to tgid during window close Greg Kroah-Hartman
` (86 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Nick Desaulniers,
Michael Ellerman
From: Nathan Chancellor <nathan@kernel.org>
commit 015d98149b326e0f1f02e44413112ca8b4330543 upstream.
A change in clang 13 results in the __lwsync macro being defined as
__builtin_ppc_lwsync, which emits 'lwsync' or 'msync' depending on what
the target supports. This breaks the build because of -Werror in
arch/powerpc, along with thousands of warnings:
In file included from arch/powerpc/kernel/pmc.c:12:
In file included from include/linux/bug.h:5:
In file included from arch/powerpc/include/asm/bug.h:109:
In file included from include/asm-generic/bug.h:20:
In file included from include/linux/kernel.h:12:
In file included from include/linux/bitops.h:32:
In file included from arch/powerpc/include/asm/bitops.h:62:
arch/powerpc/include/asm/barrier.h:49:9: error: '__lwsync' macro redefined [-Werror,-Wmacro-redefined]
#define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory")
^
<built-in>:308:9: note: previous definition is here
#define __lwsync __builtin_ppc_lwsync
^
1 error generated.
Undefine this macro so that the runtime patching introduced by
commit 2d1b2027626d ("powerpc: Fixup lwsync at runtime") continues to
work properly with clang and the build no longer breaks.
Cc: stable@vger.kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://github.com/ClangBuiltLinux/linux/issues/1386
Link: https://github.com/llvm/llvm-project/commit/62b5df7fe2b3fda1772befeda15598fbef96a614
Link: https://lore.kernel.org/r/20210528182752.1852002-1-nathan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/barrier.h | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/powerpc/include/asm/barrier.h
+++ b/arch/powerpc/include/asm/barrier.h
@@ -46,6 +46,8 @@
# define SMPWMB eieio
#endif
+/* clang defines this macro for a builtin, which will not work with runtime patching */
+#undef __lwsync
#define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory")
#define dma_rmb() __lwsync()
#define dma_wmb() __asm__ __volatile__ (stringify_in_c(SMPWMB) : : :"memory")
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 184/266] powerpc/powernv/vas: Release reference to tgid during window close
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 183/266] powerpc/barrier: Avoid collision with clangs __lwsync macro Greg Kroah-Hartman
@ 2021-07-15 18:38 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 185/266] drm/amdgpu: add new dimgrey cavefish DID Greg Kroah-Hartman
` (85 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:38 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Piggin, Haren Myneni,
Michael Ellerman
From: Haren Myneni <haren@linux.ibm.com>
commit 91cdbb955aa94ee0841af4685be40937345d29b8 upstream.
The kernel handles the NX fault by updating CSB or sending
signal to process. In multithread applications, children can
open VAS windows and can exit without closing them. But the
parent can continue to send NX requests with these windows. To
prevent pid reuse, reference will be taken on pid and tgid
when the window is opened and release them during window close.
The current code is not releasing the tgid reference which can
cause pid leak and this patch fixes the issue.
Fixes: db1c08a740635 ("powerpc/vas: Take reference to PID and mm for user space windows")
Cc: stable@vger.kernel.org # 5.8+
Reported-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Haren Myneni <haren@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/6020fc4d444864fe20f7dcdc5edfe53e67480a1c.camel@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powernv/vas-window.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/arch/powerpc/platforms/powernv/vas-window.c
+++ b/arch/powerpc/platforms/powernv/vas-window.c
@@ -1093,9 +1093,9 @@ struct vas_window *vas_tx_win_open(int v
/*
* Process closes window during exit. In the case of
* multithread application, the child thread can open
- * window and can exit without closing it. Expects parent
- * thread to use and close the window. So do not need
- * to take pid reference for parent thread.
+ * window and can exit without closing it. so takes tgid
+ * reference until window closed to make sure tgid is not
+ * reused.
*/
txwin->tgid = find_get_pid(task_tgid_vnr(current));
/*
@@ -1339,8 +1339,9 @@ int vas_win_close(struct vas_window *win
/* if send window, drop reference to matching receive window */
if (window->tx_win) {
if (window->user_win) {
- /* Drop references to pid and mm */
+ /* Drop references to pid. tgid and mm */
put_pid(window->pid);
+ put_pid(window->tgid);
if (window->mm) {
mm_context_remove_vas_window(window->mm);
mmdrop(window->mm);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 185/266] drm/amdgpu: add new dimgrey cavefish DID
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2021-07-15 18:38 ` [PATCH 5.13 184/266] powerpc/powernv/vas: Release reference to tgid during window close Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 186/266] drm/amdgpu: Update NV SIMD-per-CU to 2 Greg Kroah-Hartman
` (84 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Guchun Chen, Alex Deucher
From: Alex Deucher <alexander.deucher@amd.com>
commit 06ac9b6c736ac9da600b1782d7ac6d6e746286c4 upstream.
Add new PCI device id.
Reviewed-by: Guchun Chen <guchun.chen@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -1179,6 +1179,7 @@ static const struct pci_device_id pciidl
{0x1002, 0x73E0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH},
{0x1002, 0x73E1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH},
{0x1002, 0x73E2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH},
+ {0x1002, 0x73E3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH},
{0x1002, 0x73FF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_DIMGREY_CAVEFISH},
/* Aldebaran */
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 186/266] drm/amdgpu: Update NV SIMD-per-CU to 2
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 185/266] drm/amdgpu: add new dimgrey cavefish DID Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 187/266] drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2) Greg Kroah-Hartman
` (83 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joseph Greathouse, Alex Deucher,
Felix Kuehling
From: Joseph Greathouse <Joseph.Greathouse@amd.com>
commit aa6158112645aae514982ad8d56df64428fcf203 upstream.
Navi series GPUs have 2 SIMDs per CU (and then 2 CUs per WGP).
The NV enum headers incorrectly listed this as 4, which later meant
we were incorrectly reporting the number of SIMDs in the HSA
topology. This could cause problems down the line for user-space
applications that want to launch a fixed amount of work to each
SIMD.
Signed-off-by: Joseph Greathouse <Joseph.Greathouse@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/include/navi10_enum.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/include/navi10_enum.h
+++ b/drivers/gpu/drm/amd/include/navi10_enum.h
@@ -430,7 +430,7 @@ ARRAY_2D_DEPTH
*/
typedef enum ENUM_NUM_SIMD_PER_CU {
-NUM_SIMD_PER_CU = 0x00000004,
+NUM_SIMD_PER_CU = 0x00000002,
} ENUM_NUM_SIMD_PER_CU;
/*
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 187/266] drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2)
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 186/266] drm/amdgpu: Update NV SIMD-per-CU to 2 Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 188/266] drm/amdgpu: fix NAK-G generation during PCI-e link width switch Greg Kroah-Hartman
` (82 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aaron Liu, Luben Tuikov, Alex Deucher
From: Aaron Liu <aaron.liu@amd.com>
commit e2329e74a615cc58b25c42b7aa1477a5e3f6a435 upstream.
Without driver loaded, SDMA0_UTCL1_PAGE.TMZ_ENABLE is set to 1
by default for all asic. On Raven/Renoir, the sdma goldsetting
changes SDMA0_UTCL1_PAGE.TMZ_ENABLE to 0.
This patch restores SDMA0_UTCL1_PAGE.TMZ_ENABLE to 1.
Signed-off-by: Aaron Liu <aaron.liu@amd.com>
Acked-by: Luben Tuikov <luben.tuikov@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -144,7 +144,7 @@ static const struct soc15_reg_golden gol
SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC0_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_IB_CNTL, 0x800f0111, 0x00000100),
SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
- SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003e0),
SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000)
};
@@ -288,7 +288,7 @@ static const struct soc15_reg_golden gol
SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_POWER_CNTL, 0x003fff07, 0x40000051),
SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC0_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000),
- SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003e0),
SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x03fbe1fe)
};
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 188/266] drm/amdgpu: fix NAK-G generation during PCI-e link width switch
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 187/266] drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2) Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 189/266] drm/amdgpu: fix the hang caused by PCIe " Greg Kroah-Hartman
` (81 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Evan Quan, Lijo Lazar, Alex Deucher
From: Evan Quan <evan.quan@amd.com>
commit 5a5da8ae9546031e43efd4fa5aa8baa481e83dfb upstream.
A lot of NAK-G being generated when link widht switching is happening.
WA for this issue is to program the SPC to 4 symbols per clock during
bootup when the native PCIE width is x4.
Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_nbio.h | 1 +
drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c | 28 ++++++++++++++++++++++++++++
drivers/gpu/drm/amd/amdgpu/nv.c | 3 +++
3 files changed, 32 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_nbio.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_nbio.h
@@ -93,6 +93,7 @@ struct amdgpu_nbio_funcs {
void (*enable_aspm)(struct amdgpu_device *adev,
bool enable);
void (*program_aspm)(struct amdgpu_device *adev);
+ void (*apply_lc_spc_mode_wa)(struct amdgpu_device *adev);
};
struct amdgpu_nbio {
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c
@@ -51,6 +51,8 @@
#define mmBIF_MMSCH1_DOORBELL_RANGE 0x01d8
#define mmBIF_MMSCH1_DOORBELL_RANGE_BASE_IDX 2
+#define smnPCIE_LC_LINK_WIDTH_CNTL 0x11140288
+
static void nbio_v2_3_remap_hdp_registers(struct amdgpu_device *adev)
{
WREG32_SOC15(NBIO, 0, mmREMAP_HDP_MEM_FLUSH_CNTL,
@@ -463,6 +465,31 @@ static void nbio_v2_3_program_aspm(struc
WREG32_PCIE(smnPCIE_LC_CNTL3, data);
}
+static void nbio_v2_3_apply_lc_spc_mode_wa(struct amdgpu_device *adev)
+{
+ uint32_t reg_data = 0;
+ uint32_t link_width = 0;
+
+ if (!((adev->asic_type >= CHIP_NAVI10) &&
+ (adev->asic_type <= CHIP_NAVI12)))
+ return;
+
+ reg_data = RREG32_PCIE(smnPCIE_LC_LINK_WIDTH_CNTL);
+ link_width = (reg_data & PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK)
+ >> PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT;
+
+ /*
+ * Program PCIE_LC_CNTL6.LC_SPC_MODE_8GT to 0x2 (4 symbols per clock data)
+ * if link_width is 0x3 (x4)
+ */
+ if (0x3 == link_width) {
+ reg_data = RREG32_PCIE(smnPCIE_LC_CNTL6);
+ reg_data &= ~PCIE_LC_CNTL6__LC_SPC_MODE_8GT_MASK;
+ reg_data |= (0x2 << PCIE_LC_CNTL6__LC_SPC_MODE_8GT__SHIFT);
+ WREG32_PCIE(smnPCIE_LC_CNTL6, reg_data);
+ }
+}
+
const struct amdgpu_nbio_funcs nbio_v2_3_funcs = {
.get_hdp_flush_req_offset = nbio_v2_3_get_hdp_flush_req_offset,
.get_hdp_flush_done_offset = nbio_v2_3_get_hdp_flush_done_offset,
@@ -484,4 +511,5 @@ const struct amdgpu_nbio_funcs nbio_v2_3
.remap_hdp_registers = nbio_v2_3_remap_hdp_registers,
.enable_aspm = nbio_v2_3_enable_aspm,
.program_aspm = nbio_v2_3_program_aspm,
+ .apply_lc_spc_mode_wa = nbio_v2_3_apply_lc_spc_mode_wa,
};
--- a/drivers/gpu/drm/amd/amdgpu/nv.c
+++ b/drivers/gpu/drm/amd/amdgpu/nv.c
@@ -1194,6 +1194,9 @@ static int nv_common_hw_init(void *handl
{
struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+ if (adev->nbio.funcs->apply_lc_spc_mode_wa)
+ adev->nbio.funcs->apply_lc_spc_mode_wa(adev);
+
/* enable pcie gen2/3 link */
nv_pcie_gen3_enable(adev);
/* enable aspm */
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 189/266] drm/amdgpu: fix the hang caused by PCIe link width switch
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 188/266] drm/amdgpu: fix NAK-G generation during PCI-e link width switch Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 190/266] drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create() Greg Kroah-Hartman
` (80 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Evan Quan, Lijo Lazar, Alex Deucher
From: Evan Quan <evan.quan@amd.com>
commit adcf949e664a8b04df2fb8aa916892e58561653c upstream.
SMU had set all the necessary fields for a link width switch
but the width switch wasn't occurring because the link was idle
in the L1 state. Setting LC_L1_RECONFIG_EN=0x1 will allow width
switches to also be initiated while in L1 instead of waiting until
the link is back in L0.
Signed-off-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_nbio.h | 1 +
drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c | 13 +++++++++++++
drivers/gpu/drm/amd/amdgpu/nv.c | 3 +++
3 files changed, 17 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_nbio.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_nbio.h
@@ -94,6 +94,7 @@ struct amdgpu_nbio_funcs {
bool enable);
void (*program_aspm)(struct amdgpu_device *adev);
void (*apply_lc_spc_mode_wa)(struct amdgpu_device *adev);
+ void (*apply_l1_link_width_reconfig_wa)(struct amdgpu_device *adev);
};
struct amdgpu_nbio {
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c
@@ -490,6 +490,18 @@ static void nbio_v2_3_apply_lc_spc_mode_
}
}
+static void nbio_v2_3_apply_l1_link_width_reconfig_wa(struct amdgpu_device *adev)
+{
+ uint32_t reg_data = 0;
+
+ if (adev->asic_type != CHIP_NAVI10)
+ return;
+
+ reg_data = RREG32_PCIE(smnPCIE_LC_LINK_WIDTH_CNTL);
+ reg_data |= PCIE_LC_LINK_WIDTH_CNTL__LC_L1_RECONFIG_EN_MASK;
+ WREG32_PCIE(smnPCIE_LC_LINK_WIDTH_CNTL, reg_data);
+}
+
const struct amdgpu_nbio_funcs nbio_v2_3_funcs = {
.get_hdp_flush_req_offset = nbio_v2_3_get_hdp_flush_req_offset,
.get_hdp_flush_done_offset = nbio_v2_3_get_hdp_flush_done_offset,
@@ -512,4 +524,5 @@ const struct amdgpu_nbio_funcs nbio_v2_3
.enable_aspm = nbio_v2_3_enable_aspm,
.program_aspm = nbio_v2_3_program_aspm,
.apply_lc_spc_mode_wa = nbio_v2_3_apply_lc_spc_mode_wa,
+ .apply_l1_link_width_reconfig_wa = nbio_v2_3_apply_l1_link_width_reconfig_wa,
};
--- a/drivers/gpu/drm/amd/amdgpu/nv.c
+++ b/drivers/gpu/drm/amd/amdgpu/nv.c
@@ -1197,6 +1197,9 @@ static int nv_common_hw_init(void *handl
if (adev->nbio.funcs->apply_lc_spc_mode_wa)
adev->nbio.funcs->apply_lc_spc_mode_wa(adev);
+ if (adev->nbio.funcs->apply_l1_link_width_reconfig_wa)
+ adev->nbio.funcs->apply_l1_link_width_reconfig_wa(adev);
+
/* enable pcie gen2/3 link */
nv_pcie_gen3_enable(adev);
/* enable aspm */
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 190/266] drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 189/266] drm/amdgpu: fix the hang caused by PCIe " Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 191/266] drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64 Greg Kroah-Hartman
` (79 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian König, Jing Xiangfeng,
Alex Deucher
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
commit 9ba85914c36c8fed9bf3e8b69c0782908c1247b7 upstream.
radeon_user_framebuffer_create() misses to call drm_gem_object_put() in
an error path. Add the missed function call to fix it.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_display.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1325,6 +1325,7 @@ radeon_user_framebuffer_create(struct dr
/* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */
if (obj->import_attach) {
DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n");
+ drm_gem_object_put(obj);
return ERR_PTR(-EINVAL);
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 191/266] drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 190/266] drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create() Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 192/266] drm/vc4: txp: Properly set the possible_crtcs mask Greg Kroah-Hartman
` (78 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jianmin Lv, Tiezhu Yang, Alex Deucher
From: Tiezhu Yang <yangtiezhu@loongson.cn>
commit c1bfd74bfef77bcefc88d12eaf8996c0dfd51331 upstream.
On the Loongson64 platform used with Radeon GPU, shutdown or reboot failed
when console=tty is in the boot cmdline.
radeon_suspend_kms() puts the hw in the suspend state, especially set fb
state as FBINFO_STATE_SUSPENDED:
if (fbcon) {
console_lock();
radeon_fbdev_set_suspend(rdev, 1);
console_unlock();
}
Then avoid to do any more fb operations in the related functions:
if (p->state != FBINFO_STATE_RUNNING)
return;
So call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64 to fix
this issue, it looks like some kind of workaround like powerpc.
Co-developed-by: Jianmin Lv <lvjianmin@loongson.cn>
Signed-off-by: Jianmin Lv <lvjianmin@loongson.cn>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_drv.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -386,13 +386,13 @@ radeon_pci_shutdown(struct pci_dev *pdev
if (radeon_device_is_virtual())
radeon_pci_remove(pdev);
-#ifdef CONFIG_PPC64
+#if defined(CONFIG_PPC64) || defined(CONFIG_MACH_LOONGSON64)
/*
* Some adapters need to be suspended before a
* shutdown occurs in order to prevent an error
- * during kexec.
- * Make this power specific becauase it breaks
- * some non-power boards.
+ * during kexec, shutdown or reboot.
+ * Make this power and Loongson specific because
+ * it breaks some other boards.
*/
radeon_suspend_kms(pci_get_drvdata(pdev), true, true, false);
#endif
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 192/266] drm/vc4: txp: Properly set the possible_crtcs mask
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 191/266] drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64 Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 193/266] drm/vc4: crtc: Skip the TXP Greg Kroah-Hartman
` (77 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Zimmermann, Maxime Ripard
From: Maxime Ripard <maxime@cerno.tech>
commit bf6de8e61509f3c957d7f75f017b18d40a18a950 upstream.
The current code does a binary OR on the possible_crtcs variable of the
TXP encoder, while we want to set it to that value instead.
Cc: <stable@vger.kernel.org> # v5.9+
Fixes: 39fcb2808376 ("drm/vc4: txp: Turn the TXP into a CRTC of its own")
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20210507150515.257424-2-maxime@cerno.tech
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vc4/vc4_txp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/vc4/vc4_txp.c
+++ b/drivers/gpu/drm/vc4/vc4_txp.c
@@ -507,7 +507,7 @@ static int vc4_txp_bind(struct device *d
return ret;
encoder = &txp->connector.encoder;
- encoder->possible_crtcs |= drm_crtc_mask(crtc);
+ encoder->possible_crtcs = drm_crtc_mask(crtc);
ret = devm_request_irq(dev, irq, vc4_txp_interrupt, 0,
dev_name(dev), txp);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 193/266] drm/vc4: crtc: Skip the TXP
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 192/266] drm/vc4: txp: Properly set the possible_crtcs mask Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 194/266] drm/vc4: hdmi: Prevent clock unbalance Greg Kroah-Hartman
` (76 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Zimmermann, Maxime Ripard
From: Maxime Ripard <maxime@cerno.tech>
commit 47a50743031ad4138050ae6d266ddd3dfe845ead upstream.
The vc4_set_crtc_possible_masks is meant to run over all the encoders
and then set their possible_crtcs mask to their associated pixelvalve.
However, since the commit 39fcb2808376 ("drm/vc4: txp: Turn the TXP into
a CRTC of its own"), the TXP has been turned to a CRTC and encoder of
its own, and while it does indeed register an encoder, it no longer has
an associated pixelvalve. The code will thus run over the TXP encoder
and set a bogus possible_crtcs mask, overriding the one set in the TXP
bind function.
In order to fix this, let's skip any virtual encoder.
Cc: <stable@vger.kernel.org> # v5.9+
Fixes: 39fcb2808376 ("drm/vc4: txp: Turn the TXP into a CRTC of its own")
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20210507150515.257424-3-maxime@cerno.tech
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vc4/vc4_crtc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -1076,6 +1076,9 @@ static void vc4_set_crtc_possible_masks(
struct vc4_encoder *vc4_encoder;
int i;
+ if (encoder->encoder_type == DRM_MODE_ENCODER_VIRTUAL)
+ continue;
+
vc4_encoder = to_vc4_encoder(encoder);
for (i = 0; i < ARRAY_SIZE(pv_data->encoder_types); i++) {
if (vc4_encoder->type == encoder_types[i]) {
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 194/266] drm/vc4: hdmi: Prevent clock unbalance
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 193/266] drm/vc4: crtc: Skip the TXP Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 195/266] drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info() Greg Kroah-Hartman
` (75 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Dave Stevenson
From: Maxime Ripard <maxime@cerno.tech>
commit 5b006000423667ef0f55721fc93e477b31f22d28 upstream.
Since we fixed the hooks to disable the encoder at boot, we now have an
unbalanced clk_disable call at boot since we never enabled them in the
first place.
Let's mimic the state of the hardware and enable the clocks at boot if
the controller is enabled to get the use-count right.
Cc: <stable@vger.kernel.org> # v5.10+
Fixes: 09c438139b8f ("drm/vc4: hdmi: Implement finer-grained hooks")
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210507150515.257424-7-maxime@cerno.tech
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -2012,6 +2012,14 @@ static int vc4_hdmi_bind(struct device *
if (vc4_hdmi->variant->reset)
vc4_hdmi->variant->reset(vc4_hdmi);
+ if ((of_device_is_compatible(dev->of_node, "brcm,bcm2711-hdmi0") ||
+ of_device_is_compatible(dev->of_node, "brcm,bcm2711-hdmi1")) &&
+ HDMI_READ(HDMI_VID_CTL) & VC4_HD_VID_CTL_ENABLE) {
+ clk_prepare_enable(vc4_hdmi->pixel_clock);
+ clk_prepare_enable(vc4_hdmi->hsm_clock);
+ clk_prepare_enable(vc4_hdmi->pixel_bvb_clock);
+ }
+
pm_runtime_enable(dev);
drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_TMDS);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 195/266] drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 194/266] drm/vc4: hdmi: Prevent clock unbalance Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 196/266] drm/rockchip: dsi: remove extra component_del() call Greg Kroah-Hartman
` (74 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lyude Paul,
Jérôme de Bretagne, Ville Syrjälä
From: Lyude Paul <lyude@redhat.com>
commit 205bb69a90363541a634a662a599fddb95956524 upstream.
While the DP specification isn't entirely clear on if this should be
allowed or not, some branch devices report having downstream ports present
while also reporting a downstream port count of 0. So to avoid breaking
those devices, we need to handle this in drm_dp_read_downstream_info().
So, to do this we assume there's no downstream port info when the
downstream port count is 0.
Signed-off-by: Lyude Paul <lyude@redhat.com>
Tested-by: Jérôme de Bretagne <jerome.debretagne@gmail.com>
Bugzilla: https://gitlab.freedesktop.org/drm/intel/-/issues/3416
Fixes: 3d3721ccb18a ("drm/i915/dp: Extract drm_dp_read_downstream_info()")
Cc: <stable@vger.kernel.org> # v5.10+
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210430223428.10514-1-lyude@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_dp_helper.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -679,7 +679,14 @@ int drm_dp_read_downstream_info(struct d
!(dpcd[DP_DOWNSTREAMPORT_PRESENT] & DP_DWN_STRM_PORT_PRESENT))
return 0;
+ /* Some branches advertise having 0 downstream ports, despite also advertising they have a
+ * downstream port present. The DP spec isn't clear on if this is allowed or not, but since
+ * some branches do it we need to handle it regardless.
+ */
len = drm_dp_downstream_port_count(dpcd);
+ if (!len)
+ return 0;
+
if (dpcd[DP_DOWNSTREAMPORT_PRESENT] & DP_DETAILED_CAP_INFO_AVAILABLE)
len *= 4;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 196/266] drm/rockchip: dsi: remove extra component_del() call
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 195/266] drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info() Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 197/266] drm/amd/display: fix incorrrect valid irq check Greg Kroah-Hartman
` (73 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Hebb, Heiko Stuebner
From: Thomas Hebb <tommyhebb@gmail.com>
commit b354498bbe65c917d521b3b56317ddc9ab217425 upstream.
commit cf6d100dd238 ("drm/rockchip: dsi: add dual mipi support") added
this devcnt field and call to component_del(). However, these both
appear to be erroneous changes left over from an earlier version of the
patch. In the version merged, nothing ever modifies devcnt, meaning
component_del() runs unconditionally and in addition to the
component_del() calls in dw_mipi_dsi_rockchip_host_detach(). The second
call fails to delete anything and produces a warning in dmesg.
If we look at the previous version of the patch[1], however, we see that
it had logic to calculate devcnt and call component_add() in certain
situations. This was removed in v6, and the fact that the deletion code
was not appears to have been an oversight.
[1] https://patchwork.kernel.org/project/dri-devel/patch/20180821140515.22246-8-heiko@sntech.de/
Fixes: cf6d100dd238 ("drm/rockchip: dsi: add dual mipi support")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/201385acb0eeb5dfb037afdc6a94bfbcdab97f99.1618797778.git.tommyhebb@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 4 ----
1 file changed, 4 deletions(-)
--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
@@ -243,7 +243,6 @@ struct dw_mipi_dsi_rockchip {
struct dw_mipi_dsi *dmd;
const struct rockchip_dw_dsi_chip_data *cdata;
struct dw_mipi_dsi_plat_data pdata;
- int devcnt;
};
struct dphy_pll_parameter_map {
@@ -1141,9 +1140,6 @@ static int dw_mipi_dsi_rockchip_remove(s
{
struct dw_mipi_dsi_rockchip *dsi = platform_get_drvdata(pdev);
- if (dsi->devcnt == 0)
- component_del(dsi->dev, &dw_mipi_dsi_rockchip_ops);
-
dw_mipi_dsi_remove(dsi->dmd);
return 0;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 197/266] drm/amd/display: fix incorrrect valid irq check
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 196/266] drm/rockchip: dsi: remove extra component_del() call Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 198/266] pinctrl/amd: Add device HID for new AMD GPIO controller Greg Kroah-Hartman
` (72 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Guchun Chen, Harry Wentland,
Alex Deucher, Evan Quan
From: Guchun Chen <guchun.chen@amd.com>
commit e38ca7e422791a4d1c01e56dbf7f9982db0ed365 upstream.
valid DAL irq should be < DAL_IRQ_SOURCES_NUMBER.
Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Reviewed-and-tested-by: Evan Quan <evan.quan@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/irq_types.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/dc/irq_types.h
+++ b/drivers/gpu/drm/amd/display/dc/irq_types.h
@@ -165,7 +165,7 @@ enum irq_type
};
#define DAL_VALID_IRQ_SRC_NUM(src) \
- ((src) <= DAL_IRQ_SOURCES_NUMBER && (src) > DC_IRQ_SOURCE_INVALID)
+ ((src) < DAL_IRQ_SOURCES_NUMBER && (src) > DC_IRQ_SOURCE_INVALID)
/* Number of Page Flip IRQ Sources. */
#define DAL_PFLIP_IRQ_SRC_NUM \
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 198/266] pinctrl/amd: Add device HID for new AMD GPIO controller
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 197/266] drm/amd/display: fix incorrrect valid irq check Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 199/266] drm/amd/display: Reject non-zero src_y and src_x for video planes Greg Kroah-Hartman
` (71 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sachi King, Maximilian Luz, Linus Walleij
From: Maximilian Luz <luzmaximilian@gmail.com>
commit 1ca46d3e43569186bd1decfb02a6b4c4ddb4304b upstream.
Add device HID AMDI0031 to the AMD GPIO controller driver match table.
This controller can be found on Microsoft Surface Laptop 4 devices and
seems similar enough that we can just copy the existing AMDI0030 entry.
Cc: <stable@vger.kernel.org> # 5.10+
Tested-by: Sachi King <nakato@nakato.io>
Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
Link: https://lore.kernel.org/r/20210512210316.1982416-1-luzmaximilian@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/pinctrl-amd.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -991,6 +991,7 @@ static int amd_gpio_remove(struct platfo
static const struct acpi_device_id amd_gpio_acpi_match[] = {
{ "AMD0030", 0 },
{ "AMDI0030", 0},
+ { "AMDI0031", 0},
{ },
};
MODULE_DEVICE_TABLE(acpi, amd_gpio_acpi_match);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 199/266] drm/amd/display: Reject non-zero src_y and src_x for video planes
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 198/266] pinctrl/amd: Add device HID for new AMD GPIO controller Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 200/266] drm/ingenic: Fix pixclock rate for 24-bit serial panels Greg Kroah-Hartman
` (70 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Harry Wentland, nicholas.kazlauskas,
amd-gfx, alexander.deucher, Roman.Li, hersenxs.wu, danny.wang,
Christian König
From: Harry Wentland <harry.wentland@amd.com>
commit c6c6a712199ab355ce333fa5764a59506bb107c1 upstream.
[Why]
This hasn't been well tested and leads to complete system hangs on DCN1
based systems, possibly others.
The system hang can be reproduced by gesturing the video on the YouTube
Android app on ChromeOS into full screen.
[How]
Reject atomic commits with non-zero drm_plane_state.src_x or src_y values.
v2:
- Add code comment describing the reason we're rejecting non-zero
src_x and src_y
- Drop gerrit Change-Id
- Add stable CC
- Based on amd-staging-drm-next
v3: removed trailing whitespace
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Cc: stable@vger.kernel.org
Cc: nicholas.kazlauskas@amd.com
Cc: amd-gfx@lists.freedesktop.org
Cc: alexander.deucher@amd.com
Cc: Roman.Li@amd.com
Cc: hersenxs.wu@amd.com
Cc: danny.wang@amd.com
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4049,6 +4049,23 @@ static int fill_dc_scaling_info(const st
scaling_info->src_rect.y != 0))
return -EINVAL;
+ /*
+ * For reasons we don't (yet) fully understand a non-zero
+ * src_y coordinate into an NV12 buffer can cause a
+ * system hang. To avoid hangs (and maybe be overly cautious)
+ * let's reject both non-zero src_x and src_y.
+ *
+ * We currently know of only one use-case to reproduce a
+ * scenario with non-zero src_x and src_y for NV12, which
+ * is to gesture the YouTube Android app into full screen
+ * on ChromeOS.
+ */
+ if (state->fb &&
+ state->fb->format->format == DRM_FORMAT_NV12 &&
+ (scaling_info->src_rect.x != 0 ||
+ scaling_info->src_rect.y != 0))
+ return -EINVAL;
+
scaling_info->src_rect.width = state->src_w >> 16;
if (scaling_info->src_rect.width == 0)
return -EINVAL;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 200/266] drm/ingenic: Fix pixclock rate for 24-bit serial panels
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 199/266] drm/amd/display: Reject non-zero src_y and src_x for video planes Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 201/266] drm/tegra: Dont set allow_fb_modifiers explicitly Greg Kroah-Hartman
` (69 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Thomas Zimmermann,
H . Nikolaus Schaller
From: Paul Cercueil <paul@crapouillou.net>
commit 60a6b73dd821e98fe958b2a83393ccd724b306b1 upstream.
When using a 24-bit panel on a 8-bit serial bus, the pixel clock
requested by the panel has to be multiplied by 3, since the subpixels
are shifted sequentially.
The code (in ingenic_drm_encoder_atomic_check) already computed
crtc_state->adjusted_mode->crtc_clock accordingly, but clk_set_rate()
used crtc_state->adjusted_mode->clock instead.
Fixes: 28ab7d35b6e0 ("drm/ingenic: Properly compute timings when using a 3x8-bit panel")
Cc: stable@vger.kernel.org # v5.10
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Tested-by: H. Nikolaus Schaller <hns@goldelico.com> # CI20/jz4780 (HDMI) and Alpha400/jz4730 (LCD)
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20210323144008.166248-1-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
+++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
@@ -342,7 +342,7 @@ static void ingenic_drm_crtc_atomic_flus
if (priv->update_clk_rate) {
mutex_lock(&priv->clk_mutex);
clk_set_rate(priv->pix_clk,
- crtc_state->adjusted_mode.clock * 1000);
+ crtc_state->adjusted_mode.crtc_clock * 1000);
priv->update_clk_rate = false;
mutex_unlock(&priv->clk_mutex);
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 201/266] drm/tegra: Dont set allow_fb_modifiers explicitly
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 200/266] drm/ingenic: Fix pixclock rate for 24-bit serial panels Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 202/266] drm/msm/mdp4: Fix modifier support enabling Greg Kroah-Hartman
` (68 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pekka Paalanen, Thierry Reding,
Daniel Vetter, Thierry Reding, Jonathan Hunter, linux-tegra
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit be4306ad928fcf736cbe2616b6dd19d91f1bc083 upstream.
Since
commit 890880ddfdbe256083170866e49c87618b706ac7
Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Date: Fri Jan 4 09:56:10 2019 +0100
drm: Auto-set allow_fb_modifiers when given modifiers at plane init
this is done automatically as part of plane init, if drivers set the
modifier list correctly. Which is the case here.
It was slightly inconsistently though, since planes with only linear
modifier support haven't listed that explicitly. Fix that, and cc:
stable to allow userspace to rely on this. Again don't backport
further than where Paul's patch got added.
Cc: stable@vger.kernel.org # v5.1 +
Cc: Pekka Paalanen <pekka.paalanen@collabora.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: Jonathan Hunter <jonathanh@nvidia.com>
Cc: linux-tegra@vger.kernel.org
Link: https://patchwork.freedesktop.org/patch/msgid/20210413094904.3736372-10-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/tegra/dc.c | 10 ++++++++--
drivers/gpu/drm/tegra/drm.c | 2 --
2 files changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -999,6 +999,11 @@ static const struct drm_plane_helper_fun
.atomic_disable = tegra_cursor_atomic_disable,
};
+static const uint64_t linear_modifiers[] = {
+ DRM_FORMAT_MOD_LINEAR,
+ DRM_FORMAT_MOD_INVALID
+};
+
static struct drm_plane *tegra_dc_cursor_plane_create(struct drm_device *drm,
struct tegra_dc *dc)
{
@@ -1032,7 +1037,7 @@ static struct drm_plane *tegra_dc_cursor
err = drm_universal_plane_init(drm, &plane->base, possible_crtcs,
&tegra_plane_funcs, formats,
- num_formats, NULL,
+ num_formats, linear_modifiers,
DRM_PLANE_TYPE_CURSOR, NULL);
if (err < 0) {
kfree(plane);
@@ -1151,7 +1156,8 @@ static struct drm_plane *tegra_dc_overla
err = drm_universal_plane_init(drm, &plane->base, possible_crtcs,
&tegra_plane_funcs, formats,
- num_formats, NULL, type, NULL);
+ num_formats, linear_modifiers,
+ type, NULL);
if (err < 0) {
kfree(plane);
return ERR_PTR(err);
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -1124,8 +1124,6 @@ static int host1x_drm_probe(struct host1
drm->mode_config.max_width = 0;
drm->mode_config.max_height = 0;
- drm->mode_config.allow_fb_modifiers = true;
-
drm->mode_config.normalize_zpos = true;
drm->mode_config.funcs = &tegra_drm_mode_config_funcs;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 202/266] drm/msm/mdp4: Fix modifier support enabling
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 201/266] drm/tegra: Dont set allow_fb_modifiers explicitly Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 203/266] drm/arm/malidp: Always list modifiers Greg Kroah-Hartman
` (67 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pekka Paalanen, Lyude Paul,
Rob Clark, Jordan Crouse, Emil Velikov, Sam Ravnborg,
Daniel Vetter
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit 35cbb8c91e9cf310277d3dfb4d046df8edf2df33 upstream.
Setting the cap without the modifier list is very confusing to
userspace. Fix that by listing the ones we support explicitly.
Stable backport so that userspace can rely on this working in a
reasonable way, i.e. that the cap set implies IN_FORMATS is available.
Acked-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Cc: stable@vger.kernel.org
Cc: Pekka Paalanen <pekka.paalanen@collabora.com>
Cc: Rob Clark <robdclark@chromium.org>
Cc: Jordan Crouse <jordan@cosmicpenguin.net>
Cc: Emil Velikov <emil.velikov@collabora.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210427092018.832258-5-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 2 --
drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c | 8 +++++++-
2 files changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
@@ -88,8 +88,6 @@ static int mdp4_hw_init(struct msm_kms *
if (mdp4_kms->rev > 1)
mdp4_write(mdp4_kms, REG_MDP4_RESET_STATUS, 1);
- dev->mode_config.allow_fb_modifiers = true;
-
out:
pm_runtime_put_sync(dev->dev);
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c
@@ -349,6 +349,12 @@ enum mdp4_pipe mdp4_plane_pipe(struct dr
return mdp4_plane->pipe;
}
+static const uint64_t supported_format_modifiers[] = {
+ DRM_FORMAT_MOD_SAMSUNG_64_32_TILE,
+ DRM_FORMAT_MOD_LINEAR,
+ DRM_FORMAT_MOD_INVALID
+};
+
/* initialize plane */
struct drm_plane *mdp4_plane_init(struct drm_device *dev,
enum mdp4_pipe pipe_id, bool private_plane)
@@ -377,7 +383,7 @@ struct drm_plane *mdp4_plane_init(struct
type = private_plane ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
ret = drm_universal_plane_init(dev, plane, 0xff, &mdp4_plane_funcs,
mdp4_plane->formats, mdp4_plane->nformats,
- NULL, type, NULL);
+ supported_format_modifiers, type, NULL);
if (ret)
goto fail;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 203/266] drm/arm/malidp: Always list modifiers
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 202/266] drm/msm/mdp4: Fix modifier support enabling Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 204/266] drm/nouveau: Dont set allow_fb_modifiers explicitly Greg Kroah-Hartman
` (66 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liviu Dudau, Pekka Paalanen,
Lyude Paul, Brian Starkey, Daniel Vetter
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit 26c3e7fd5a3499e408915dadae5d5360790aae9a upstream.
Even when all we support is linear, make that explicit. Otherwise the
uapi is rather confusing.
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Acked-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Cc: stable@vger.kernel.org
Cc: Pekka Paalanen <pekka.paalanen@collabora.com>
Cc: Liviu Dudau <liviu.dudau@arm.com>
Cc: Brian Starkey <brian.starkey@arm.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210427092018.832258-2-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/arm/malidp_planes.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -927,6 +927,11 @@ static const struct drm_plane_helper_fun
.atomic_disable = malidp_de_plane_disable,
};
+static const uint64_t linear_only_modifiers[] = {
+ DRM_FORMAT_MOD_LINEAR,
+ DRM_FORMAT_MOD_INVALID
+};
+
int malidp_de_planes_init(struct drm_device *drm)
{
struct malidp_drm *malidp = drm->dev_private;
@@ -990,8 +995,8 @@ int malidp_de_planes_init(struct drm_dev
*/
ret = drm_universal_plane_init(drm, &plane->base, crtcs,
&malidp_de_plane_funcs, formats, n,
- (id == DE_SMART) ? NULL : modifiers, plane_type,
- NULL);
+ (id == DE_SMART) ? linear_only_modifiers : modifiers,
+ plane_type, NULL);
if (ret < 0)
goto cleanup;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 204/266] drm/nouveau: Dont set allow_fb_modifiers explicitly
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 203/266] drm/arm/malidp: Always list modifiers Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 205/266] drm/ingenic: Switch IPU plane to type OVERLAY Greg Kroah-Hartman
` (65 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lyude Paul, Pekka Paalanen,
Daniel Vetter, Ben Skeggs, nouveau
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit cee93c028288b9af02919f3bd8593ba61d1e610d upstream.
Since
commit 890880ddfdbe256083170866e49c87618b706ac7
Author: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Date: Fri Jan 4 09:56:10 2019 +0100
drm: Auto-set allow_fb_modifiers when given modifiers at plane init
this is done automatically as part of plane init, if drivers set the
modifier list correctly. Which is the case here.
Note that this fixes an inconsistency: We've set the cap everywhere,
but only nv50+ supports modifiers. Hence cc stable, but not further
back then the patch from Paul.
Reviewed-by: Lyude Paul <lyude@redhat.com>
Cc: stable@vger.kernel.org # v5.1 +
Cc: Pekka Paalanen <pekka.paalanen@collabora.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: nouveau@lists.freedesktop.org
Link: https://patchwork.freedesktop.org/patch/msgid/20210427092018.832258-6-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_display.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -697,7 +697,6 @@ nouveau_display_create(struct drm_device
dev->mode_config.preferred_depth = 24;
dev->mode_config.prefer_shadow = 1;
- dev->mode_config.allow_fb_modifiers = true;
if (drm->client.device.info.chipset < 0x11)
dev->mode_config.async_page_flip = false;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 205/266] drm/ingenic: Switch IPU plane to type OVERLAY
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 204/266] drm/nouveau: Dont set allow_fb_modifiers explicitly Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 206/266] drm/i915/display: Do not zero past infoframes.vsc Greg Kroah-Hartman
` (64 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Cercueil, Simon Ser
From: Paul Cercueil <paul@crapouillou.net>
commit 68b433fe6937cfa3f8975d18643d5956254edd6a upstream.
It should have been an OVERLAY from the beginning. The documentation
stipulates that there should be an unique PRIMARY plane per CRTC.
Fixes: fc1acf317b01 ("drm/ingenic: Add support for the IPU")
Cc: <stable@vger.kernel.org> # 5.8+
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Acked-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/20210329175046.214629-2-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 11 +++++------
drivers/gpu/drm/ingenic/ingenic-ipu.c | 2 +-
2 files changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
+++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
@@ -419,7 +419,7 @@ static void ingenic_drm_plane_enable(str
unsigned int en_bit;
if (priv->soc_info->has_osd) {
- if (plane->type == DRM_PLANE_TYPE_PRIMARY)
+ if (plane != &priv->f0)
en_bit = JZ_LCD_OSDC_F1EN;
else
en_bit = JZ_LCD_OSDC_F0EN;
@@ -434,7 +434,7 @@ void ingenic_drm_plane_disable(struct de
unsigned int en_bit;
if (priv->soc_info->has_osd) {
- if (plane->type == DRM_PLANE_TYPE_PRIMARY)
+ if (plane != &priv->f0)
en_bit = JZ_LCD_OSDC_F1EN;
else
en_bit = JZ_LCD_OSDC_F0EN;
@@ -461,8 +461,7 @@ void ingenic_drm_plane_config(struct dev
ingenic_drm_plane_enable(priv, plane);
- if (priv->soc_info->has_osd &&
- plane->type == DRM_PLANE_TYPE_PRIMARY) {
+ if (priv->soc_info->has_osd && plane != &priv->f0) {
switch (fourcc) {
case DRM_FORMAT_XRGB1555:
ctrl |= JZ_LCD_OSDCTRL_RGB555;
@@ -510,7 +509,7 @@ void ingenic_drm_plane_config(struct dev
}
if (priv->soc_info->has_osd) {
- if (plane->type == DRM_PLANE_TYPE_PRIMARY) {
+ if (plane != &priv->f0) {
xy_reg = JZ_REG_LCD_XYP1;
size_reg = JZ_REG_LCD_SIZE1;
} else {
@@ -561,7 +560,7 @@ static void ingenic_drm_plane_atomic_upd
height = newstate->src_h >> 16;
cpp = newstate->fb->format->cpp[0];
- if (!priv->soc_info->has_osd || plane->type == DRM_PLANE_TYPE_OVERLAY)
+ if (!priv->soc_info->has_osd || plane == &priv->f0)
hwdesc = &priv->dma_hwdescs->hwdesc_f0;
else
hwdesc = &priv->dma_hwdescs->hwdesc_f1;
--- a/drivers/gpu/drm/ingenic/ingenic-ipu.c
+++ b/drivers/gpu/drm/ingenic/ingenic-ipu.c
@@ -767,7 +767,7 @@ static int ingenic_ipu_bind(struct devic
err = drm_universal_plane_init(drm, plane, 1, &ingenic_ipu_plane_funcs,
soc_info->formats, soc_info->num_formats,
- NULL, DRM_PLANE_TYPE_PRIMARY, NULL);
+ NULL, DRM_PLANE_TYPE_OVERLAY, NULL);
if (err) {
dev_err(dev, "Failed to init plane: %i\n", err);
return err;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 206/266] drm/i915/display: Do not zero past infoframes.vsc
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 205/266] drm/ingenic: Switch IPU plane to type OVERLAY Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 207/266] mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B Greg Kroah-Hartman
` (63 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kees Cook,
José Roberto de Souza, Rodrigo Vivi
From: Kees Cook <keescook@chromium.org>
commit 07b72960d2b4a087ff2445e286159e69742069cc upstream.
intel_dp_vsc_sdp_unpack() was using a memset() size (36, struct dp_sdp)
larger than the destination (24, struct drm_dp_vsc_sdp), clobbering
fields in struct intel_crtc_state after infoframes.vsc. Use the actual
target size for the memset().
Fixes: 1b404b7dbb10 ("drm/i915/dp: Read out DP SDPs")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210617213301.1824728-1-keescook@chromium.org
(cherry picked from commit c88e2647c5bb45d04dc4302018ebe6ebbf331823)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_dp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -2850,7 +2850,7 @@ static int intel_dp_vsc_sdp_unpack(struc
if (size < sizeof(struct dp_sdp))
return -EINVAL;
- memset(vsc, 0, size);
+ memset(vsc, 0, sizeof(*vsc));
if (sdp->sdp_header.HB0 != 0)
return -EINVAL;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 207/266] mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 206/266] drm/i915/display: Do not zero past infoframes.vsc Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 208/266] mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode Greg Kroah-Hartman
` (62 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Adrian Hunter, Ulf Hansson
From: Hans de Goede <hdegoede@redhat.com>
commit 94ee6782e045645abd9180ab9369b01293d862bd upstream.
On the Toshiba Encore 2 WT8-B the microSD slot always reports the card
being write-protected even though microSD cards do not have a write-protect
switch at all.
Add a new DMI_QUIRK_SD_NO_WRITE_PROTECT quirk entry to sdhci-acpi.c's
DMI quirk table for this.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/20210503092157.5689-1-hdegoede@redhat.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-acpi.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/mmc/host/sdhci-acpi.c
+++ b/drivers/mmc/host/sdhci-acpi.c
@@ -822,6 +822,17 @@ static const struct dmi_system_id sdhci_
},
.driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT,
},
+ {
+ /*
+ * The Toshiba WT8-B's microSD slot always reports the card being
+ * write-protected.
+ */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "TOSHIBA ENCORE 2 WT8-B"),
+ },
+ .driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT,
+ },
{} /* Terminating entry */
};
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 208/266] mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 207/266] mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 209/266] mmc: core: clear flags before allowing to retune Greg Kroah-Hartman
` (61 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Al Cooper, Adrian Hunter, Ulf Hansson
From: Al Cooper <alcooperx@gmail.com>
commit d0244847f9fc5e20df8b7483c8a4717fe0432d38 upstream.
When an eMMC device is being run in HS400 mode, any access to the
RPMB device will cause the error message "mmc1: Invalid UHS-I mode
selected". This happens as a result of tuning being disabled before
RPMB access and then re-enabled after the RPMB access is complete.
When tuning is re-enabled, the system has to switch from HS400
to HS200 to do the tuning and then back to HS400. As part of
sequence to switch from HS400 to HS200 the system is temporarily
put into HS mode. When switching to HS mode, sdhci_get_preset_value()
is called and does not have support for HS mode and prints the warning
message and returns the preset for SDR12. The fix is to add support
for MMC and SD HS modes to sdhci_get_preset_value().
This can be reproduced on any system running eMMC in HS400 mode
(not HS400ES) by using the "mmc" utility to run the following
command: "mmc rpmb read-counter /dev/mmcblk0rpmb".
Signed-off-by: Al Cooper <alcooperx@gmail.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: 52983382c74f ("mmc: sdhci: enhance preset value function")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210624163045.33651-1-alcooperx@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci.c | 4 ++++
drivers/mmc/host/sdhci.h | 1 +
2 files changed, 5 insertions(+)
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1812,6 +1812,10 @@ static u16 sdhci_get_preset_value(struct
u16 preset = 0;
switch (host->timing) {
+ case MMC_TIMING_MMC_HS:
+ case MMC_TIMING_SD_HS:
+ preset = sdhci_readw(host, SDHCI_PRESET_FOR_HIGH_SPEED);
+ break;
case MMC_TIMING_UHS_SDR12:
preset = sdhci_readw(host, SDHCI_PRESET_FOR_SDR12);
break;
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -253,6 +253,7 @@
/* 60-FB reserved */
+#define SDHCI_PRESET_FOR_HIGH_SPEED 0x64
#define SDHCI_PRESET_FOR_SDR12 0x66
#define SDHCI_PRESET_FOR_SDR25 0x68
#define SDHCI_PRESET_FOR_SDR50 0x6A
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 209/266] mmc: core: clear flags before allowing to retune
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 208/266] mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 210/266] mmc: core: Allow UHS-I voltage switch for SDSC cards if supported Greg Kroah-Hartman
` (60 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Wolfram Sang,
Yoshihiro Shimoda, Ulf Hansson
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
commit 77347eda64ed5c9383961d1de9165f9d0b7d8df6 upstream.
It might be that something goes wrong during tuning so the MMC core will
immediately trigger a retune. In our case it was:
- we sent a tuning block
- there was an error so we need to send an abort cmd to the eMMC
- the abort cmd had a CRC error
- retune was set by the MMC core
This lead to a vicious circle causing a performance regression of 75%.
So, clear retuning flags before we enable retuning to start with a known
cleared state.
Reported-by Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Fixes: bd11e8bd03ca ("mmc: core: Flag re-tuning is needed on CRC errors")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210624151616.38770-2-wsa+renesas@sang-engineering.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -937,11 +937,14 @@ int mmc_execute_tuning(struct mmc_card *
err = host->ops->execute_tuning(host, opcode);
- if (err)
+ if (err) {
pr_err("%s: tuning execution failed: %d\n",
mmc_hostname(host), err);
- else
+ } else {
+ host->retune_now = 0;
+ host->need_retune = 0;
mmc_retune_enable(host);
+ }
return err;
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 210/266] mmc: core: Allow UHS-I voltage switch for SDSC cards if supported
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 209/266] mmc: core: clear flags before allowing to retune Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 211/266] docs: Makefile: Use CONFIG_SHELL not SHELL Greg Kroah-Hartman
` (59 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christian Loehle, Ulf Hansson
From: Christian Löhle <CLoehle@hyperstone.com>
commit 09247e110b2efce3a104e57e887c373e0a57a412 upstream.
While initializing an UHS-I SD card, the mmc core first tries to switch to
1.8V I/O voltage, before it continues to change the settings for the bus
speed mode.
However, the current behaviour in the mmc core is inconsistent and doesn't
conform to the SD spec. More precisely, an SD card that supports UHS-I must
set both the SD_OCR_CCS bit and the SD_OCR_S18R bit in the OCR register
response. When switching to 1.8V I/O the mmc core correctly checks both of
the bits, but only the SD_OCR_S18R bit when changing the settings for bus
speed mode.
Rather than actually fixing the code to confirm to the SD spec, let's
deliberately deviate from it by requiring only the SD_OCR_S18R bit for both
parts. This enables us to support UHS-I for SDSC cards (outside spec),
which is actually being supported by some existing SDSC cards. Moreover,
this fixes the inconsistent behaviour.
Signed-off-by: Christian Loehle <cloehle@hyperstone.com>
Link: https://lore.kernel.org/r/CWXP265MB26803AE79E0AD5ED083BF2A6C4529@CWXP265MB2680.GBRP265.PROD.OUTLOOK.COM
Cc: stable@vger.kernel.org
[Ulf: Rewrote commit message and comments to clarify the changes]
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/sd.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -847,11 +847,13 @@ try_again:
return err;
/*
- * In case CCS and S18A in the response is set, start Signal Voltage
- * Switch procedure. SPI mode doesn't support CMD11.
+ * In case the S18A bit is set in the response, let's start the signal
+ * voltage switch procedure. SPI mode doesn't support CMD11.
+ * Note that, according to the spec, the S18A bit is not valid unless
+ * the CCS bit is set as well. We deliberately deviate from the spec in
+ * regards to this, which allows UHS-I to be supported for SDSC cards.
*/
- if (!mmc_host_is_spi(host) && rocr &&
- ((*rocr & 0x41000000) == 0x41000000)) {
+ if (!mmc_host_is_spi(host) && rocr && (*rocr & 0x01000000)) {
err = mmc_set_uhs_voltage(host, pocr);
if (err == -EAGAIN) {
retries--;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 211/266] docs: Makefile: Use CONFIG_SHELL not SHELL
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 210/266] mmc: core: Allow UHS-I voltage switch for SDSC cards if supported Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 212/266] ata: ahci_sunxi: Disable DIPM Greg Kroah-Hartman
` (58 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kees Cook, Jonathan Corbet
From: Kees Cook <keescook@chromium.org>
commit 222a28edce38b62074a950fb243df621c602b4d3 upstream.
Fix think-o about which variable to find the Kbuild-configured shell.
This has accidentally worked due to most shells setting $SHELL by
default.
Fixes: 51e46c7a4007 ("docs, parallelism: Rearrange how jobserver reservations are made")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210617225808.3907377-1-keescook@chromium.org
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/Documentation/Makefile
+++ b/Documentation/Makefile
@@ -76,7 +76,7 @@ quiet_cmd_sphinx = SPHINX $@ --> file:/
PYTHONDONTWRITEBYTECODE=1 \
BUILDDIR=$(abspath $(BUILDDIR)) SPHINX_CONF=$(abspath $(srctree)/$(src)/$5/$(SPHINX_CONF)) \
$(PYTHON3) $(srctree)/scripts/jobserver-exec \
- $(SHELL) $(srctree)/Documentation/sphinx/parallel-wrapper.sh \
+ $(CONFIG_SHELL) $(srctree)/Documentation/sphinx/parallel-wrapper.sh \
$(SPHINXBUILD) \
-b $2 \
-c $(abspath $(srctree)/$(src)) \
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 212/266] ata: ahci_sunxi: Disable DIPM
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 211/266] docs: Makefile: Use CONFIG_SHELL not SHELL Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 213/266] arm64: tlb: fix the TTL value of tlb_get_level Greg Kroah-Hartman
` (57 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Timo Sigurdsson, Jens Axboe
From: Timo Sigurdsson <public_timo.s@silentcreek.de>
commit f6bca4d91b2ea052e917cca3f9d866b5cc1d500a upstream.
DIPM is unsupported or broken on sunxi. Trying to enable the power
management policy med_power_with_dipm on an Allwinner A20 SoC based board
leads to immediate I/O errors and the attached SATA disk disappears from
the /dev filesystem. A reset (power cycle) is required to make the SATA
controller or disk work again. The A10 and A20 SoC data sheets and manuals
don't mention DIPM at all [1], so it's fair to assume that it's simply not
supported. But even if it was, it should be considered broken and best be
disabled in the ahci_sunxi driver.
[1] https://github.com/allwinner-zh/documents/tree/master/
Fixes: c5754b5220f0 ("ARM: sunxi: Add support for Allwinner SUNXi SoCs sata to ahci_platform")
Cc: stable@vger.kernel.org
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Tested-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Link: https://lore.kernel.org/r/20210614072539.3307-1-public_timo.s@silentcreek.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/ahci_sunxi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/ata/ahci_sunxi.c
+++ b/drivers/ata/ahci_sunxi.c
@@ -200,7 +200,7 @@ static void ahci_sunxi_start_engine(stru
}
static const struct ata_port_info ahci_sunxi_port_info = {
- .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ,
+ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ | ATA_FLAG_NO_DIPM,
.pio_mask = ATA_PIO4,
.udma_mask = ATA_UDMA6,
.port_ops = &ahci_platform_ops,
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 213/266] arm64: tlb: fix the TTL value of tlb_get_level
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 212/266] ata: ahci_sunxi: Disable DIPM Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 214/266] cpu/hotplug: Cure the cpusets trainwreck Greg Kroah-Hartman
` (56 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, ZhuRui, Zhenyu Ye,
Will Deacon
From: Zhenyu Ye <yezhenyu2@huawei.com>
commit 52218fcd61cb42bde0d301db4acb3ffdf3463cc7 upstream.
The TTL field indicates the level of page table walk holding the *leaf*
entry for the address being invalidated. But currently, the TTL field
may be set to an incorrent value in the following stack:
pte_free_tlb
__pte_free_tlb
tlb_remove_table
tlb_table_invalidate
tlb_flush_mmu_tlbonly
tlb_flush
In this case, we just want to flush a PTE page, but the tlb->cleared_pmds
is set and we get tlb_level = 2 in the tlb_get_level() function. This may
cause some unexpected problems.
This patch set the TTL field to 0 if tlb->freed_tables is set. The
tlb->freed_tables indicates page table pages are freed, not the leaf
entry.
Cc: <stable@vger.kernel.org> # 5.9.x
Fixes: c4ab2cbc1d87 ("arm64: tlb: Set the TTL field in flush_tlb_range")
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: ZhuRui <zhurui3@huawei.com>
Signed-off-by: Zhenyu Ye <yezhenyu2@huawei.com>
Link: https://lore.kernel.org/r/b80ead47-1f88-3a00-18e1-cacc22f54cc4@huawei.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/tlb.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -28,6 +28,10 @@ static void tlb_flush(struct mmu_gather
*/
static inline int tlb_get_level(struct mmu_gather *tlb)
{
+ /* The TTL field is only valid for the leaf entry. */
+ if (tlb->freed_tables)
+ return 0;
+
if (tlb->cleared_ptes && !(tlb->cleared_pmds ||
tlb->cleared_puds ||
tlb->cleared_p4ds))
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 214/266] cpu/hotplug: Cure the cpusets trainwreck
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 213/266] arm64: tlb: fix the TTL value of tlb_get_level Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 215/266] clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround Greg Kroah-Hartman
` (55 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Klimov, Joshua Baker, Thomas Gleixner
From: Thomas Gleixner <tglx@linutronix.de>
commit b22afcdf04c96ca58327784e280e10288cfd3303 upstream.
Alexey and Joshua tried to solve a cpusets related hotplug problem which is
user space visible and results in unexpected behaviour for some time after
a CPU has been plugged in and the corresponding uevent was delivered.
cpusets delegate the hotplug work (rebuilding cpumasks etc.) to a
workqueue. This is done because the cpusets code has already a lock
nesting of cgroups_mutex -> cpu_hotplug_lock. A synchronous callback or
waiting for the work to finish with cpu_hotplug_lock held can and will
deadlock because that results in the reverse lock order.
As a consequence the uevent can be delivered before cpusets have consistent
state which means that a user space invocation of sched_setaffinity() to
move a task to the plugged CPU fails up to the point where the scheduled
work has been processed.
The same is true for CPU unplug, but that does not create user observable
failure (yet).
It's still inconsistent to claim that an operation is finished before it
actually is and that's the real issue at hand. uevents just make it
reliably observable.
Obviously the problem should be fixed in cpusets/cgroups, but untangling
that is pretty much impossible because according to the changelog of the
commit which introduced this 8 years ago:
3a5a6d0c2b03("cpuset: don't nest cgroup_mutex inside get_online_cpus()")
the lock order cgroups_mutex -> cpu_hotplug_lock is a design decision and
the whole code is built around that.
So bite the bullet and invoke the relevant cpuset function, which waits for
the work to finish, in _cpu_up/down() after dropping cpu_hotplug_lock and
only when tasks are not frozen by suspend/hibernate because that would
obviously wait forever.
Waiting there with cpu_add_remove_lock, which is protecting the present
and possible CPU maps, held is not a problem at all because neither work
queues nor cpusets/cgroups have any lockchains related to that lock.
Waiting in the hotplug machinery is not problematic either because there
are already state callbacks which wait for hardware queues to drain. It
makes the operations slightly slower, but hotplug is slow anyway.
This ensures that state is consistent before returning from a hotplug
up/down operation. It's still inconsistent during the operation, but that's
a different story.
Add a large comment which explains why this is done and why this is not a
dump ground for the hack of the day to work around half thought out locking
schemes. Document also the implications vs. hotplug operations and
serialization or the lack of it.
Thanks to Alexy and Joshua for analyzing why this temporary
sched_setaffinity() failure happened.
Fixes: 3a5a6d0c2b03("cpuset: don't nest cgroup_mutex inside get_online_cpus()")
Reported-by: Alexey Klimov <aklimov@redhat.com>
Reported-by: Joshua Baker <jobaker@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Alexey Klimov <aklimov@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87tuowcnv3.ffs@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 49 insertions(+)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -32,6 +32,7 @@
#include <linux/relay.h>
#include <linux/slab.h>
#include <linux/percpu-rwsem.h>
+#include <linux/cpuset.h>
#include <trace/events/power.h>
#define CREATE_TRACE_POINTS
@@ -873,6 +874,52 @@ void __init cpuhp_threads_init(void)
kthread_unpark(this_cpu_read(cpuhp_state.thread));
}
+/*
+ *
+ * Serialize hotplug trainwrecks outside of the cpu_hotplug_lock
+ * protected region.
+ *
+ * The operation is still serialized against concurrent CPU hotplug via
+ * cpu_add_remove_lock, i.e. CPU map protection. But it is _not_
+ * serialized against other hotplug related activity like adding or
+ * removing of state callbacks and state instances, which invoke either the
+ * startup or the teardown callback of the affected state.
+ *
+ * This is required for subsystems which are unfixable vs. CPU hotplug and
+ * evade lock inversion problems by scheduling work which has to be
+ * completed _before_ cpu_up()/_cpu_down() returns.
+ *
+ * Don't even think about adding anything to this for any new code or even
+ * drivers. It's only purpose is to keep existing lock order trainwrecks
+ * working.
+ *
+ * For cpu_down() there might be valid reasons to finish cleanups which are
+ * not required to be done under cpu_hotplug_lock, but that's a different
+ * story and would be not invoked via this.
+ */
+static void cpu_up_down_serialize_trainwrecks(bool tasks_frozen)
+{
+ /*
+ * cpusets delegate hotplug operations to a worker to "solve" the
+ * lock order problems. Wait for the worker, but only if tasks are
+ * _not_ frozen (suspend, hibernate) as that would wait forever.
+ *
+ * The wait is required because otherwise the hotplug operation
+ * returns with inconsistent state, which could even be observed in
+ * user space when a new CPU is brought up. The CPU plug uevent
+ * would be delivered and user space reacting on it would fail to
+ * move tasks to the newly plugged CPU up to the point where the
+ * work has finished because up to that point the newly plugged CPU
+ * is not assignable in cpusets/cgroups. On unplug that's not
+ * necessarily a visible issue, but it is still inconsistent state,
+ * which is the real problem which needs to be "fixed". This can't
+ * prevent the transient state between scheduling the work and
+ * returning from waiting for it.
+ */
+ if (!tasks_frozen)
+ cpuset_wait_for_hotplug();
+}
+
#ifdef CONFIG_HOTPLUG_CPU
#ifndef arch_clear_mm_cpumask_cpu
#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
@@ -1108,6 +1155,7 @@ out:
*/
lockup_detector_cleanup();
arch_smt_update();
+ cpu_up_down_serialize_trainwrecks(tasks_frozen);
return ret;
}
@@ -1302,6 +1350,7 @@ static int _cpu_up(unsigned int cpu, int
out:
cpus_write_unlock();
arch_smt_update();
+ cpu_up_down_serialize_trainwrecks(tasks_frozen);
return ret;
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 215/266] clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 214/266] cpu/hotplug: Cure the cpusets trainwreck Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 216/266] fpga: stratix10-soc: Add missing fpga_mgr_free() call Greg Kroah-Hartman
` (54 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roman Stratiienko, Samuel Holland,
Daniel Lezcano
From: Samuel Holland <samuel@sholland.org>
commit 8b33dfe0ba1c84c1aab2456590b38195837f1e6e upstream.
Bad counter reads are experienced sometimes when bit 10 or greater rolls
over. Originally, testing showed that at least 10 lower bits would be
set to the same value during these bad reads. However, some users still
reported time skips.
Wider testing revealed that on some chips, occasionally only the lowest
9 bits would read as the anomalous value. During these reads (which
still happen only when bit 10), bit 9 would read as the correct value.
Reduce the mask by one bit to cover these cases as well.
Cc: stable@vger.kernel.org
Fixes: c950ca8c35ee ("clocksource/drivers/arch_timer: Workaround for Allwinner A64 timer instability")
Reported-by: Roman Stratiienko <r.stratiienko@gmail.com>
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210515021439.55316-1-samuel@sholland.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clocksource/arm_arch_timer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -365,7 +365,7 @@ static u64 notrace arm64_858921_read_cnt
do { \
_val = read_sysreg(reg); \
_retries--; \
- } while (((_val + 1) & GENMASK(9, 0)) <= 1 && _retries); \
+ } while (((_val + 1) & GENMASK(8, 0)) <= 1 && _retries); \
\
WARN_ON_ONCE(!_retries); \
_val; \
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 216/266] fpga: stratix10-soc: Add missing fpga_mgr_free() call
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 215/266] clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 217/266] ASoC: tegra: Set driver_name=tegra for all machine drivers Greg Kroah-Hartman
` (53 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Russ Weight, Xu Yilun, Moritz Fischer
From: Russ Weight <russell.h.weight@intel.com>
commit d9ec9daa20eb8de1efe6abae78c9835ec8ed86f9 upstream.
The stratix10-soc driver uses fpga_mgr_create() function and is therefore
responsible to call fpga_mgr_free() to release the class driver resources.
Add a missing call to fpga_mgr_free in the s10_remove() function.
Signed-off-by: Russ Weight <russell.h.weight@intel.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Signed-off-by: Moritz Fischer <mdf@kernel.org>
Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210614170909.232415-3-mdf@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/fpga/stratix10-soc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/fpga/stratix10-soc.c
+++ b/drivers/fpga/stratix10-soc.c
@@ -454,6 +454,7 @@ static int s10_remove(struct platform_de
struct s10_priv *priv = mgr->priv;
fpga_mgr_unregister(mgr);
+ fpga_mgr_free(mgr);
stratix10_svc_free_channel(priv->chan);
return 0;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 217/266] ASoC: tegra: Set driver_name=tegra for all machine drivers
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 216/266] fpga: stratix10-soc: Add missing fpga_mgr_free() call Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 218/266] mwifiex: bring down link before deleting interface Greg Kroah-Hartman
` (52 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Mark Brown
From: Dmitry Osipenko <digetx@gmail.com>
commit f6eb84fa596abf28959fc7e0b626f925eb1196c7 upstream.
The driver_name="tegra" is now required by the newer ALSA UCMs, otherwise
Tegra UCMs don't match by the path/name.
All Tegra machine drivers are specifying the card's name, but it has no
effect if model name is specified in the device-tree since it overrides
the card's name. We need to set the driver_name to "tegra" in order to
get a usable lookup path for the updated ALSA UCMs. The new UCM lookup
path has a form of driver_name/card_name.
The old lookup paths that are based on driver module name continue to
work as before. Note that UCM matching never worked for Tegra ASoC drivers
if they were compiled as built-in, this is fixed by supporting the new
naming scheme.
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20210529154649.25936-2-digetx@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/tegra/tegra_alc5632.c | 1 +
sound/soc/tegra/tegra_max98090.c | 1 +
sound/soc/tegra/tegra_rt5640.c | 1 +
sound/soc/tegra/tegra_rt5677.c | 1 +
sound/soc/tegra/tegra_sgtl5000.c | 1 +
sound/soc/tegra/tegra_wm8753.c | 1 +
sound/soc/tegra/tegra_wm8903.c | 1 +
sound/soc/tegra/tegra_wm9712.c | 1 +
sound/soc/tegra/trimslice.c | 1 +
9 files changed, 9 insertions(+)
--- a/sound/soc/tegra/tegra_alc5632.c
+++ b/sound/soc/tegra/tegra_alc5632.c
@@ -139,6 +139,7 @@ static struct snd_soc_dai_link tegra_alc
static struct snd_soc_card snd_soc_tegra_alc5632 = {
.name = "tegra-alc5632",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &tegra_alc5632_dai,
.num_links = 1,
--- a/sound/soc/tegra/tegra_max98090.c
+++ b/sound/soc/tegra/tegra_max98090.c
@@ -182,6 +182,7 @@ static struct snd_soc_dai_link tegra_max
static struct snd_soc_card snd_soc_tegra_max98090 = {
.name = "tegra-max98090",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &tegra_max98090_dai,
.num_links = 1,
--- a/sound/soc/tegra/tegra_rt5640.c
+++ b/sound/soc/tegra/tegra_rt5640.c
@@ -132,6 +132,7 @@ static struct snd_soc_dai_link tegra_rt5
static struct snd_soc_card snd_soc_tegra_rt5640 = {
.name = "tegra-rt5640",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &tegra_rt5640_dai,
.num_links = 1,
--- a/sound/soc/tegra/tegra_rt5677.c
+++ b/sound/soc/tegra/tegra_rt5677.c
@@ -175,6 +175,7 @@ static struct snd_soc_dai_link tegra_rt5
static struct snd_soc_card snd_soc_tegra_rt5677 = {
.name = "tegra-rt5677",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &tegra_rt5677_dai,
.num_links = 1,
--- a/sound/soc/tegra/tegra_sgtl5000.c
+++ b/sound/soc/tegra/tegra_sgtl5000.c
@@ -97,6 +97,7 @@ static struct snd_soc_dai_link tegra_sgt
static struct snd_soc_card snd_soc_tegra_sgtl5000 = {
.name = "tegra-sgtl5000",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &tegra_sgtl5000_dai,
.num_links = 1,
--- a/sound/soc/tegra/tegra_wm8753.c
+++ b/sound/soc/tegra/tegra_wm8753.c
@@ -101,6 +101,7 @@ static struct snd_soc_dai_link tegra_wm8
static struct snd_soc_card snd_soc_tegra_wm8753 = {
.name = "tegra-wm8753",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &tegra_wm8753_dai,
.num_links = 1,
--- a/sound/soc/tegra/tegra_wm8903.c
+++ b/sound/soc/tegra/tegra_wm8903.c
@@ -235,6 +235,7 @@ static struct snd_soc_dai_link tegra_wm8
static struct snd_soc_card snd_soc_tegra_wm8903 = {
.name = "tegra-wm8903",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &tegra_wm8903_dai,
.num_links = 1,
--- a/sound/soc/tegra/tegra_wm9712.c
+++ b/sound/soc/tegra/tegra_wm9712.c
@@ -54,6 +54,7 @@ static struct snd_soc_dai_link tegra_wm9
static struct snd_soc_card snd_soc_tegra_wm9712 = {
.name = "tegra-wm9712",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &tegra_wm9712_dai,
.num_links = 1,
--- a/sound/soc/tegra/trimslice.c
+++ b/sound/soc/tegra/trimslice.c
@@ -94,6 +94,7 @@ static struct snd_soc_dai_link trimslice
static struct snd_soc_card snd_soc_trimslice = {
.name = "tegra-trimslice",
+ .driver_name = "tegra",
.owner = THIS_MODULE,
.dai_link = &trimslice_tlv320aic23_dai,
.num_links = 1,
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 218/266] mwifiex: bring down link before deleting interface
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 217/266] ASoC: tegra: Set driver_name=tegra for all machine drivers Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 219/266] i40e: fix PTP on 5Gb links Greg Kroah-Hartman
` (51 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maximilian Luz, dave, Johannes Berg,
Brian Norris, Kalle Valo
From: Brian Norris <briannorris@chromium.org>
commit 1f9482aa8d412b4ba06ce6ab8e333fb8ca29a06e upstream.
We can deadlock when rmmod'ing the driver or going through firmware
reset, because the cfg80211_unregister_wdev() has to bring down the link
for us, ... which then grab the same wiphy lock.
nl80211_del_interface() already handles a very similar case, with a nice
description:
/*
* We hold RTNL, so this is safe, without RTNL opencount cannot
* reach 0, and thus the rdev cannot be deleted.
*
* We need to do it for the dev_close(), since that will call
* the netdev notifiers, and we need to acquire the mutex there
* but don't know if we get there from here or from some other
* place (e.g. "ip link set ... down").
*/
mutex_unlock(&rdev->wiphy.mtx);
...
Do similarly for mwifiex teardown, by ensuring we bring the link down
first.
Sample deadlock trace:
[ 247.103516] INFO: task rmmod:2119 blocked for more than 123 seconds.
[ 247.110630] Not tainted 5.12.4 #5
[ 247.115796] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 247.124557] task:rmmod state:D stack: 0 pid: 2119 ppid: 2114 flags:0x00400208
[ 247.133905] Call trace:
[ 247.136644] __switch_to+0x130/0x170
[ 247.140643] __schedule+0x714/0xa0c
[ 247.144548] schedule_preempt_disabled+0x88/0xf4
[ 247.149714] __mutex_lock_common+0x43c/0x750
[ 247.154496] mutex_lock_nested+0x5c/0x68
[ 247.158884] cfg80211_netdev_notifier_call+0x280/0x4e0 [cfg80211]
[ 247.165769] raw_notifier_call_chain+0x4c/0x78
[ 247.170742] call_netdevice_notifiers_info+0x68/0xa4
[ 247.176305] __dev_close_many+0x7c/0x138
[ 247.180693] dev_close_many+0x7c/0x10c
[ 247.184893] unregister_netdevice_many+0xfc/0x654
[ 247.190158] unregister_netdevice_queue+0xb4/0xe0
[ 247.195424] _cfg80211_unregister_wdev+0xa4/0x204 [cfg80211]
[ 247.201816] cfg80211_unregister_wdev+0x20/0x2c [cfg80211]
[ 247.208016] mwifiex_del_virtual_intf+0xc8/0x188 [mwifiex]
[ 247.214174] mwifiex_uninit_sw+0x158/0x1b0 [mwifiex]
[ 247.219747] mwifiex_remove_card+0x38/0xa0 [mwifiex]
[ 247.225316] mwifiex_pcie_remove+0xd0/0xe0 [mwifiex_pcie]
[ 247.231451] pci_device_remove+0x50/0xe0
[ 247.235849] device_release_driver_internal+0x110/0x1b0
[ 247.241701] driver_detach+0x5c/0x9c
[ 247.245704] bus_remove_driver+0x84/0xb8
[ 247.250095] driver_unregister+0x3c/0x60
[ 247.254486] pci_unregister_driver+0x2c/0x90
[ 247.259267] cleanup_module+0x18/0xcdc [mwifiex_pcie]
Fixes: a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-wireless/98392296-40ee-6300-369c-32e16cff3725@gmail.com/
Link: https://lore.kernel.org/linux-wireless/ab4d00ce52f32bd8e45ad0448a44737e@bewaar.me/
Reported-by: Maximilian Luz <luzmaximilian@gmail.com>
Reported-by: dave@bewaar.me
Cc: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Tested-by: Maximilian Luz <luzmaximilian@gmail.com>
Tested-by: Dave Olsthoorn <dave@bewaar.me>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210515024227.2159311-1-briannorris@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/mwifiex/main.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -1445,11 +1445,18 @@ static void mwifiex_uninit_sw(struct mwi
if (!priv)
continue;
rtnl_lock();
- wiphy_lock(adapter->wiphy);
if (priv->netdev &&
- priv->wdev.iftype != NL80211_IFTYPE_UNSPECIFIED)
+ priv->wdev.iftype != NL80211_IFTYPE_UNSPECIFIED) {
+ /*
+ * Close the netdev now, because if we do it later, the
+ * netdev notifiers will need to acquire the wiphy lock
+ * again --> deadlock.
+ */
+ dev_close(priv->wdev.netdev);
+ wiphy_lock(adapter->wiphy);
mwifiex_del_virtual_intf(adapter->wiphy, &priv->wdev);
- wiphy_unlock(adapter->wiphy);
+ wiphy_unlock(adapter->wiphy);
+ }
rtnl_unlock();
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 219/266] i40e: fix PTP on 5Gb links
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 218/266] mwifiex: bring down link before deleting interface Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 220/266] qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute Greg Kroah-Hartman
` (50 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Sergeev, Jesse Brandeburg,
Tony Brelinski, Tony Nguyen
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
commit 26b0ce8dd3dd704393dbace4dc416adfeffe531f upstream.
As reported by Alex Sergeev, the i40e driver is incrementing the PTP
clock at 40Gb speeds when linked at 5Gb. Fix this bug by making
sure that the right multiplier is selected when linked at 5Gb.
Fixes: 3dbdd6c2f70a ("i40e: Add support for 5Gbps cards")
Cc: stable@vger.kernel.org
Reported-by: Alex Sergeev <asergeev@carbonrobotics.com>
Suggested-by: Alex Sergeev <asergeev@carbonrobotics.com>
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_ptp.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -11,13 +11,14 @@
* operate with the nanosecond field directly without fear of overflow.
*
* Much like the 82599, the update period is dependent upon the link speed:
- * At 40Gb link or no link, the period is 1.6ns.
- * At 10Gb link, the period is multiplied by 2. (3.2ns)
+ * At 40Gb, 25Gb, or no link, the period is 1.6ns.
+ * At 10Gb or 5Gb link, the period is multiplied by 2. (3.2ns)
* At 1Gb link, the period is multiplied by 20. (32ns)
* 1588 functionality is not supported at 100Mbps.
*/
#define I40E_PTP_40GB_INCVAL 0x0199999999ULL
#define I40E_PTP_10GB_INCVAL_MULT 2
+#define I40E_PTP_5GB_INCVAL_MULT 2
#define I40E_PTP_1GB_INCVAL_MULT 20
#define I40E_PRTTSYN_CTL1_TSYNTYPE_V1 BIT(I40E_PRTTSYN_CTL1_TSYNTYPE_SHIFT)
@@ -465,6 +466,9 @@ void i40e_ptp_set_increment(struct i40e_
case I40E_LINK_SPEED_10GB:
mult = I40E_PTP_10GB_INCVAL_MULT;
break;
+ case I40E_LINK_SPEED_5GB:
+ mult = I40E_PTP_5GB_INCVAL_MULT;
+ break;
case I40E_LINK_SPEED_1GB:
mult = I40E_PTP_1GB_INCVAL_MULT;
break;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 220/266] qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 219/266] i40e: fix PTP on 5Gb links Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 221/266] ipmi/watchdog: Stop watchdog timer when the current action is none Greg Kroah-Hartman
` (49 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Sami Tolvanen,
Sedat Dilek, Philippe Mathieu-Daudé,
Kees Cook
From: Nathan Chancellor <nathan@kernel.org>
commit fca41af18e10318e4de090db47d9fa7169e1bf2f upstream.
fw_cfg_showrev() is called by an indirect call in kobj_attr_show(),
which violates clang's CFI checking because fw_cfg_showrev()'s second
parameter is 'struct attribute', whereas the ->show() member of 'struct
kobj_structure' expects the second parameter to be of type 'struct
kobj_attribute'.
$ cat /sys/firmware/qemu_fw_cfg/rev
3
$ dmesg | grep "CFI failure"
[ 26.016832] CFI failure (target: fw_cfg_showrev+0x0/0x8):
Fix this by converting fw_cfg_rev_attr to 'struct kobj_attribute' where
this would have been caught automatically by the incompatible pointer
types compiler warning. Update fw_cfg_showrev() accordingly.
Fixes: 75f3e8e47f38 ("firmware: introduce sysfs driver for QEMU's fw_cfg device")
Link: https://github.com/ClangBuiltLinux/linux/issues/1299
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210211194258.4137998-1-nathan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/qemu_fw_cfg.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c
@@ -299,15 +299,13 @@ static int fw_cfg_do_platform_probe(stru
return 0;
}
-static ssize_t fw_cfg_showrev(struct kobject *k, struct attribute *a, char *buf)
+static ssize_t fw_cfg_showrev(struct kobject *k, struct kobj_attribute *a,
+ char *buf)
{
return sprintf(buf, "%u\n", fw_cfg_rev);
}
-static const struct {
- struct attribute attr;
- ssize_t (*show)(struct kobject *k, struct attribute *a, char *buf);
-} fw_cfg_rev_attr = {
+static const struct kobj_attribute fw_cfg_rev_attr = {
.attr = { .name = "rev", .mode = S_IRUSR },
.show = fw_cfg_showrev,
};
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 221/266] ipmi/watchdog: Stop watchdog timer when the current action is none
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 220/266] qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 222/266] xfrm: policy: Read seqcount outside of rcu-read side in xfrm_policy_lookup_bytype Greg Kroah-Hartman
` (48 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Petr Pavlu, Corey Minyard
From: Petr Pavlu <petr.pavlu@suse.com>
commit 2253042d86f57d90a621ac2513a7a7a13afcf809 upstream.
When an IPMI watchdog timer is being stopped in ipmi_close() or
ipmi_ioctl(WDIOS_DISABLECARD), the current watchdog action is updated to
WDOG_TIMEOUT_NONE and _ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB) is called
to install this action. The latter function ends up invoking
__ipmi_set_timeout() which makes the actual 'Set Watchdog Timer' IPMI
request.
For IPMI 1.0, this operation results in fully stopping the watchdog timer.
For IPMI >= 1.5, function __ipmi_set_timeout() always specifies the "don't
stop" flag in the prepared 'Set Watchdog Timer' IPMI request. This causes
that the watchdog timer has its action correctly updated to 'none' but the
timer continues to run. A problem is that IPMI firmware can then still log
an expiration event when the configured timeout is reached, which is
unexpected because the watchdog timer was requested to be stopped.
The patch fixes this problem by not setting the "don't stop" flag in
__ipmi_set_timeout() when the current action is WDOG_TIMEOUT_NONE which
results in stopping the watchdog timer. This makes the behaviour for
IPMI >= 1.5 consistent with IPMI 1.0. It also matches the logic in
__ipmi_heartbeat() which does not allow to reset the watchdog if the
current action is WDOG_TIMEOUT_NONE as that would start the timer.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Message-Id: <10a41bdc-9c99-089c-8d89-fa98ce5ea080@suse.com>
Cc: stable@vger.kernel.org
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_watchdog.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -371,16 +371,18 @@ static int __ipmi_set_timeout(struct ipm
data[0] = 0;
WDOG_SET_TIMER_USE(data[0], WDOG_TIMER_USE_SMS_OS);
- if ((ipmi_version_major > 1)
- || ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) {
- /* This is an IPMI 1.5-only feature. */
- data[0] |= WDOG_DONT_STOP_ON_SET;
- } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
- /*
- * In ipmi 1.0, setting the timer stops the watchdog, we
- * need to start it back up again.
- */
- hbnow = 1;
+ if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
+ if ((ipmi_version_major > 1) ||
+ ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) {
+ /* This is an IPMI 1.5-only feature. */
+ data[0] |= WDOG_DONT_STOP_ON_SET;
+ } else {
+ /*
+ * In ipmi 1.0, setting the timer stops the watchdog, we
+ * need to start it back up again.
+ */
+ hbnow = 1;
+ }
}
data[1] = 0;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 222/266] xfrm: policy: Read seqcount outside of rcu-read side in xfrm_policy_lookup_bytype
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 221/266] ipmi/watchdog: Stop watchdog timer when the current action is none Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 223/266] thermal/drivers/int340x/processor_thermal: Fix tcc setting Greg Kroah-Hartman
` (47 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Varad Gautam, linux-rt-users, netdev,
Steffen Klassert, Herbert Xu, David S. Miller, Jakub Kicinski,
Florian Westphal, Ahmed S. Darwish
From: Varad Gautam <varad.gautam@suse.com>
commit d7b0408934c749f546b01f2b33d07421a49b6f3e upstream.
xfrm_policy_lookup_bytype loops on seqcount mutex xfrm_policy_hash_generation
within an RCU read side critical section. Although ill advised, this is fine if
the loop is bounded.
xfrm_policy_hash_generation wraps mutex hash_resize_mutex, which is used to
serialize writers (xfrm_hash_resize, xfrm_hash_rebuild). This is fine too.
On PREEMPT_RT=y, the read_seqcount_begin call within xfrm_policy_lookup_bytype
emits a mutex lock/unlock for hash_resize_mutex. Mutex locking is fine, since
RCU read side critical sections are allowed to sleep with PREEMPT_RT.
xfrm_hash_resize can, however, block on synchronize_rcu while holding
hash_resize_mutex.
This leads to the following situation on PREEMPT_RT, where the writer is
blocked on RCU grace period expiry, while the reader is blocked on a lock held
by the writer:
Thead 1 (xfrm_hash_resize) Thread 2 (xfrm_policy_lookup_bytype)
rcu_read_lock();
mutex_lock(&hash_resize_mutex);
read_seqcount_begin(&xfrm_policy_hash_generation);
mutex_lock(&hash_resize_mutex); // block
xfrm_bydst_resize();
synchronize_rcu(); // block
<RCU stalls in xfrm_policy_lookup_bytype>
Move the read_seqcount_begin call outside of the RCU read side critical section,
and do an rcu_read_unlock/retry if we got stale data within the critical section.
On non-PREEMPT_RT, this shortens the time spent within RCU read side critical
section in case the seqcount needs a retry, and avoids unbounded looping.
Fixes: 77cc278f7b20 ("xfrm: policy: Use sequence counters with associated lock")
Signed-off-by: Varad Gautam <varad.gautam@suse.com>
Cc: linux-rt-users <linux-rt-users@vger.kernel.org>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org # v4.9
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Florian Westphal <fw@strlen.de>
Cc: "Ahmed S. Darwish" <a.darwish@linutronix.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Ahmed S. Darwish <a.darwish@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_policy.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2092,12 +2092,15 @@ static struct xfrm_policy *xfrm_policy_l
if (unlikely(!daddr || !saddr))
return NULL;
- rcu_read_lock();
retry:
- do {
- sequence = read_seqcount_begin(&xfrm_policy_hash_generation);
- chain = policy_hash_direct(net, daddr, saddr, family, dir);
- } while (read_seqcount_retry(&xfrm_policy_hash_generation, sequence));
+ sequence = read_seqcount_begin(&xfrm_policy_hash_generation);
+ rcu_read_lock();
+
+ chain = policy_hash_direct(net, daddr, saddr, family, dir);
+ if (read_seqcount_retry(&xfrm_policy_hash_generation, sequence)) {
+ rcu_read_unlock();
+ goto retry;
+ }
ret = NULL;
hlist_for_each_entry_rcu(pol, chain, bydst) {
@@ -2128,11 +2131,15 @@ static struct xfrm_policy *xfrm_policy_l
}
skip_inexact:
- if (read_seqcount_retry(&xfrm_policy_hash_generation, sequence))
+ if (read_seqcount_retry(&xfrm_policy_hash_generation, sequence)) {
+ rcu_read_unlock();
goto retry;
+ }
- if (ret && !xfrm_pol_hold_rcu(ret))
+ if (ret && !xfrm_pol_hold_rcu(ret)) {
+ rcu_read_unlock();
goto retry;
+ }
fail:
rcu_read_unlock();
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 223/266] thermal/drivers/int340x/processor_thermal: Fix tcc setting
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 222/266] xfrm: policy: Read seqcount outside of rcu-read side in xfrm_policy_lookup_bytype Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 224/266] ubifs: Fix races between xattr_{set|get} and listxattr operations Greg Kroah-Hartman
` (46 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada, Zhang Rui,
Daniel Lezcano
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit fe6a6de6692e7f7159c1ff42b07ecd737df712b4 upstream.
The following fixes are done for tcc sysfs interface:
- TCC is 6 bits only from bit 29-24
- TCC of 0 is valid
- When BIT(31) is set, this register is read only
- Check for invalid tcc value
- Error for negative values
Fixes: fdf4f2fb8e899 ("drivers: thermal: processor_thermal_device: Export sysfs interface for TCC offset")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: stable@vger.kernel.org
Acked-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210628215803.75038-1-srinivas.pandruvada@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/intel/int340x_thermal/processor_thermal_device.c | 20 ++++++----
1 file changed, 12 insertions(+), 8 deletions(-)
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -100,24 +100,27 @@ static ssize_t tcc_offset_degree_celsius
if (err)
return err;
- val = (val >> 24) & 0xff;
+ val = (val >> 24) & 0x3f;
return sprintf(buf, "%d\n", (int)val);
}
-static int tcc_offset_update(int tcc)
+static int tcc_offset_update(unsigned int tcc)
{
u64 val;
int err;
- if (!tcc)
+ if (tcc > 63)
return -EINVAL;
err = rdmsrl_safe(MSR_IA32_TEMPERATURE_TARGET, &val);
if (err)
return err;
- val &= ~GENMASK_ULL(31, 24);
- val |= (tcc & 0xff) << 24;
+ if (val & BIT(31))
+ return -EPERM;
+
+ val &= ~GENMASK_ULL(29, 24);
+ val |= (tcc & 0x3f) << 24;
err = wrmsrl_safe(MSR_IA32_TEMPERATURE_TARGET, val);
if (err)
@@ -126,14 +129,15 @@ static int tcc_offset_update(int tcc)
return 0;
}
-static int tcc_offset_save;
+static unsigned int tcc_offset_save;
static ssize_t tcc_offset_degree_celsius_store(struct device *dev,
struct device_attribute *attr, const char *buf,
size_t count)
{
+ unsigned int tcc;
u64 val;
- int tcc, err;
+ int err;
err = rdmsrl_safe(MSR_PLATFORM_INFO, &val);
if (err)
@@ -142,7 +146,7 @@ static ssize_t tcc_offset_degree_celsius
if (!(val & BIT(30)))
return -EACCES;
- if (kstrtoint(buf, 0, &tcc))
+ if (kstrtouint(buf, 0, &tcc))
return -EINVAL;
err = tcc_offset_update(tcc);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 224/266] ubifs: Fix races between xattr_{set|get} and listxattr operations
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 223/266] thermal/drivers/int340x/processor_thermal: Fix tcc setting Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 225/266] power: supply: ab8500: Fix an old bug Greg Kroah-Hartman
` (45 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhihao Cheng, Sascha Hauer,
Richard Weinberger
From: Zhihao Cheng <chengzhihao1@huawei.com>
commit f4e3634a3b642225a530c292fdb1e8a4007507f5 upstream.
UBIFS may occur some problems with concurrent xattr_{set|get} and
listxattr operations, such as assertion failure, memory corruption,
stale xattr value[1].
Fix it by importing a new rw-lock in @ubifs_inode to serilize write
operations on xattr, concurrent read operations are still effective,
just like ext4.
[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com
Fixes: 1e51764a3c2ac05a23 ("UBIFS: add new flash file system")
Cc: stable@vger.kernel.org # v2.6+
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ubifs/super.c | 1 +
fs/ubifs/ubifs.h | 2 ++
fs/ubifs/xattr.c | 44 +++++++++++++++++++++++++++++++++-----------
3 files changed, 36 insertions(+), 11 deletions(-)
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -275,6 +275,7 @@ static struct inode *ubifs_alloc_inode(s
memset((void *)ui + sizeof(struct inode), 0,
sizeof(struct ubifs_inode) - sizeof(struct inode));
mutex_init(&ui->ui_mutex);
+ init_rwsem(&ui->xattr_sem);
spin_lock_init(&ui->ui_lock);
return &ui->vfs_inode;
};
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -356,6 +356,7 @@ struct ubifs_gced_idx_leb {
* @ui_mutex: serializes inode write-back with the rest of VFS operations,
* serializes "clean <-> dirty" state changes, serializes bulk-read,
* protects @dirty, @bulk_read, @ui_size, and @xattr_size
+ * @xattr_sem: serilizes write operations (remove|set|create) on xattr
* @ui_lock: protects @synced_i_size
* @synced_i_size: synchronized size of inode, i.e. the value of inode size
* currently stored on the flash; used only for regular file
@@ -409,6 +410,7 @@ struct ubifs_inode {
unsigned int bulk_read:1;
unsigned int compr_type:2;
struct mutex ui_mutex;
+ struct rw_semaphore xattr_sem;
spinlock_t ui_lock;
loff_t synced_i_size;
loff_t ui_size;
--- a/fs/ubifs/xattr.c
+++ b/fs/ubifs/xattr.c
@@ -285,6 +285,7 @@ int ubifs_xattr_set(struct inode *host,
if (!xent)
return -ENOMEM;
+ down_write(&ubifs_inode(host)->xattr_sem);
/*
* The extended attribute entries are stored in LNC, so multiple
* look-ups do not involve reading the flash.
@@ -319,6 +320,7 @@ int ubifs_xattr_set(struct inode *host,
iput(inode);
out_free:
+ up_write(&ubifs_inode(host)->xattr_sem);
kfree(xent);
return err;
}
@@ -341,18 +343,19 @@ ssize_t ubifs_xattr_get(struct inode *ho
if (!xent)
return -ENOMEM;
+ down_read(&ubifs_inode(host)->xattr_sem);
xent_key_init(c, &key, host->i_ino, &nm);
err = ubifs_tnc_lookup_nm(c, &key, xent, &nm);
if (err) {
if (err == -ENOENT)
err = -ENODATA;
- goto out_unlock;
+ goto out_cleanup;
}
inode = iget_xattr(c, le64_to_cpu(xent->inum));
if (IS_ERR(inode)) {
err = PTR_ERR(inode);
- goto out_unlock;
+ goto out_cleanup;
}
ui = ubifs_inode(inode);
@@ -374,7 +377,8 @@ ssize_t ubifs_xattr_get(struct inode *ho
out_iput:
mutex_unlock(&ui->ui_mutex);
iput(inode);
-out_unlock:
+out_cleanup:
+ up_read(&ubifs_inode(host)->xattr_sem);
kfree(xent);
return err;
}
@@ -406,16 +410,21 @@ ssize_t ubifs_listxattr(struct dentry *d
dbg_gen("ino %lu ('%pd'), buffer size %zd", host->i_ino,
dentry, size);
+ down_read(&host_ui->xattr_sem);
len = host_ui->xattr_names + host_ui->xattr_cnt;
- if (!buffer)
+ if (!buffer) {
/*
* We should return the minimum buffer size which will fit a
* null-terminated list of all the extended attribute names.
*/
- return len;
+ err = len;
+ goto out_err;
+ }
- if (len > size)
- return -ERANGE;
+ if (len > size) {
+ err = -ERANGE;
+ goto out_err;
+ }
lowest_xent_key(c, &key, host->i_ino);
while (1) {
@@ -437,8 +446,9 @@ ssize_t ubifs_listxattr(struct dentry *d
pxent = xent;
key_read(c, &xent->key, &key);
}
-
kfree(pxent);
+ up_read(&host_ui->xattr_sem);
+
if (err != -ENOENT) {
ubifs_err(c, "cannot find next direntry, error %d", err);
return err;
@@ -446,6 +456,10 @@ ssize_t ubifs_listxattr(struct dentry *d
ubifs_assert(c, written <= size);
return written;
+
+out_err:
+ up_read(&host_ui->xattr_sem);
+ return err;
}
static int remove_xattr(struct ubifs_info *c, struct inode *host,
@@ -504,6 +518,7 @@ int ubifs_purge_xattrs(struct inode *hos
ubifs_warn(c, "inode %lu has too many xattrs, doing a non-atomic deletion",
host->i_ino);
+ down_write(&ubifs_inode(host)->xattr_sem);
lowest_xent_key(c, &key, host->i_ino);
while (1) {
xent = ubifs_tnc_next_ent(c, &key, &nm);
@@ -523,7 +538,7 @@ int ubifs_purge_xattrs(struct inode *hos
ubifs_ro_mode(c, err);
kfree(pxent);
kfree(xent);
- return err;
+ goto out_err;
}
ubifs_assert(c, ubifs_inode(xino)->xattr);
@@ -535,7 +550,7 @@ int ubifs_purge_xattrs(struct inode *hos
kfree(xent);
iput(xino);
ubifs_err(c, "cannot remove xattr, error %d", err);
- return err;
+ goto out_err;
}
iput(xino);
@@ -544,14 +559,19 @@ int ubifs_purge_xattrs(struct inode *hos
pxent = xent;
key_read(c, &xent->key, &key);
}
-
kfree(pxent);
+ up_write(&ubifs_inode(host)->xattr_sem);
+
if (err != -ENOENT) {
ubifs_err(c, "cannot find next direntry, error %d", err);
return err;
}
return 0;
+
+out_err:
+ up_write(&ubifs_inode(host)->xattr_sem);
+ return err;
}
/**
@@ -594,6 +614,7 @@ static int ubifs_xattr_remove(struct ino
if (!xent)
return -ENOMEM;
+ down_write(&ubifs_inode(host)->xattr_sem);
xent_key_init(c, &key, host->i_ino, &nm);
err = ubifs_tnc_lookup_nm(c, &key, xent, &nm);
if (err) {
@@ -618,6 +639,7 @@ static int ubifs_xattr_remove(struct ino
iput(inode);
out_free:
+ up_write(&ubifs_inode(host)->xattr_sem);
kfree(xent);
return err;
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 225/266] power: supply: ab8500: Fix an old bug
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 224/266] ubifs: Fix races between xattr_{set|get} and listxattr operations Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 226/266] mfd: syscon: Free the allocated name field of struct regmap_config Greg Kroah-Hartman
` (44 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Marcus Cooper,
Linus Walleij, Sebastian Reichel
From: Linus Walleij <linus.walleij@linaro.org>
commit f1c74a6c07e76fcb31a4bcc1f437c4361a2674ce upstream.
Trying to get the AB8500 charging driver working I ran into a bit
of bitrot: we haven't used the driver for a while so errors in
refactorings won't be noticed.
This one is pretty self evident: use argument to the macro or we
end up with a random pointer to something else.
Cc: stable@vger.kernel.org
Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Marcus Cooper <codekipper@gmail.com>
Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/ab8500-chargalg.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/power/supply/ab8500-chargalg.h
+++ b/drivers/power/supply/ab8500-chargalg.h
@@ -15,7 +15,7 @@
* - POWER_SUPPLY_TYPE_USB,
* because only them store as drv_data pointer to struct ux500_charger.
*/
-#define psy_to_ux500_charger(x) power_supply_get_drvdata(psy)
+#define psy_to_ux500_charger(x) power_supply_get_drvdata(x)
/* Forward declaration */
struct ux500_charger;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 226/266] mfd: syscon: Free the allocated name field of struct regmap_config
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 225/266] power: supply: ab8500: Fix an old bug Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 227/266] nvmem: core: add a missing of_node_put Greg Kroah-Hartman
` (43 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Meng Li, Lee Jones
From: Limeng <Meng.Li@windriver.com>
commit 56a1188159cb2b87fbcb5a7a7afb38a4dd9db0c1 upstream.
The commit 529a1101212a("mfd: syscon: Don't free allocated name
for regmap_config") doesn't free the allocated name field of struct
regmap_config, but introduce a memory leak. There is another
commit 94cc89eb8fa5("regmap: debugfs: Fix handling of name string
for debugfs init delays") fixing this debugfs init issue from root
cause. With this fixing, the name field in struct regmap_debugfs_node
is removed. When initialize debugfs for syscon driver, the name
field of struct regmap_config is not used anymore. So, the allocated
name field of struct regmap_config is need to be freed directly after
regmap initialization to avoid memory leak.
Cc: stable@vger.kernel.org
Fixes: 529a1101212a("mfd: syscon: Don't free allocated name for regmap_config")
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/syscon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mfd/syscon.c
+++ b/drivers/mfd/syscon.c
@@ -108,6 +108,7 @@ static struct syscon *of_syscon_register
syscon_config.max_register = resource_size(&res) - reg_io_width;
regmap = regmap_init_mmio(NULL, base, &syscon_config);
+ kfree(syscon_config.name);
if (IS_ERR(regmap)) {
pr_err("regmap init failed\n");
ret = PTR_ERR(regmap);
@@ -144,7 +145,6 @@ err_clk:
regmap_exit(regmap);
err_regmap:
iounmap(base);
- kfree(syscon_config.name);
err_map:
kfree(syscon);
return ERR_PTR(ret);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 227/266] nvmem: core: add a missing of_node_put
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 226/266] mfd: syscon: Free the allocated name field of struct regmap_config Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 228/266] lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE Greg Kroah-Hartman
` (42 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Srinivas Kandagatla
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit 63879e2964bceee2aa5bbe8b99ea58bba28bb64f upstream.
'for_each_child_of_node' performs an of_node_get on each iteration, so a
return from the middle of the loop requires an of_node_put.
Fixes: e888d445ac33 ("nvmem: resolve cells from DT at registration time")
Cc: <stable@vger.kernel.org>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20210611102321.11509-1-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/core.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -686,15 +686,17 @@ static int nvmem_add_cells_from_of(struc
continue;
if (len < 2 * sizeof(u32)) {
dev_err(dev, "nvmem: invalid reg on %pOF\n", child);
+ of_node_put(child);
return -EINVAL;
}
cell = kzalloc(sizeof(*cell), GFP_KERNEL);
- if (!cell)
+ if (!cell) {
+ of_node_put(child);
return -ENOMEM;
+ }
cell->nvmem = nvmem;
- cell->np = of_node_get(child);
cell->offset = be32_to_cpup(addr++);
cell->bytes = be32_to_cpup(addr);
cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
@@ -715,11 +717,12 @@ static int nvmem_add_cells_from_of(struc
cell->name, nvmem->stride);
/* Cells already added will be freed later. */
kfree_const(cell->name);
- of_node_put(cell->np);
kfree(cell);
+ of_node_put(child);
return -EINVAL;
}
+ cell->np = of_node_get(child);
nvmem_cell_add(cell);
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 228/266] lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 227/266] nvmem: core: add a missing of_node_put Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 229/266] selftests/lkdtm: Fix expected text for CR4 pinning Greg Kroah-Hartman
` (41 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit a15676ac8f24a9ac5fd881cf17be4be13fa0910a upstream.
When built under CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, this test is
expected to fail (i.e. not trip an exception).
Fixes: 46d1a0f03d66 ("selftests/lkdtm: Add tests for LKDTM targets")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210623203936.3151093-5-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/lkdtm/bugs.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/misc/lkdtm/bugs.c
+++ b/drivers/misc/lkdtm/bugs.c
@@ -161,6 +161,9 @@ void lkdtm_UNALIGNED_LOAD_STORE_WRITE(vo
if (*p == 0)
val = 0x87654321;
*p = val;
+
+ if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
+ pr_err("XFAIL: arch has CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS\n");
}
void lkdtm_SOFTLOCKUP(void)
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 229/266] selftests/lkdtm: Fix expected text for CR4 pinning
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 228/266] lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 230/266] extcon: intel-mrfld: Sync hardware and software state on init Greg Kroah-Hartman
` (40 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit c2eb472bbe25b3f360990f23b293b3fbadfa4bc0 upstream.
The error text for CR4 pinning changed. Update the test to match.
Fixes: a13b9d0b9721 ("x86/cpu: Use pinning mask for CR4 bits needing to be 0")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210623203936.3151093-3-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/lkdtm/tests.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/lkdtm/tests.txt
+++ b/tools/testing/selftests/lkdtm/tests.txt
@@ -11,7 +11,7 @@ CORRUPT_LIST_ADD list_add corruption
CORRUPT_LIST_DEL list_del corruption
STACK_GUARD_PAGE_LEADING
STACK_GUARD_PAGE_TRAILING
-UNSET_SMEP CR4 bits went missing
+UNSET_SMEP pinned CR4 bits changed:
DOUBLE_FAULT
CORRUPT_PAC
UNALIGNED_LOAD_STORE_WRITE
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 230/266] extcon: intel-mrfld: Sync hardware and software state on init
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 229/266] selftests/lkdtm: Fix expected text for CR4 pinning Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 231/266] lkdtm: Enable DOUBLE_FAULT on all architectures Greg Kroah-Hartman
` (39 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Ferry Toth, Chanwoo Choi
From: Ferry Toth <ftoth@exalondelft.nl>
commit ecb5bdff901139850fb3ca3ae2d0cccac045bc52 upstream.
extcon driver for Basin Cove PMIC shadows the switch status used for dwc3
DRD to detect a change in the switch position. This change initializes the
status at probe time.
Cc: stable@vger.kernel.org
Fixes: 492929c54791 ("extcon: mrfld: Introduce extcon driver for Basin Cove PMIC")
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Ferry Toth <ftoth@exalondelft.nl>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/extcon/extcon-intel-mrfld.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/extcon/extcon-intel-mrfld.c
+++ b/drivers/extcon/extcon-intel-mrfld.c
@@ -197,6 +197,7 @@ static int mrfld_extcon_probe(struct pla
struct intel_soc_pmic *pmic = dev_get_drvdata(dev->parent);
struct regmap *regmap = pmic->regmap;
struct mrfld_extcon_data *data;
+ unsigned int status;
unsigned int id;
int irq, ret;
@@ -244,6 +245,14 @@ static int mrfld_extcon_probe(struct pla
/* Get initial state */
mrfld_extcon_role_detect(data);
+ /*
+ * Cached status value is used for cable detection, see comments
+ * in mrfld_extcon_cable_detect(), we need to sync cached value
+ * with a real state of the hardware.
+ */
+ regmap_read(regmap, BCOVE_SCHGRIRQ1, &status);
+ data->status = status;
+
mrfld_extcon_clear(data, BCOVE_MIRQLVL1, BCOVE_LVL1_CHGR);
mrfld_extcon_clear(data, BCOVE_MCHGRIRQ1, BCOVE_CHGRIRQ_ALL);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 231/266] lkdtm: Enable DOUBLE_FAULT on all architectures
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 230/266] extcon: intel-mrfld: Sync hardware and software state on init Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 232/266] seq_buf: Fix overflow in seq_buf_putmem_hex() Greg Kroah-Hartman
` (38 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kees Cook
From: Kees Cook <keescook@chromium.org>
commit f123c42bbeff26bfe8bdb08a01307e92d51eec39 upstream.
Where feasible, I prefer to have all tests visible on all architectures,
but to have them wired to XFAIL. DOUBLE_FAIL was set up to XFAIL, but
wasn't actually being added to the test list.
Fixes: cea23efb4de2 ("lkdtm/bugs: Make double-fault test always available")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210623203936.3151093-7-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/lkdtm/core.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/misc/lkdtm/core.c
+++ b/drivers/misc/lkdtm/core.c
@@ -177,9 +177,7 @@ static const struct crashtype crashtypes
CRASHTYPE(STACKLEAK_ERASING),
CRASHTYPE(CFI_FORWARD_PROTO),
CRASHTYPE(FORTIFIED_STRSCPY),
-#ifdef CONFIG_X86_32
CRASHTYPE(DOUBLE_FAULT),
-#endif
#ifdef CONFIG_PPC_BOOK3S_64
CRASHTYPE(PPC_SLB_MULTIHIT),
#endif
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 232/266] seq_buf: Fix overflow in seq_buf_putmem_hex()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 231/266] lkdtm: Enable DOUBLE_FAULT on all architectures Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 233/266] rq-qos: fix missed wake-ups in rq_qos_throttle try two Greg Kroah-Hartman
` (37 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yun Zhou, Steven Rostedt (VMware)
From: Yun Zhou <yun.zhou@windriver.com>
commit d3b16034a24a112bb83aeb669ac5b9b01f744bb7 upstream.
There's two variables being increased in that loop (i and j), and i
follows the raw data, and j follows what is being written into the buffer.
We should compare 'i' to MAX_MEMHEX_BYTES or compare 'j' to HEX_CHARS.
Otherwise, if 'j' goes bigger than HEX_CHARS, it will overflow the
destination buffer.
Link: https://lore.kernel.org/lkml/20210625122453.5e2fe304@oasis.local.home/
Link: https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou@windriver.com
Cc: stable@vger.kernel.org
Fixes: 5e3ca0ec76fce ("ftrace: introduce the "hex" output method")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/seq_buf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -229,8 +229,10 @@ int seq_buf_putmem_hex(struct seq_buf *s
WARN_ON(s->size == 0);
+ BUILD_BUG_ON(MAX_MEMHEX_BYTES * 2 >= HEX_CHARS);
+
while (len) {
- start_len = min(len, HEX_CHARS - 1);
+ start_len = min(len, MAX_MEMHEX_BYTES);
#ifdef __BIG_ENDIAN
for (i = 0, j = 0; i < start_len; i++) {
#else
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 233/266] rq-qos: fix missed wake-ups in rq_qos_throttle try two
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 232/266] seq_buf: Fix overflow in seq_buf_putmem_hex() Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 234/266] tracing: Simplify & fix saved_tgids logic Greg Kroah-Hartman
` (36 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jan Kara, Jens Axboe
From: Jan Kara <jack@suse.cz>
commit 11c7aa0ddea8611007768d3e6b58d45dc60a19e1 upstream.
Commit 545fbd0775ba ("rq-qos: fix missed wake-ups in rq_qos_throttle")
tried to fix a problem that a process could be sleeping in rq_qos_wait()
without anyone to wake it up. However the fix is not complete and the
following can still happen:
CPU1 (waiter1) CPU2 (waiter2) CPU3 (waker)
rq_qos_wait() rq_qos_wait()
acquire_inflight_cb() -> fails
acquire_inflight_cb() -> fails
completes IOs, inflight
decreased
prepare_to_wait_exclusive()
prepare_to_wait_exclusive()
has_sleeper = !wq_has_single_sleeper() -> true as there are two sleepers
has_sleeper = !wq_has_single_sleeper() -> true
io_schedule() io_schedule()
Deadlock as now there's nobody to wakeup the two waiters. The logic
automatically blocking when there are already sleepers is really subtle
and the only way to make it work reliably is that we check whether there
are some waiters in the queue when adding ourselves there. That way, we
are guaranteed that at least the first process to enter the wait queue
will recheck the waiting condition before going to sleep and thus
guarantee forward progress.
Fixes: 545fbd0775ba ("rq-qos: fix missed wake-ups in rq_qos_throttle")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20210607112613.25344-1-jack@suse.cz
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-rq-qos.c | 4 ++--
include/linux/wait.h | 2 +-
kernel/sched/wait.c | 9 +++++++--
3 files changed, 10 insertions(+), 5 deletions(-)
--- a/block/blk-rq-qos.c
+++ b/block/blk-rq-qos.c
@@ -266,8 +266,8 @@ void rq_qos_wait(struct rq_wait *rqw, vo
if (!has_sleeper && acquire_inflight_cb(rqw, private_data))
return;
- prepare_to_wait_exclusive(&rqw->wait, &data.wq, TASK_UNINTERRUPTIBLE);
- has_sleeper = !wq_has_single_sleeper(&rqw->wait);
+ has_sleeper = !prepare_to_wait_exclusive(&rqw->wait, &data.wq,
+ TASK_UNINTERRUPTIBLE);
do {
/* The memory barrier in set_task_state saves us here. */
if (data.got_token)
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -1136,7 +1136,7 @@ do { \
* Waitqueues which are removed from the waitqueue_head at wakeup time
*/
void prepare_to_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
-void prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
+bool prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
long prepare_to_wait_event(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
void finish_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long timeout);
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -264,17 +264,22 @@ prepare_to_wait(struct wait_queue_head *
}
EXPORT_SYMBOL(prepare_to_wait);
-void
+/* Returns true if we are the first waiter in the queue, false otherwise. */
+bool
prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state)
{
unsigned long flags;
+ bool was_empty = false;
wq_entry->flags |= WQ_FLAG_EXCLUSIVE;
spin_lock_irqsave(&wq_head->lock, flags);
- if (list_empty(&wq_entry->entry))
+ if (list_empty(&wq_entry->entry)) {
+ was_empty = list_empty(&wq_head->head);
__add_wait_queue_entry_tail(wq_head, wq_entry);
+ }
set_current_state(state);
spin_unlock_irqrestore(&wq_head->lock, flags);
+ return was_empty;
}
EXPORT_SYMBOL(prepare_to_wait_exclusive);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 234/266] tracing: Simplify & fix saved_tgids logic
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 233/266] rq-qos: fix missed wake-ups in rq_qos_throttle try two Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 235/266] tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT Greg Kroah-Hartman
` (35 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ingo Molnar, Joel Fernandes,
Paul Burton, Steven Rostedt (VMware)
From: Paul Burton <paulburton@google.com>
commit b81b3e959adb107cd5b36c7dc5ba1364bbd31eb2 upstream.
The tgid_map array records a mapping from pid to tgid, where the index
of an entry within the array is the pid & the value stored at that index
is the tgid.
The saved_tgids_next() function iterates over pointers into the tgid_map
array & dereferences the pointers which results in the tgid, but then it
passes that dereferenced value to trace_find_tgid() which treats it as a
pid & does a further lookup within the tgid_map array. It seems likely
that the intent here was to skip over entries in tgid_map for which the
recorded tgid is zero, but instead we end up skipping over entries for
which the thread group leader hasn't yet had its own tgid recorded in
tgid_map.
A minimal fix would be to remove the call to trace_find_tgid, turning:
if (trace_find_tgid(*ptr))
into:
if (*ptr)
..but it seems like this logic can be much simpler if we simply let
seq_read() iterate over the whole tgid_map array & filter out empty
entries by returning SEQ_SKIP from saved_tgids_show(). Here we take that
approach, removing the incorrect logic here entirely.
Link: https://lkml.kernel.org/r/20210630003406.4013668-1-paulburton@google.com
Fixes: d914ba37d714 ("tracing: Add support for recording tgid of tasks")
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Joel Fernandes <joelaf@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Paul Burton <paulburton@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 38 +++++++++++++-------------------------
1 file changed, 13 insertions(+), 25 deletions(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5608,37 +5608,20 @@ static const struct file_operations trac
static void *saved_tgids_next(struct seq_file *m, void *v, loff_t *pos)
{
- int *ptr = v;
+ int pid = ++(*pos);
- if (*pos || m->count)
- ptr++;
-
- (*pos)++;
-
- for (; ptr <= &tgid_map[PID_MAX_DEFAULT]; ptr++) {
- if (trace_find_tgid(*ptr))
- return ptr;
- }
+ if (pid > PID_MAX_DEFAULT)
+ return NULL;
- return NULL;
+ return &tgid_map[pid];
}
static void *saved_tgids_start(struct seq_file *m, loff_t *pos)
{
- void *v;
- loff_t l = 0;
-
- if (!tgid_map)
+ if (!tgid_map || *pos > PID_MAX_DEFAULT)
return NULL;
- v = &tgid_map[0];
- while (l <= *pos) {
- v = saved_tgids_next(m, v, &l);
- if (!v)
- return NULL;
- }
-
- return v;
+ return &tgid_map[*pos];
}
static void saved_tgids_stop(struct seq_file *m, void *v)
@@ -5647,9 +5630,14 @@ static void saved_tgids_stop(struct seq_
static int saved_tgids_show(struct seq_file *m, void *v)
{
- int pid = (int *)v - tgid_map;
+ int *entry = (int *)v;
+ int pid = entry - tgid_map;
+ int tgid = *entry;
+
+ if (tgid == 0)
+ return SEQ_SKIP;
- seq_printf(m, "%d %d\n", pid, trace_find_tgid(pid));
+ seq_printf(m, "%d %d\n", pid, tgid);
return 0;
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 235/266] tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 234/266] tracing: Simplify & fix saved_tgids logic Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 236/266] ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe Greg Kroah-Hartman
` (34 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ingo Molnar, Joel Fernandes,
Paul Burton, Steven Rostedt (VMware)
From: Paul Burton <paulburton@google.com>
commit 4030a6e6a6a4a42ff8c18414c9e0c93e24cc70b8 upstream.
Currently tgid_map is sized at PID_MAX_DEFAULT entries, which means that
on systems where pid_max is configured higher than PID_MAX_DEFAULT the
ftrace record-tgid option doesn't work so well. Any tasks with PIDs
higher than PID_MAX_DEFAULT are simply not recorded in tgid_map, and
don't show up in the saved_tgids file.
In particular since systemd v243 & above configure pid_max to its
highest possible 1<<22 value by default on 64 bit systems this renders
the record-tgids option of little use.
Increase the size of tgid_map to the configured pid_max instead,
allowing it to cover the full range of PIDs up to the maximum value of
PID_MAX_LIMIT if the system is configured that way.
On 64 bit systems with pid_max == PID_MAX_LIMIT this will increase the
size of tgid_map from 256KiB to 16MiB. Whilst this 64x increase in
memory overhead sounds significant 64 bit systems are presumably best
placed to accommodate it, and since tgid_map is only allocated when the
record-tgid option is actually used presumably the user would rather it
spends sufficient memory to actually record the tgids they expect.
The size of tgid_map could also increase for CONFIG_BASE_SMALL=y
configurations, but these seem unlikely to be systems upon which people
are both configuring a large pid_max and running ftrace with record-tgid
anyway.
Of note is that we only allocate tgid_map once, the first time that the
record-tgid option is enabled. Therefore its size is only set once, to
the value of pid_max at the time the record-tgid option is first
enabled. If a user increases pid_max after that point, the saved_tgids
file will not contain entries for any tasks with pids beyond the earlier
value of pid_max.
Link: https://lkml.kernel.org/r/20210701172407.889626-2-paulburton@google.com
Fixes: d914ba37d714 ("tracing: Add support for recording tgid of tasks")
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Joel Fernandes <joelaf@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Paul Burton <paulburton@google.com>
[ Fixed comment coding style ]
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 63 ++++++++++++++++++++++++++++++++++++++-------------
1 file changed, 47 insertions(+), 16 deletions(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2184,8 +2184,15 @@ void tracing_reset_all_online_cpus(void)
}
}
+/*
+ * The tgid_map array maps from pid to tgid; i.e. the value stored at index i
+ * is the tgid last observed corresponding to pid=i.
+ */
static int *tgid_map;
+/* The maximum valid index into tgid_map. */
+static size_t tgid_map_max;
+
#define SAVED_CMDLINES_DEFAULT 128
#define NO_CMDLINE_MAP UINT_MAX
static arch_spinlock_t trace_cmdline_lock = __ARCH_SPIN_LOCK_UNLOCKED;
@@ -2458,24 +2465,41 @@ void trace_find_cmdline(int pid, char co
preempt_enable();
}
+static int *trace_find_tgid_ptr(int pid)
+{
+ /*
+ * Pairs with the smp_store_release in set_tracer_flag() to ensure that
+ * if we observe a non-NULL tgid_map then we also observe the correct
+ * tgid_map_max.
+ */
+ int *map = smp_load_acquire(&tgid_map);
+
+ if (unlikely(!map || pid > tgid_map_max))
+ return NULL;
+
+ return &map[pid];
+}
+
int trace_find_tgid(int pid)
{
- if (unlikely(!tgid_map || !pid || pid > PID_MAX_DEFAULT))
- return 0;
+ int *ptr = trace_find_tgid_ptr(pid);
- return tgid_map[pid];
+ return ptr ? *ptr : 0;
}
static int trace_save_tgid(struct task_struct *tsk)
{
+ int *ptr;
+
/* treat recording of idle task as a success */
if (!tsk->pid)
return 1;
- if (unlikely(!tgid_map || tsk->pid > PID_MAX_DEFAULT))
+ ptr = trace_find_tgid_ptr(tsk->pid);
+ if (!ptr)
return 0;
- tgid_map[tsk->pid] = tsk->tgid;
+ *ptr = tsk->tgid;
return 1;
}
@@ -5171,6 +5195,8 @@ int trace_keep_overwrite(struct tracer *
int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
{
+ int *map;
+
if ((mask == TRACE_ITER_RECORD_TGID) ||
(mask == TRACE_ITER_RECORD_CMD))
lockdep_assert_held(&event_mutex);
@@ -5193,10 +5219,19 @@ int set_tracer_flag(struct trace_array *
trace_event_enable_cmd_record(enabled);
if (mask == TRACE_ITER_RECORD_TGID) {
- if (!tgid_map)
- tgid_map = kvcalloc(PID_MAX_DEFAULT + 1,
- sizeof(*tgid_map),
- GFP_KERNEL);
+ if (!tgid_map) {
+ tgid_map_max = pid_max;
+ map = kvcalloc(tgid_map_max + 1, sizeof(*tgid_map),
+ GFP_KERNEL);
+
+ /*
+ * Pairs with smp_load_acquire() in
+ * trace_find_tgid_ptr() to ensure that if it observes
+ * the tgid_map we just allocated then it also observes
+ * the corresponding tgid_map_max value.
+ */
+ smp_store_release(&tgid_map, map);
+ }
if (!tgid_map) {
tr->trace_flags &= ~TRACE_ITER_RECORD_TGID;
return -ENOMEM;
@@ -5610,18 +5645,14 @@ static void *saved_tgids_next(struct seq
{
int pid = ++(*pos);
- if (pid > PID_MAX_DEFAULT)
- return NULL;
-
- return &tgid_map[pid];
+ return trace_find_tgid_ptr(pid);
}
static void *saved_tgids_start(struct seq_file *m, loff_t *pos)
{
- if (!tgid_map || *pos > PID_MAX_DEFAULT)
- return NULL;
+ int pid = *pos;
- return &tgid_map[*pos];
+ return trace_find_tgid_ptr(pid);
}
static void saved_tgids_stop(struct seq_file *m, void *v)
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 236/266] ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 235/266] tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 237/266] coresight: Propagate symlink failure Greg Kroah-Hartman
` (33 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Samuel Iglesias Gonsalvez, Lv Yunlong
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
commit 9272e5d0028d45a3b45b58c9255e6e0df53f7ad9 upstream.
In the out_err_bus_register error branch of tpci200_pci_probe,
tpci200->info->cfg_regs is freed by tpci200_uninstall()->
tpci200_unregister()->pci_iounmap(..,tpci200->info->cfg_regs)
in the first time.
But later, iounmap() is called to free tpci200->info->cfg_regs
again.
My patch sets tpci200->info->cfg_regs to NULL after tpci200_uninstall()
to avoid the double free.
Fixes: cea2f7cdff2af ("Staging: ipack/bridges/tpci200: Use the TPCI200 in big endian mode")
Cc: stable <stable@vger.kernel.org>
Acked-by: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Link: https://lore.kernel.org/r/20210524093205.8333-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ipack/carriers/tpci200.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/ipack/carriers/tpci200.c
+++ b/drivers/ipack/carriers/tpci200.c
@@ -596,8 +596,11 @@ static int tpci200_pci_probe(struct pci_
out_err_bus_register:
tpci200_uninstall(tpci200);
+ /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */
+ tpci200->info->cfg_regs = NULL;
out_err_install:
- iounmap(tpci200->info->cfg_regs);
+ if (tpci200->info->cfg_regs)
+ iounmap(tpci200->info->cfg_regs);
out_err_ioremap:
pci_release_region(pdev, TPCI200_CFG_MEM_BAR);
out_err_pci_request:
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 237/266] coresight: Propagate symlink failure
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 236/266] ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 238/266] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() Greg Kroah-Hartman
` (32 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeremy Linton, Mathieu Poirier
From: Jeremy Linton <jeremy.linton@arm.com>
commit 51dd19a7e9f8fbbb7cd92b8a357091911eae7f78 upstream.
If the symlink is unable to be created, the driver goes
ahead and continues device creation. Instead lets propagate
the failure, and fail the probe.
Link: https://lore.kernel.org/r/20210526204042.2681700-1-jeremy.linton@arm.com
Fixes: 8a7365c2d418 ("coresight: Expose device connections via sysfs")
Cc: stable@vger.kernel.org
Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20210614175901.532683-7-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/coresight/coresight-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -1392,7 +1392,7 @@ static int coresight_fixup_device_conns(
}
}
- return 0;
+ return ret;
}
static int coresight_remove_match(struct device *dev, void *data)
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 238/266] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 237/266] coresight: Propagate symlink failure Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 239/266] dm zoned: check zone capacity Greg Kroah-Hartman
` (31 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Suzuki K Poulose,
Mathieu Poirier
From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
commit 5fae8a946ac2df879caf3f79a193d4766d00239b upstream.
commit 6f755e85c332 ("coresight: Add helper for inserting synchronization
packets") removed trailing '\0' from barrier_pkt array and updated the
call sites like etb_update_buffer() to have proper checks for barrier_pkt
size before read but missed updating tmc_update_etf_buffer() which still
reads barrier_pkt past the array size resulting in KASAN out-of-bounds
bug. Fix this by adding a check for barrier_pkt size before accessing
like it is done in etb_update_buffer().
BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698
Read of size 4 at addr ffffffd05b7d1030 by task perf/2629
Call trace:
dump_backtrace+0x0/0x27c
show_stack+0x20/0x2c
dump_stack+0x11c/0x188
print_address_description+0x3c/0x4a4
__kasan_report+0x140/0x164
kasan_report+0x10/0x18
__asan_report_load4_noabort+0x1c/0x24
tmc_update_etf_buffer+0x4b8/0x698
etm_event_stop+0x248/0x2d8
etm_event_del+0x20/0x2c
event_sched_out+0x214/0x6f0
group_sched_out+0xd0/0x270
ctx_sched_out+0x2ec/0x518
__perf_event_task_sched_out+0x4fc/0xe6c
__schedule+0x1094/0x16a0
preempt_schedule_irq+0x88/0x170
arm64_preempt_schedule_irq+0xf0/0x18c
el1_irq+0xe8/0x180
perf_event_exec+0x4d8/0x56c
setup_new_exec+0x204/0x400
load_elf_binary+0x72c/0x18c0
search_binary_handler+0x13c/0x420
load_script+0x500/0x6c4
search_binary_handler+0x13c/0x420
exec_binprm+0x118/0x654
__do_execve_file+0x77c/0xba4
__arm64_compat_sys_execve+0x98/0xac
el0_svc_common+0x1f8/0x5e0
el0_svc_compat_handler+0x84/0xb0
el0_svc_compat+0x10/0x50
The buggy address belongs to the variable:
barrier_pkt+0x10/0x40
Memory state around the buggy address:
ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00
ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03
^
ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa
ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa
==================================================================
Link: https://lore.kernel.org/r/20210505093430.18445-1-saiprakash.ranjan@codeaurora.org
Fixes: 0c3fc4d5fa26 ("coresight: Add barrier packet for synchronisation")
Cc: stable@vger.kernel.org
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20210614175901.532683-6-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -530,7 +530,7 @@ static unsigned long tmc_update_etf_buff
buf_ptr = buf->data_pages[cur] + offset;
*buf_ptr = readl_relaxed(drvdata->base + TMC_RRD);
- if (lost && *barrier) {
+ if (lost && i < CORESIGHT_BARRIER_PKT_SIZE) {
*buf_ptr = *barrier;
barrier++;
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 239/266] dm zoned: check zone capacity
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 238/266] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 240/266] dm writecache: flush origin device when writing and cache is full Greg Kroah-Hartman
` (30 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Damien Le Moal, Mike Snitzer
From: Damien Le Moal <damien.lemoal@wdc.com>
commit bab68499428ed934f0493ac74197ed6f36204260 upstream.
The dm-zoned target cannot support zoned block devices with zones that
have a capacity smaller than the zone size (e.g. NVMe zoned namespaces)
due to the current chunk zone mapping implementation as it is assumed
that zones and chunks have the same size with all blocks usable.
If a zoned drive is found to have zones with a capacity different from
the zone size, fail the target initialization.
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Cc: stable@vger.kernel.org # v5.9+
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-zoned-metadata.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/md/dm-zoned-metadata.c
+++ b/drivers/md/dm-zoned-metadata.c
@@ -1390,6 +1390,13 @@ static int dmz_init_zone(struct blk_zone
return -ENXIO;
}
+ /*
+ * Devices that have zones with a capacity smaller than the zone size
+ * (e.g. NVMe zoned namespaces) are not supported.
+ */
+ if (blkz->capacity != blkz->len)
+ return -ENXIO;
+
switch (blkz->type) {
case BLK_ZONE_TYPE_CONVENTIONAL:
set_bit(DMZ_RND, &zone->flags);
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 240/266] dm writecache: flush origin device when writing and cache is full
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 239/266] dm zoned: check zone capacity Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 241/266] dm btree remove: assign new_root only when removal succeeds Greg Kroah-Hartman
` (29 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer
From: Mikulas Patocka <mpatocka@redhat.com>
commit ee55b92a7391bf871939330f662651b54be51b73 upstream.
Commit d53f1fafec9d086f1c5166436abefdaef30e0363 ("dm writecache: do
direct write if the cache is full") changed dm-writecache, so that it
writes directly to the origin device if the cache is full.
Unfortunately, it doesn't forward flush requests to the origin device,
so that there is a bug where flushes are being ignored.
Fix this by adding missing flush forwarding.
For PMEM mode, we fix this bug by disabling direct writes to the origin
device, because it performs better.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: d53f1fafec9d ("dm writecache: do direct write if the cache is full")
Cc: stable@vger.kernel.org # v5.7+
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-writecache.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -1297,8 +1297,12 @@ static int writecache_map(struct dm_targ
writecache_flush(wc);
if (writecache_has_error(wc))
goto unlock_error;
+ if (unlikely(wc->cleaner))
+ goto unlock_remap_origin;
goto unlock_submit;
} else {
+ if (dm_bio_get_target_bio_nr(bio))
+ goto unlock_remap_origin;
writecache_offload_bio(wc, bio);
goto unlock_return;
}
@@ -1377,7 +1381,7 @@ read_next_block:
}
e = writecache_pop_from_freelist(wc, (sector_t)-1);
if (unlikely(!e)) {
- if (!found_entry) {
+ if (!WC_MODE_PMEM(wc) && !found_entry) {
direct_write:
e = writecache_find_entry(wc, bio->bi_iter.bi_sector, WFE_RETURN_FOLLOWING);
if (e) {
@@ -2481,7 +2485,7 @@ overflow:
goto bad;
}
- ti->num_flush_bios = 1;
+ ti->num_flush_bios = WC_MODE_PMEM(wc) ? 1 : 2;
ti->flush_supported = true;
ti->num_discard_bios = 1;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 241/266] dm btree remove: assign new_root only when removal succeeds
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 240/266] dm writecache: flush origin device when writing and cache is full Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 242/266] PCI: Leave Apple Thunderbolt controllers on for s2idle or standby Greg Kroah-Hartman
` (28 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hou Tao, Mike Snitzer
From: Hou Tao <houtao1@huawei.com>
commit b6e58b5466b2959f83034bead2e2e1395cca8aeb upstream.
remove_raw() in dm_btree_remove() may fail due to IO read error
(e.g. read the content of origin block fails during shadowing),
and the value of shadow_spine::root is uninitialized, but
the uninitialized value is still assign to new_root in the
end of dm_btree_remove().
For dm-thin, the value of pmd->details_root or pmd->root will become
an uninitialized value, so if trying to read details_info tree again
out-of-bound memory may occur as showed below:
general protection fault, probably for non-canonical address 0x3fdcb14c8d7520
CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6
Hardware name: QEMU Standard PC
RIP: 0010:metadata_ll_load_ie+0x14/0x30
Call Trace:
sm_metadata_count_is_more_than_one+0xb9/0xe0
dm_tm_shadow_block+0x52/0x1c0
shadow_step+0x59/0xf0
remove_raw+0xb2/0x170
dm_btree_remove+0xf4/0x1c0
dm_pool_delete_thin_device+0xc3/0x140
pool_message+0x218/0x2b0
target_message+0x251/0x290
ctl_ioctl+0x1c4/0x4d0
dm_ctl_ioctl+0xe/0x20
__x64_sys_ioctl+0x7b/0xb0
do_syscall_64+0x40/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Fixing it by only assign new_root when removal succeeds
Signed-off-by: Hou Tao <houtao1@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-btree-remove.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -549,7 +549,8 @@ int dm_btree_remove(struct dm_btree_info
delete_at(n, index);
}
- *new_root = shadow_root(&spine);
+ if (!r)
+ *new_root = shadow_root(&spine);
exit_shadow_spine(&spine);
return r;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 242/266] PCI: Leave Apple Thunderbolt controllers on for s2idle or standby
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 241/266] dm btree remove: assign new_root only when removal succeeds Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 243/266] PCI: aardvark: Fix checking for PIO Non-posted Request Greg Kroah-Hartman
` (27 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konstantin Kharlamov, Bjorn Helgaas,
Lukas Wunner
From: Konstantin Kharlamov <Hi-Angel@yandex.ru>
commit 4694ae373dc2114f9a82f6ae15737e65af0c6dea upstream.
On Macbook 2013, resuming from suspend-to-idle or standby resulted in the
external monitor no longer being detected, a stacktrace, and errors like
this in dmesg:
pcieport 0000:06:00.0: can't change power state from D3hot to D0 (config space inaccessible)
The reason is that we know how to turn power to the Thunderbolt controller
*off* via the SXIO/SXFP/SXLF methods, but we don't know how to turn power
back on. We have to rely on firmware to turn the power back on.
When going to the "suspend-to-idle" or "standby" system sleep states,
firmware is not involved either on the suspend side or the resume side, so
we can't use SXIO/SXFP/SXLF to turn the power off.
Skip SXIO/SXFP/SXLF when firmware isn't involved in suspend, e.g., when
we're going to the "suspend-to-idle" or "standby" system sleep states.
Fixes: 1df5172c5c25 ("PCI: Suspend/resume quirks for Apple thunderbolt")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212767
Link: https://lore.kernel.org/r/20210520235501.917397-1-Hi-Angel@yandex.ru
Signed-off-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -27,6 +27,7 @@
#include <linux/nvme.h>
#include <linux/platform_data/x86/apple.h>
#include <linux/pm_runtime.h>
+#include <linux/suspend.h>
#include <linux/switchtec.h>
#include <asm/dma.h> /* isa_dma_bridge_buggy */
#include "pci.h"
@@ -3656,6 +3657,16 @@ static void quirk_apple_poweroff_thunder
return;
if (pci_pcie_type(dev) != PCI_EXP_TYPE_UPSTREAM)
return;
+
+ /*
+ * SXIO/SXFP/SXLF turns off power to the Thunderbolt controller.
+ * We don't know how to turn it back on again, but firmware does,
+ * so we can only use SXIO/SXFP/SXLF if we're suspending via
+ * firmware.
+ */
+ if (!pm_suspend_via_firmware())
+ return;
+
bridge = ACPI_HANDLE(&dev->dev);
if (!bridge)
return;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 243/266] PCI: aardvark: Fix checking for PIO Non-posted Request
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 242/266] PCI: Leave Apple Thunderbolt controllers on for s2idle or standby Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:39 ` [PATCH 5.13 244/266] PCI: aardvark: Implement workaround for the readback value of VEND_ID Greg Kroah-Hartman
` (26 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Lorenzo Pieralisi,
Marek Behún
From: Pali Rohár <pali@kernel.org>
commit 8ceeac307a79f68c0d0c72d6e48b82fa424204ec upstream.
PIO_NON_POSTED_REQ for PIO_STAT register is incorrectly defined. Bit 10 in
register PIO_STAT indicates the response is to a non-posted request.
Link: https://lore.kernel.org/r/20210624213345.3617-2-pali@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-aardvark.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -57,7 +57,7 @@
#define PIO_COMPLETION_STATUS_UR 1
#define PIO_COMPLETION_STATUS_CRS 2
#define PIO_COMPLETION_STATUS_CA 4
-#define PIO_NON_POSTED_REQ BIT(0)
+#define PIO_NON_POSTED_REQ BIT(10)
#define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8)
#define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc)
#define PIO_WR_DATA (PIO_BASE_ADDR + 0x10)
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 244/266] PCI: aardvark: Implement workaround for the readback value of VEND_ID
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 243/266] PCI: aardvark: Fix checking for PIO Non-posted Request Greg Kroah-Hartman
@ 2021-07-15 18:39 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 245/266] media: subdev: disallow ioctl for saa6588/davinci Greg Kroah-Hartman
` (25 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:39 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Lorenzo Pieralisi,
Marek Behún
From: Pali Rohár <pali@kernel.org>
commit 7f71a409fe3d9358da07c77f15bb5b7960f12253 upstream.
Marvell Armada 3700 Functional Errata, Guidelines, and Restrictions
document describes in erratum 4.1 PCIe value of vendor ID (Ref #: 243):
The readback value of VEND_ID (RD0070000h [15:0]) is 1B4Bh, while it
should read 11ABh.
The firmware can write the correct value, 11ABh, through VEND_ID
(RD0076044h [15:0]).
Implement this workaround in aardvark driver for both PCI vendor id and PCI
subsystem vendor id.
This change affects and fixes PCI vendor id of emulated PCIe root bridge.
After this change emulated PCIe root bridge has correct vendor id.
Link: https://lore.kernel.org/r/20210624222621.4776-5-pali@kernel.org
Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-aardvark.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -125,6 +125,7 @@
#define LTSSM_MASK 0x3f
#define LTSSM_L0 0x10
#define RC_BAR_CONFIG 0x300
+#define VENDOR_ID_REG (LMI_BASE_ADDR + 0x44)
/* PCIe core controller registers */
#define CTRL_CORE_BASE_ADDR 0x18000
@@ -385,6 +386,16 @@ static void advk_pcie_setup_hw(struct ad
reg |= (IS_RC_MSK << IS_RC_SHIFT);
advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG);
+ /*
+ * Replace incorrect PCI vendor id value 0x1b4b by correct value 0x11ab.
+ * VENDOR_ID_REG contains vendor id in low 16 bits and subsystem vendor
+ * id in high 16 bits. Updating this register changes readback value of
+ * read-only vendor id bits in PCIE_CORE_DEV_ID_REG register. Workaround
+ * for erratum 4.1: "The value of device and vendor ID is incorrect".
+ */
+ reg = (PCI_VENDOR_ID_MARVELL << 16) | PCI_VENDOR_ID_MARVELL;
+ advk_writel(pcie, reg, VENDOR_ID_REG);
+
/* Set Advanced Error Capabilities and Control PF0 register */
reg = PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX |
PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX_EN |
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 245/266] media: subdev: disallow ioctl for saa6588/davinci
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2021-07-15 18:39 ` [PATCH 5.13 244/266] PCI: aardvark: Implement workaround for the readback value of VEND_ID Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 246/266] media: i2c: ccs-core: fix pm_runtime_get_sync() usage count Greg Kroah-Hartman
` (24 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Laurent Pinchart,
Hans Verkuil, Mauro Carvalho Chehab
From: Arnd Bergmann <arnd@arndb.de>
commit 0a7790be182d32b9b332a37cb4206e24fe94b728 upstream.
The saa6588_ioctl() function expects to get called from other kernel
functions with a 'saa6588_command' pointer, but I found nothing stops it
from getting called from user space instead, which seems rather dangerous.
The same thing happens in the davinci vpbe driver with its VENC_GET_FLD
command.
As a quick fix, add a separate .command() callback pointer for this
driver and change the two callers over to that. This change can easily
get backported to stable kernels if necessary, but since there are only
two drivers, we may want to eventually replace this with a set of more
specialized callbacks in the long run.
Fixes: c3fda7f835b0 ("V4L/DVB (10537): saa6588: convert to v4l2_subdev.")
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/saa6588.c | 4 ++--
drivers/media/pci/bt8xx/bttv-driver.c | 6 +++---
drivers/media/pci/saa7134/saa7134-video.c | 6 +++---
drivers/media/platform/davinci/vpbe_display.c | 2 +-
drivers/media/platform/davinci/vpbe_venc.c | 6 ++----
include/media/v4l2-subdev.h | 4 ++++
6 files changed, 15 insertions(+), 13 deletions(-)
--- a/drivers/media/i2c/saa6588.c
+++ b/drivers/media/i2c/saa6588.c
@@ -380,7 +380,7 @@ static void saa6588_configure(struct saa
/* ---------------------------------------------------------------------- */
-static long saa6588_ioctl(struct v4l2_subdev *sd, unsigned int cmd, void *arg)
+static long saa6588_command(struct v4l2_subdev *sd, unsigned int cmd, void *arg)
{
struct saa6588 *s = to_saa6588(sd);
struct saa6588_command *a = arg;
@@ -433,7 +433,7 @@ static int saa6588_s_tuner(struct v4l2_s
/* ----------------------------------------------------------------------- */
static const struct v4l2_subdev_core_ops saa6588_core_ops = {
- .ioctl = saa6588_ioctl,
+ .command = saa6588_command,
};
static const struct v4l2_subdev_tuner_ops saa6588_tuner_ops = {
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -3179,7 +3179,7 @@ static int radio_release(struct file *fi
btv->radio_user--;
- bttv_call_all(btv, core, ioctl, SAA6588_CMD_CLOSE, &cmd);
+ bttv_call_all(btv, core, command, SAA6588_CMD_CLOSE, &cmd);
if (btv->radio_user == 0)
btv->has_radio_tuner = 0;
@@ -3260,7 +3260,7 @@ static ssize_t radio_read(struct file *f
cmd.result = -ENODEV;
radio_enable(btv);
- bttv_call_all(btv, core, ioctl, SAA6588_CMD_READ, &cmd);
+ bttv_call_all(btv, core, command, SAA6588_CMD_READ, &cmd);
return cmd.result;
}
@@ -3281,7 +3281,7 @@ static __poll_t radio_poll(struct file *
cmd.instance = file;
cmd.event_list = wait;
cmd.poll_mask = res;
- bttv_call_all(btv, core, ioctl, SAA6588_CMD_POLL, &cmd);
+ bttv_call_all(btv, core, command, SAA6588_CMD_POLL, &cmd);
return cmd.poll_mask;
}
--- a/drivers/media/pci/saa7134/saa7134-video.c
+++ b/drivers/media/pci/saa7134/saa7134-video.c
@@ -1181,7 +1181,7 @@ static int video_release(struct file *fi
saa_call_all(dev, tuner, standby);
if (vdev->vfl_type == VFL_TYPE_RADIO)
- saa_call_all(dev, core, ioctl, SAA6588_CMD_CLOSE, &cmd);
+ saa_call_all(dev, core, command, SAA6588_CMD_CLOSE, &cmd);
mutex_unlock(&dev->lock);
return 0;
@@ -1200,7 +1200,7 @@ static ssize_t radio_read(struct file *f
cmd.result = -ENODEV;
mutex_lock(&dev->lock);
- saa_call_all(dev, core, ioctl, SAA6588_CMD_READ, &cmd);
+ saa_call_all(dev, core, command, SAA6588_CMD_READ, &cmd);
mutex_unlock(&dev->lock);
return cmd.result;
@@ -1216,7 +1216,7 @@ static __poll_t radio_poll(struct file *
cmd.event_list = wait;
cmd.poll_mask = 0;
mutex_lock(&dev->lock);
- saa_call_all(dev, core, ioctl, SAA6588_CMD_POLL, &cmd);
+ saa_call_all(dev, core, command, SAA6588_CMD_POLL, &cmd);
mutex_unlock(&dev->lock);
return rc | cmd.poll_mask;
--- a/drivers/media/platform/davinci/vpbe_display.c
+++ b/drivers/media/platform/davinci/vpbe_display.c
@@ -47,7 +47,7 @@ static int venc_is_second_field(struct v
ret = v4l2_subdev_call(vpbe_dev->venc,
core,
- ioctl,
+ command,
VENC_GET_FLD,
&val);
if (ret < 0) {
--- a/drivers/media/platform/davinci/vpbe_venc.c
+++ b/drivers/media/platform/davinci/vpbe_venc.c
@@ -521,9 +521,7 @@ static int venc_s_routing(struct v4l2_su
return ret;
}
-static long venc_ioctl(struct v4l2_subdev *sd,
- unsigned int cmd,
- void *arg)
+static long venc_command(struct v4l2_subdev *sd, unsigned int cmd, void *arg)
{
u32 val;
@@ -542,7 +540,7 @@ static long venc_ioctl(struct v4l2_subde
}
static const struct v4l2_subdev_core_ops venc_core_ops = {
- .ioctl = venc_ioctl,
+ .command = venc_command,
};
static const struct v4l2_subdev_video_ops venc_video_ops = {
--- a/include/media/v4l2-subdev.h
+++ b/include/media/v4l2-subdev.h
@@ -162,6 +162,9 @@ struct v4l2_subdev_io_pin_config {
* @s_gpio: set GPIO pins. Very simple right now, might need to be extended with
* a direction argument if needed.
*
+ * @command: called by in-kernel drivers in order to call functions internal
+ * to subdev drivers driver that have a separate callback.
+ *
* @ioctl: called at the end of ioctl() syscall handler at the V4L2 core.
* used to provide support for private ioctls used on the driver.
*
@@ -193,6 +196,7 @@ struct v4l2_subdev_core_ops {
int (*load_fw)(struct v4l2_subdev *sd);
int (*reset)(struct v4l2_subdev *sd, u32 val);
int (*s_gpio)(struct v4l2_subdev *sd, u32 val);
+ long (*command)(struct v4l2_subdev *sd, unsigned int cmd, void *arg);
long (*ioctl)(struct v4l2_subdev *sd, unsigned int cmd, void *arg);
#ifdef CONFIG_COMPAT
long (*compat_ioctl32)(struct v4l2_subdev *sd, unsigned int cmd,
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 246/266] media: i2c: ccs-core: fix pm_runtime_get_sync() usage count
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 245/266] media: subdev: disallow ioctl for saa6588/davinci Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 247/266] media: dtv5100: fix control-request directions Greg Kroah-Hartman
` (23 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Mauro Carvalho Chehab
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
commit da3a1858c3a37c09446e1470c48352897d59d11b upstream.
The pm_runtime_get_sync() internally increments the
dev->power.usage_count without decrementing it, even on errors.
There is a bug at ccs_pm_get_init(): when this function returns
an error, the stream is not started, and RPM usage_count
should not be incremented. However, if the calls to
v4l2_ctrl_handler_setup() return errors, it will be kept
incremented.
At ccs_suspend() the best is to replace it by the new
pm_runtime_resume_and_get(), introduced by:
commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
in order to properly decrement the usage counter automatically,
in the case of errors.
Fixes: 96e3a6b92f23 ("media: smiapp: Avoid maintaining power state information")
Cc: stable@vger.kernel.org
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ccs/ccs-core.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)
--- a/drivers/media/i2c/ccs/ccs-core.c
+++ b/drivers/media/i2c/ccs/ccs-core.c
@@ -1880,21 +1880,33 @@ static int ccs_pm_get_init(struct ccs_se
struct i2c_client *client = v4l2_get_subdevdata(&sensor->src->sd);
int rval;
+ /*
+ * It can't use pm_runtime_resume_and_get() here, as the driver
+ * relies at the returned value to detect if the device was already
+ * active or not.
+ */
rval = pm_runtime_get_sync(&client->dev);
- if (rval < 0) {
- pm_runtime_put_noidle(&client->dev);
+ if (rval < 0)
+ goto error;
- return rval;
- } else if (!rval) {
- rval = v4l2_ctrl_handler_setup(&sensor->pixel_array->
- ctrl_handler);
- if (rval)
- return rval;
+ /* Device was already active, so don't set controls */
+ if (rval == 1)
+ return 0;
- return v4l2_ctrl_handler_setup(&sensor->src->ctrl_handler);
- }
+ /* Restore V4L2 controls to the previously suspended device */
+ rval = v4l2_ctrl_handler_setup(&sensor->pixel_array->ctrl_handler);
+ if (rval)
+ goto error;
+ rval = v4l2_ctrl_handler_setup(&sensor->src->ctrl_handler);
+ if (rval)
+ goto error;
+
+ /* Keep PM runtime usage_count incremented on success */
return 0;
+error:
+ pm_runtime_put(&client->dev);
+ return rval;
}
static int ccs_set_stream(struct v4l2_subdev *subdev, int enable)
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 247/266] media: dtv5100: fix control-request directions
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 246/266] media: i2c: ccs-core: fix pm_runtime_get_sync() usage count Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 248/266] media: zr364xx: fix memory leak in zr364xx_start_readpipe Greg Kroah-Hartman
` (22 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 8c8b9a9be2afa8bd6a72ad1130532baab9fab89d upstream.
The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.
Fix the control requests which erroneously used usb_rcvctrlpipe().
Fixes: 8466028be792 ("V4L/DVB (8734): Initial support for AME DTV-5100 USB2.0 DVB-T")
Cc: stable@vger.kernel.org # 2.6.28
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/dtv5100.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/dvb-usb/dtv5100.c
+++ b/drivers/media/usb/dvb-usb/dtv5100.c
@@ -26,6 +26,7 @@ static int dtv5100_i2c_msg(struct dvb_us
u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
{
struct dtv5100_state *st = d->priv;
+ unsigned int pipe;
u8 request;
u8 type;
u16 value;
@@ -34,6 +35,7 @@ static int dtv5100_i2c_msg(struct dvb_us
switch (wlen) {
case 1:
/* write { reg }, read { value } */
+ pipe = usb_rcvctrlpipe(d->udev, 0);
request = (addr == DTV5100_DEMOD_ADDR ? DTV5100_DEMOD_READ :
DTV5100_TUNER_READ);
type = USB_TYPE_VENDOR | USB_DIR_IN;
@@ -41,6 +43,7 @@ static int dtv5100_i2c_msg(struct dvb_us
break;
case 2:
/* write { reg, value } */
+ pipe = usb_sndctrlpipe(d->udev, 0);
request = (addr == DTV5100_DEMOD_ADDR ? DTV5100_DEMOD_WRITE :
DTV5100_TUNER_WRITE);
type = USB_TYPE_VENDOR | USB_DIR_OUT;
@@ -54,7 +57,7 @@ static int dtv5100_i2c_msg(struct dvb_us
memcpy(st->data, rbuf, rlen);
msleep(1); /* avoid I2C errors */
- return usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), request,
+ return usb_control_msg(d->udev, pipe, request,
type, value, index, st->data, rlen,
DTV5100_USB_TIMEOUT);
}
@@ -141,7 +144,7 @@ static int dtv5100_probe(struct usb_inte
/* initialize non qt1010/zl10353 part? */
for (i = 0; dtv5100_init[i].request; i++) {
- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
dtv5100_init[i].request,
USB_TYPE_VENDOR | USB_DIR_OUT,
dtv5100_init[i].value,
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 248/266] media: zr364xx: fix memory leak in zr364xx_start_readpipe
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 247/266] media: dtv5100: fix control-request directions Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 249/266] media: ccs: Fix the op_pll_multiplier address Greg Kroah-Hartman
` (21 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+af4fa391ef18efdd5f69,
Pavel Skripkin, Hans Verkuil, Mauro Carvalho Chehab
From: Pavel Skripkin <paskripkin@gmail.com>
commit 0a045eac8d0427b64577a24d74bb8347c905ac65 upstream.
syzbot reported memory leak in zr364xx driver.
The problem was in non-freed urb in case of
usb_submit_urb() fail.
backtrace:
[<ffffffff82baedf6>] kmalloc include/linux/slab.h:561 [inline]
[<ffffffff82baedf6>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
[<ffffffff82f7cce8>] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022
[<ffffffff84251dfc>] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline]
[<ffffffff84251dfc>] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516
[<ffffffff82bb6507>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<ffffffff826018a9>] really_probe+0x159/0x500 drivers/base/dd.c:576
Fixes: ccbf035ae5de ("V4L/DVB (12278): zr364xx: implement V4L2_CAP_STREAMING")
Cc: stable@vger.kernel.org
Reported-by: syzbot+af4fa391ef18efdd5f69@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/zr364xx/zr364xx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/usb/zr364xx/zr364xx.c
+++ b/drivers/media/usb/zr364xx/zr364xx.c
@@ -1032,6 +1032,7 @@ static int zr364xx_start_readpipe(struct
DBG("submitting URB %p\n", pipe_info->stream_urb);
retval = usb_submit_urb(pipe_info->stream_urb, GFP_KERNEL);
if (retval) {
+ usb_free_urb(pipe_info->stream_urb);
printk(KERN_ERR KBUILD_MODNAME ": start read pipe failed\n");
return retval;
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 249/266] media: ccs: Fix the op_pll_multiplier address
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 248/266] media: zr364xx: fix memory leak in zr364xx_start_readpipe Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 250/266] media: gspca/sq905: fix control-request direction Greg Kroah-Hartman
` (20 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bernhard Wimmer, Sakari Ailus,
Mauro Carvalho Chehab
From: Bernhard Wimmer <be.wimm@gmail.com>
commit 0e3e0c9369c822b7f1dd11504eeb98cfd4aabf24 upstream.
According to the CCS spec the op_pll_multiplier address is 0x030e,
not 0x031e.
Signed-off-by: Bernhard Wimmer <be.wimm@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
Fixes: 6493c4b777c2 ("media: smiapp: Import CCS definitions")
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ccs/ccs-limits.c | 4 ++++
drivers/media/i2c/ccs/ccs-limits.h | 4 ++++
drivers/media/i2c/ccs/ccs-regs.h | 6 +++++-
3 files changed, 13 insertions(+), 1 deletion(-)
--- a/drivers/media/i2c/ccs/ccs-limits.c
+++ b/drivers/media/i2c/ccs/ccs-limits.c
@@ -1,5 +1,9 @@
// SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause
/* Copyright (C) 2019--2020 Intel Corporation */
+/*
+ * Generated by Documentation/driver-api/media/drivers/ccs/mk-ccs-regs;
+ * do not modify.
+ */
#include "ccs-limits.h"
#include "ccs-regs.h"
--- a/drivers/media/i2c/ccs/ccs-limits.h
+++ b/drivers/media/i2c/ccs/ccs-limits.h
@@ -1,5 +1,9 @@
/* SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause */
/* Copyright (C) 2019--2020 Intel Corporation */
+/*
+ * Generated by Documentation/driver-api/media/drivers/ccs/mk-ccs-regs;
+ * do not modify.
+ */
#ifndef __CCS_LIMITS_H__
#define __CCS_LIMITS_H__
--- a/drivers/media/i2c/ccs/ccs-regs.h
+++ b/drivers/media/i2c/ccs/ccs-regs.h
@@ -1,5 +1,9 @@
/* SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause */
/* Copyright (C) 2019--2020 Intel Corporation */
+/*
+ * Generated by Documentation/driver-api/media/drivers/ccs/mk-ccs-regs;
+ * do not modify.
+ */
#ifndef __CCS_REGS_H__
#define __CCS_REGS_H__
@@ -202,7 +206,7 @@
#define CCS_R_OP_PIX_CLK_DIV (0x0308 | CCS_FL_16BIT)
#define CCS_R_OP_SYS_CLK_DIV (0x030a | CCS_FL_16BIT)
#define CCS_R_OP_PRE_PLL_CLK_DIV (0x030c | CCS_FL_16BIT)
-#define CCS_R_OP_PLL_MULTIPLIER (0x031e | CCS_FL_16BIT)
+#define CCS_R_OP_PLL_MULTIPLIER (0x030e | CCS_FL_16BIT)
#define CCS_R_PLL_MODE 0x0310
#define CCS_PLL_MODE_SHIFT 0U
#define CCS_PLL_MODE_MASK 0x1
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 250/266] media: gspca/sq905: fix control-request direction
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 249/266] media: ccs: Fix the op_pll_multiplier address Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 251/266] media: gspca/sunplus: fix zero-length control requests Greg Kroah-Hartman
` (19 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 53ae298fde7adcc4b1432bce2dbdf8dac54dfa72 upstream.
The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.
Fix the USB_REQ_SYNCH_FRAME request which erroneously used
usb_sndctrlpipe().
Fixes: 27d35fc3fb06 ("V4L/DVB (10639): gspca - sq905: New subdriver.")
Cc: stable@vger.kernel.org # 2.6.30
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/gspca/sq905.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/usb/gspca/sq905.c
+++ b/drivers/media/usb/gspca/sq905.c
@@ -116,7 +116,7 @@ static int sq905_command(struct gspca_de
}
ret = usb_control_msg(gspca_dev->dev,
- usb_sndctrlpipe(gspca_dev->dev, 0),
+ usb_rcvctrlpipe(gspca_dev->dev, 0),
USB_REQ_SYNCH_FRAME, /* request */
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
SQ905_PING, 0, gspca_dev->usb_buf, 1,
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 251/266] media: gspca/sunplus: fix zero-length control requests
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 250/266] media: gspca/sq905: fix control-request direction Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 252/266] media: rtl28xxu: fix zero-length control request Greg Kroah-Hartman
` (18 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit b4bb4d425b7b02424afea2dfdcd77b3b4794175e upstream.
The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.
Control transfers without a data stage are treated as OUT requests by
the USB stack and should be using usb_sndctrlpipe(). Failing to do so
will now trigger a warning.
Fix the single zero-length control request which was using the
read-register helper, and update the helper so that zero-length reads
fail with an error message instead.
Fixes: 6a7eba24e4f0 ("V4L/DVB (8157): gspca: all subdrivers")
Cc: stable@vger.kernel.org # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/gspca/sunplus.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -242,6 +242,10 @@ static void reg_r(struct gspca_dev *gspc
gspca_err(gspca_dev, "reg_r: buffer overflow\n");
return;
}
+ if (len == 0) {
+ gspca_err(gspca_dev, "reg_r: zero-length read\n");
+ return;
+ }
if (gspca_dev->usb_err < 0)
return;
ret = usb_control_msg(gspca_dev->dev,
@@ -250,7 +254,7 @@ static void reg_r(struct gspca_dev *gspc
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
0, /* value */
index,
- len ? gspca_dev->usb_buf : NULL, len,
+ gspca_dev->usb_buf, len,
500);
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
@@ -727,7 +731,7 @@ static int sd_start(struct gspca_dev *gs
case MegaImageVI:
reg_w_riv(gspca_dev, 0xf0, 0, 0);
spca504B_WaitCmdStatus(gspca_dev);
- reg_r(gspca_dev, 0xf0, 4, 0);
+ reg_w_riv(gspca_dev, 0xf0, 4, 0);
spca504B_WaitCmdStatus(gspca_dev);
break;
default:
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 252/266] media: rtl28xxu: fix zero-length control request
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 251/266] media: gspca/sunplus: fix zero-length control requests Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-16 7:54 ` Johan Hovold
2021-07-15 18:40 ` [PATCH 5.13 253/266] media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K Greg Kroah-Hartman
` (17 subsequent siblings)
269 siblings, 1 reply; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+faf11bbadc5a372564da,
Antti Palosaari, Johan Hovold, Hans Verkuil,
Mauro Carvalho Chehab
From: Johan Hovold <johan@kernel.org>
commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.
Control transfers without a data stage are treated as OUT requests by
the USB stack and should be using usb_sndctrlpipe(). Failing to do so
will now trigger a warning.
Fix the zero-length i2c-read request used for type detection by
attempting to read a single byte instead.
Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
Cc: stable@vger.kernel.org # 4.0
Cc: Antti Palosaari <crope@iki.fi>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -612,8 +612,9 @@ static int rtl28xxu_read_config(struct d
static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
{
struct rtl28xxu_dev *dev = d_to_priv(d);
+ u8 buf[1];
int ret;
- struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
+ struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
dev_dbg(&d->intf->dev, "\n");
^ permalink raw reply [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 252/266] media: rtl28xxu: fix zero-length control request
2021-07-15 18:40 ` [PATCH 5.13 252/266] media: rtl28xxu: fix zero-length control request Greg Kroah-Hartman
@ 2021-07-16 7:54 ` Johan Hovold
2021-07-16 17:59 ` Greg Kroah-Hartman
0 siblings, 1 reply; 277+ messages in thread
From: Johan Hovold @ 2021-07-16 7:54 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, syzbot+faf11bbadc5a372564da,
Antti Palosaari, Hans Verkuil, Mauro Carvalho Chehab
On Thu, Jul 15, 2021 at 08:40:07PM +0200, Greg Kroah-Hartman wrote:
> From: Johan Hovold <johan@kernel.org>
>
> commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
>
> The direction of the pipe argument must match the request-type direction
> bit or control requests may fail depending on the host-controller-driver
> implementation.
>
> Control transfers without a data stage are treated as OUT requests by
> the USB stack and should be using usb_sndctrlpipe(). Failing to do so
> will now trigger a warning.
>
> Fix the zero-length i2c-read request used for type detection by
> attempting to read a single byte instead.
>
> Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
> Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
> Cc: stable@vger.kernel.org # 4.0
> Cc: Antti Palosaari <crope@iki.fi>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Please drop this patch from all stable trees.
This patch causes a regression and a second version was sent almost two
months ago, but I'm not getting any response whatsoever from the media
maintainers.
I resent the correct fix and a revert of this one almost a month ago and
the cover letter includes some further details:
https://lore.kernel.org/r/20210623084521.7105-1-johan@kernel.org
But this still hasn't been fixed in linux-next.
> ---
> drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> --- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
> +++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
> @@ -612,8 +612,9 @@ static int rtl28xxu_read_config(struct d
> static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
> {
> struct rtl28xxu_dev *dev = d_to_priv(d);
> + u8 buf[1];
> int ret;
> - struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
> + struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
>
> dev_dbg(&d->intf->dev, "\n");
>
>
>
Johan
^ permalink raw reply [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 252/266] media: rtl28xxu: fix zero-length control request
2021-07-16 7:54 ` Johan Hovold
@ 2021-07-16 17:59 ` Greg Kroah-Hartman
0 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-16 17:59 UTC (permalink / raw)
To: Johan Hovold
Cc: linux-kernel, stable, syzbot+faf11bbadc5a372564da,
Antti Palosaari, Hans Verkuil, Mauro Carvalho Chehab
On Fri, Jul 16, 2021 at 09:54:49AM +0200, Johan Hovold wrote:
> On Thu, Jul 15, 2021 at 08:40:07PM +0200, Greg Kroah-Hartman wrote:
> > From: Johan Hovold <johan@kernel.org>
> >
> > commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
> >
> > The direction of the pipe argument must match the request-type direction
> > bit or control requests may fail depending on the host-controller-driver
> > implementation.
> >
> > Control transfers without a data stage are treated as OUT requests by
> > the USB stack and should be using usb_sndctrlpipe(). Failing to do so
> > will now trigger a warning.
> >
> > Fix the zero-length i2c-read request used for type detection by
> > attempting to read a single byte instead.
> >
> > Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
> > Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
> > Cc: stable@vger.kernel.org # 4.0
> > Cc: Antti Palosaari <crope@iki.fi>
> > Signed-off-by: Johan Hovold <johan@kernel.org>
> > Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
> > Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> Please drop this patch from all stable trees.
>
> This patch causes a regression and a second version was sent almost two
> months ago, but I'm not getting any response whatsoever from the media
> maintainers.
>
> I resent the correct fix and a revert of this one almost a month ago and
> the cover letter includes some further details:
>
> https://lore.kernel.org/r/20210623084521.7105-1-johan@kernel.org
>
> But this still hasn't been fixed in linux-next.
Now dropped from all stable queues, thanks.
greg k-h
^ permalink raw reply [flat|nested] 277+ messages in thread
* [PATCH 5.13 253/266] media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 252/266] media: rtl28xxu: fix zero-length control request Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 254/266] s390/vdso: always enable vdso Greg Kroah-Hartman
` (16 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Drung, Laurent Pinchart,
Mauro Carvalho Chehab
From: Benjamin Drung <bdrung@posteo.de>
commit 4c6e0976295add7f0ed94d276c04a3d6f1ea8f83 upstream.
The Elgato Cam Link 4K HDMI video capture card reports to support three
different pixel formats, where the first format depends on the connected
HDMI device.
```
$ v4l2-ctl -d /dev/video0 --list-formats-ext
ioctl: VIDIOC_ENUM_FMT
Type: Video Capture
[0]: 'NV12' (Y/CbCr 4:2:0)
Size: Discrete 3840x2160
Interval: Discrete 0.033s (29.970 fps)
[1]: 'NV12' (Y/CbCr 4:2:0)
Size: Discrete 3840x2160
Interval: Discrete 0.033s (29.970 fps)
[2]: 'YU12' (Planar YUV 4:2:0)
Size: Discrete 3840x2160
Interval: Discrete 0.033s (29.970 fps)
```
Changing the pixel format to anything besides the first pixel format
does not work:
```
$ v4l2-ctl -d /dev/video0 --try-fmt-video pixelformat=YU12
Format Video Capture:
Width/Height : 3840/2160
Pixel Format : 'NV12' (Y/CbCr 4:2:0)
Field : None
Bytes per Line : 3840
Size Image : 12441600
Colorspace : sRGB
Transfer Function : Rec. 709
YCbCr/HSV Encoding: Rec. 709
Quantization : Default (maps to Limited Range)
Flags :
```
User space applications like VLC might show an error message on the
terminal in that case:
```
libv4l2: error set_fmt gave us a different result than try_fmt!
```
Depending on the error handling of the user space applications, they
might display a distorted video, because they use the wrong pixel format
for decoding the stream.
The Elgato Cam Link 4K responds to the USB video probe
VS_PROBE_CONTROL/VS_COMMIT_CONTROL with a malformed data structure: The
second byte contains bFormatIndex (instead of being the second byte of
bmHint). The first byte is always zero. The third byte is always 1.
The firmware bug was reported to Elgato on 2020-12-01 and it was
forwarded by the support team to the developers as feature request.
There is no firmware update available since then. The latest firmware
for Elgato Cam Link 4K as of 2021-03-23 has MCU 20.02.19 and FPGA 67.
Therefore correct the malformed data structure for this device. The
change was successfully tested with VLC, OBS, and Chromium using
different pixel formats (YUYV, NV12, YU12), resolutions (3840x2160,
1920x1080), and frame rates (29.970 and 59.940 fps).
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Drung <bdrung@posteo.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_video.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -127,10 +127,37 @@ int uvc_query_ctrl(struct uvc_device *de
static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
struct uvc_streaming_control *ctrl)
{
+ static const struct usb_device_id elgato_cam_link_4k = {
+ USB_DEVICE(0x0fd9, 0x0066)
+ };
struct uvc_format *format = NULL;
struct uvc_frame *frame = NULL;
unsigned int i;
+ /*
+ * The response of the Elgato Cam Link 4K is incorrect: The second byte
+ * contains bFormatIndex (instead of being the second byte of bmHint).
+ * The first byte is always zero. The third byte is always 1.
+ *
+ * The UVC 1.5 class specification defines the first five bits in the
+ * bmHint bitfield. The remaining bits are reserved and should be zero.
+ * Therefore a valid bmHint will be less than 32.
+ *
+ * Latest Elgato Cam Link 4K firmware as of 2021-03-23 needs this fix.
+ * MCU: 20.02.19, FPGA: 67
+ */
+ if (usb_match_one_id(stream->dev->intf, &elgato_cam_link_4k) &&
+ ctrl->bmHint > 255) {
+ u8 corrected_format_index = ctrl->bmHint >> 8;
+
+ uvc_dbg(stream->dev, VIDEO,
+ "Correct USB video probe response from {bmHint: 0x%04x, bFormatIndex: %u} to {bmHint: 0x%04x, bFormatIndex: %u}\n",
+ ctrl->bmHint, ctrl->bFormatIndex,
+ 1, corrected_format_index);
+ ctrl->bmHint = 1;
+ ctrl->bFormatIndex = corrected_format_index;
+ }
+
for (i = 0; i < stream->nformats; ++i) {
if (stream->format[i].index == ctrl->bFormatIndex) {
format = &stream->format[i];
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 254/266] s390/vdso: always enable vdso
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 253/266] media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 255/266] s390/vdso64: add sigreturn,rt_sigreturn and restart_syscall Greg Kroah-Hartman
` (15 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Heiko Carstens, Vasily Gorbik
From: Sven Schnelle <svens@linux.ibm.com>
commit d57778feb9878aa6b79c615fd029c2112d40a747 upstream.
With the upcoming move of the svc sigreturn instruction from
the signal frame to vdso we need to have vdso always enabled.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/elf.h | 11 ++++-------
arch/s390/kernel/vdso.c | 21 ++++-----------------
2 files changed, 8 insertions(+), 24 deletions(-)
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -146,8 +146,6 @@ typedef s390_compat_regs compat_elf_greg
#include <asm/vdso.h>
-extern unsigned int vdso_enabled;
-
/*
* This is used to ensure we don't load something for the wrong architecture.
*/
@@ -268,11 +266,10 @@ do { \
#define STACK_RND_MASK MMAP_RND_MASK
/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
-#define ARCH_DLINFO \
-do { \
- if (vdso_enabled) \
- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
- (unsigned long)current->mm->context.vdso_base); \
+#define ARCH_DLINFO \
+do { \
+ NEW_AUX_ENT(AT_SYSINFO_EHDR, \
+ (unsigned long)current->mm->context.vdso_base); \
} while (0)
struct linux_binprm;
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -37,18 +37,6 @@ enum vvar_pages {
VVAR_NR_PAGES,
};
-unsigned int __read_mostly vdso_enabled = 1;
-
-static int __init vdso_setup(char *str)
-{
- bool enabled;
-
- if (!kstrtobool(str, &enabled))
- vdso_enabled = enabled;
- return 1;
-}
-__setup("vdso=", vdso_setup);
-
#ifdef CONFIG_TIME_NS
struct vdso_data *arch_get_vdso_data(void *vvar_page)
{
@@ -176,7 +164,7 @@ int arch_setup_additional_pages(struct l
int rc;
BUILD_BUG_ON(VVAR_NR_PAGES != __VVAR_PAGES);
- if (!vdso_enabled || is_compat_task())
+ if (is_compat_task())
return 0;
if (mmap_write_lock_killable(mm))
return -EINTR;
@@ -218,10 +206,9 @@ static int __init vdso_init(void)
vdso_pages = (vdso64_end - vdso64_start) >> PAGE_SHIFT;
pages = kcalloc(vdso_pages + 1, sizeof(struct page *), GFP_KERNEL);
- if (!pages) {
- vdso_enabled = 0;
- return -ENOMEM;
- }
+ if (!pages)
+ panic("failed to allocate VDSO pages");
+
for (i = 0; i < vdso_pages; i++)
pages[i] = virt_to_page(vdso64_start + i * PAGE_SIZE);
pages[vdso_pages] = NULL;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 255/266] s390/vdso64: add sigreturn,rt_sigreturn and restart_syscall
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 254/266] s390/vdso: always enable vdso Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 256/266] s390/vdso: rename VDSO64_LBASE to VDSO_LBASE Greg Kroah-Hartman
` (14 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Heiko Carstens, Vasily Gorbik
From: Sven Schnelle <svens@linux.ibm.com>
commit 686341f2548b5a4c4ab1ee22427e046027ae1c9c upstream.
Add minimalistic trampolines to vdso64 so we can return from signal
without using the stack which requires pgm check handler hacks when
NX is enabled.
restart_syscall will be called from vdso to work around the architectural
limitation that the syscall number might be encoded in the svc instruction,
and therefore can not be changed.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/vdso64/vdso64.lds.S | 3 +++
arch/s390/kernel/vdso64/vdso_user_wrapper.S | 17 +++++++++++++++++
2 files changed, 20 insertions(+)
--- a/arch/s390/kernel/vdso64/vdso64.lds.S
+++ b/arch/s390/kernel/vdso64/vdso64.lds.S
@@ -137,6 +137,9 @@ VERSION
__kernel_clock_gettime;
__kernel_clock_getres;
__kernel_getcpu;
+ __kernel_restart_syscall;
+ __kernel_rt_sigreturn;
+ __kernel_sigreturn;
local: *;
};
}
--- a/arch/s390/kernel/vdso64/vdso_user_wrapper.S
+++ b/arch/s390/kernel/vdso64/vdso_user_wrapper.S
@@ -37,3 +37,20 @@ vdso_func gettimeofday
vdso_func clock_getres
vdso_func clock_gettime
vdso_func getcpu
+
+.macro vdso_syscall func,syscall
+ .globl __kernel_\func
+ .type __kernel_\func,@function
+ .align 8
+__kernel_\func:
+ CFI_STARTPROC
+ svc \syscall
+ /* Make sure we notice when a syscall returns, which shouldn't happen */
+ .word 0
+ CFI_ENDPROC
+ .size __kernel_\func,.-__kernel_\func
+.endm
+
+vdso_syscall restart_syscall,__NR_restart_syscall
+vdso_syscall sigreturn,__NR_sigreturn
+vdso_syscall rt_sigreturn,__NR_rt_sigreturn
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 256/266] s390/vdso: rename VDSO64_LBASE to VDSO_LBASE
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 255/266] s390/vdso64: add sigreturn,rt_sigreturn and restart_syscall Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 257/266] s390/vdso: add minimal compat vdso Greg Kroah-Hartman
` (13 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Heiko Carstens, Vasily Gorbik
From: Sven Schnelle <svens@linux.ibm.com>
commit 43e1f76b0b69b86b2175ef755243e61fe40c75db upstream.
Will be used by both vdso32 and vdso64, so change the name.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/vdso.h | 2 +-
arch/s390/kernel/vdso64/vdso64.lds.S | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/arch/s390/include/asm/vdso.h
+++ b/arch/s390/include/asm/vdso.h
@@ -5,7 +5,7 @@
#include <vdso/datapage.h>
/* Default link address for the vDSO */
-#define VDSO64_LBASE 0
+#define VDSO_LBASE 0
#define __VVAR_PAGES 2
--- a/arch/s390/kernel/vdso64/vdso64.lds.S
+++ b/arch/s390/kernel/vdso64/vdso64.lds.S
@@ -17,7 +17,7 @@ SECTIONS
#ifdef CONFIG_TIME_NS
PROVIDE(_timens_data = _vdso_data + PAGE_SIZE);
#endif
- . = VDSO64_LBASE + SIZEOF_HEADERS;
+ . = VDSO_LBASE + SIZEOF_HEADERS;
.hash : { *(.hash) } :text
.gnu.hash : { *(.gnu.hash) }
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 257/266] s390/vdso: add minimal compat vdso
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 256/266] s390/vdso: rename VDSO64_LBASE to VDSO_LBASE Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 258/266] s390/signal: switch to using vdso for sigreturn and syscall restart Greg Kroah-Hartman
` (12 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Heiko Carstens, Vasily Gorbik
From: Sven Schnelle <svens@linux.ibm.com>
commit 779df2248739b6308c03b354c99e4c352141e3bc upstream.
Add a small vdso for 31 bit compat application that provides
trampolines for calls to sigreturn,rt_sigreturn,syscall_restart.
This is requird for moving these syscalls away from the signal
frame to the vdso. Note that this patch effectively disables
CONFIG_COMPAT when using clang to compile the kernel. clang
doesn't support 31 bit mode.
We want to redirect sigreturn and restart_syscall to the vdso. However,
the kernel cannot parse the ELF vdso file, so we need to generate header
files which contain the offsets of the syscall instructions in the vdso
page.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/Kconfig | 1
arch/s390/Makefile | 13 ++
arch/s390/include/asm/elf.h | 2
arch/s390/include/asm/vdso.h | 27 +++--
arch/s390/include/asm/vdso/gettimeofday.h | 1
arch/s390/kernel/Makefile | 1
arch/s390/kernel/vdso.c | 50 ++++++---
arch/s390/kernel/vdso32/.gitignore | 2
arch/s390/kernel/vdso32/Makefile | 75 ++++++++++++++
arch/s390/kernel/vdso32/gen_vdso_offsets.sh | 15 ++
arch/s390/kernel/vdso32/note.S | 13 ++
arch/s390/kernel/vdso32/vdso32.lds.S | 141 ++++++++++++++++++++++++++++
arch/s390/kernel/vdso32/vdso32_wrapper.S | 15 ++
arch/s390/kernel/vdso32/vdso_user_wrapper.S | 21 ++++
arch/s390/kernel/vdso64/Makefile | 8 +
arch/s390/kernel/vdso64/gen_vdso_offsets.sh | 15 ++
16 files changed, 373 insertions(+), 27 deletions(-)
create mode 100644 arch/s390/kernel/vdso32/.gitignore
create mode 100644 arch/s390/kernel/vdso32/Makefile
create mode 100755 arch/s390/kernel/vdso32/gen_vdso_offsets.sh
create mode 100644 arch/s390/kernel/vdso32/note.S
create mode 100644 arch/s390/kernel/vdso32/vdso32.lds.S
create mode 100644 arch/s390/kernel/vdso32/vdso32_wrapper.S
create mode 100644 arch/s390/kernel/vdso32/vdso_user_wrapper.S
create mode 100755 arch/s390/kernel/vdso64/gen_vdso_offsets.sh
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -438,6 +438,7 @@ config COMPAT
select COMPAT_OLD_SIGACTION
select HAVE_UID16
depends on MULTIUSER
+ depends on !CC_IS_CLANG
help
Select this option if you want to enable your system kernel to
handle system-calls from ELF binaries for 31 bit ESA. This option
--- a/arch/s390/Makefile
+++ b/arch/s390/Makefile
@@ -165,6 +165,19 @@ archheaders:
archprepare:
$(Q)$(MAKE) $(build)=$(syscalls) kapi
$(Q)$(MAKE) $(build)=$(tools) kapi
+ifeq ($(KBUILD_EXTMOD),)
+# We need to generate vdso-offsets.h before compiling certain files in kernel/.
+# In order to do that, we should use the archprepare target, but we can't since
+# asm-offsets.h is included in some files used to generate vdso-offsets.h, and
+# asm-offsets.h is built in prepare0, for which archprepare is a dependency.
+# Therefore we need to generate the header after prepare0 has been made, hence
+# this hack.
+prepare: vdso_prepare
+vdso_prepare: prepare0
+ $(Q)$(MAKE) $(build)=arch/s390/kernel/vdso64 include/generated/vdso64-offsets.h
+ $(if $(CONFIG_COMPAT),$(Q)$(MAKE) \
+ $(build)=arch/s390/kernel/vdso32 include/generated/vdso32-offsets.h)
+endif
# Don't use tabs in echo arguments
define archhelp
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -144,8 +144,6 @@ typedef s390_compat_regs compat_elf_greg
#include <linux/sched/mm.h> /* for task_struct */
#include <asm/mmu_context.h>
-#include <asm/vdso.h>
-
/*
* This is used to ensure we don't load something for the wrong architecture.
*/
--- a/arch/s390/include/asm/vdso.h
+++ b/arch/s390/include/asm/vdso.h
@@ -4,18 +4,31 @@
#include <vdso/datapage.h>
-/* Default link address for the vDSO */
-#define VDSO_LBASE 0
-
-#define __VVAR_PAGES 2
-
-#define VDSO_VERSION_STRING LINUX_2.6.29
-
#ifndef __ASSEMBLY__
+#include <generated/vdso64-offsets.h>
+#ifdef CONFIG_COMPAT
+#include <generated/vdso32-offsets.h>
+#endif
+
+#define VDSO64_SYMBOL(tsk, name) ((tsk)->mm->context.vdso_base + (vdso64_offset_##name))
+#ifdef CONFIG_COMPAT
+#define VDSO32_SYMBOL(tsk, name) ((tsk)->mm->context.vdso_base + (vdso32_offset_##name))
+#else
+#define VDSO32_SYMBOL(tsk, name) (-1UL)
+#endif
+
extern struct vdso_data *vdso_data;
int vdso_getcpu_init(void);
#endif /* __ASSEMBLY__ */
+
+/* Default link address for the vDSO */
+#define VDSO_LBASE 0
+
+#define __VVAR_PAGES 2
+
+#define VDSO_VERSION_STRING LINUX_2.6.29
+
#endif /* __S390_VDSO_H__ */
--- a/arch/s390/include/asm/vdso/gettimeofday.h
+++ b/arch/s390/include/asm/vdso/gettimeofday.h
@@ -8,7 +8,6 @@
#include <asm/timex.h>
#include <asm/unistd.h>
-#include <asm/vdso.h>
#include <linux/compiler.h>
#define vdso_calc_delta __arch_vdso_calc_delta
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -78,3 +78,4 @@ obj-$(findstring y, $(CONFIG_PROTECTED_V
# vdso
obj-y += vdso64/
+obj-$(CONFIG_COMPAT) += vdso32/
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -20,7 +20,7 @@
#include <asm/vdso.h>
extern char vdso64_start[], vdso64_end[];
-static unsigned int vdso_pages;
+extern char vdso32_start[], vdso32_end[];
static struct vm_special_mapping vvar_mapping;
@@ -143,7 +143,12 @@ static struct vm_special_mapping vvar_ma
.fault = vvar_fault,
};
-static struct vm_special_mapping vdso_mapping = {
+static struct vm_special_mapping vdso64_mapping = {
+ .name = "[vdso]",
+ .mremap = vdso_mremap,
+};
+
+static struct vm_special_mapping vdso32_mapping = {
.name = "[vdso]",
.mremap = vdso_mremap,
};
@@ -159,16 +164,22 @@ int arch_setup_additional_pages(struct l
{
unsigned long vdso_text_len, vdso_mapping_len;
unsigned long vvar_start, vdso_text_start;
+ struct vm_special_mapping *vdso_mapping;
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
int rc;
BUILD_BUG_ON(VVAR_NR_PAGES != __VVAR_PAGES);
- if (is_compat_task())
- return 0;
if (mmap_write_lock_killable(mm))
return -EINTR;
- vdso_text_len = vdso_pages << PAGE_SHIFT;
+
+ if (is_compat_task()) {
+ vdso_text_len = vdso32_end - vdso32_start;
+ vdso_mapping = &vdso32_mapping;
+ } else {
+ vdso_text_len = vdso64_end - vdso64_start;
+ vdso_mapping = &vdso64_mapping;
+ }
vdso_mapping_len = vdso_text_len + VVAR_NR_PAGES * PAGE_SIZE;
vvar_start = get_unmapped_area(NULL, 0, vdso_mapping_len, 0, 0);
rc = vvar_start;
@@ -186,7 +197,7 @@ int arch_setup_additional_pages(struct l
vma = _install_special_mapping(mm, vdso_text_start, vdso_text_len,
VM_READ|VM_EXEC|
VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
- &vdso_mapping);
+ vdso_mapping);
if (IS_ERR(vma)) {
do_munmap(mm, vvar_start, PAGE_SIZE, NULL);
rc = PTR_ERR(vma);
@@ -199,20 +210,25 @@ out:
return rc;
}
-static int __init vdso_init(void)
+static struct page ** __init vdso_setup_pages(void *start, void *end)
{
- struct page **pages;
+ int pages = (end - start) >> PAGE_SHIFT;
+ struct page **pagelist;
int i;
- vdso_pages = (vdso64_end - vdso64_start) >> PAGE_SHIFT;
- pages = kcalloc(vdso_pages + 1, sizeof(struct page *), GFP_KERNEL);
- if (!pages)
- panic("failed to allocate VDSO pages");
-
- for (i = 0; i < vdso_pages; i++)
- pages[i] = virt_to_page(vdso64_start + i * PAGE_SIZE);
- pages[vdso_pages] = NULL;
- vdso_mapping.pages = pages;
+ pagelist = kcalloc(pages + 1, sizeof(struct page *), GFP_KERNEL);
+ if (!pagelist)
+ panic("%s: Cannot allocate page list for VDSO", __func__);
+ for (i = 0; i < pages; i++)
+ pagelist[i] = virt_to_page(start + i * PAGE_SIZE);
+ return pagelist;
+}
+
+static int __init vdso_init(void)
+{
+ vdso64_mapping.pages = vdso_setup_pages(vdso64_start, vdso64_end);
+ if (IS_ENABLED(CONFIG_COMPAT))
+ vdso32_mapping.pages = vdso_setup_pages(vdso32_start, vdso32_end);
return 0;
}
arch_initcall(vdso_init);
--- /dev/null
+++ b/arch/s390/kernel/vdso32/.gitignore
@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: GPL-2.0-only
+vdso32.lds
--- /dev/null
+++ b/arch/s390/kernel/vdso32/Makefile
@@ -0,0 +1,75 @@
+# SPDX-License-Identifier: GPL-2.0
+# List of files in the vdso
+
+KCOV_INSTRUMENT := n
+ARCH_REL_TYPE_ABS := R_390_COPY|R_390_GLOB_DAT|R_390_JMP_SLOT|R_390_RELATIVE
+ARCH_REL_TYPE_ABS += R_390_GOT|R_390_PLT
+
+include $(srctree)/lib/vdso/Makefile
+obj-vdso32 = vdso_user_wrapper-32.o note-32.o
+
+# Build rules
+
+targets := $(obj-vdso32) vdso32.so vdso32.so.dbg
+obj-vdso32 := $(addprefix $(obj)/, $(obj-vdso32))
+
+KBUILD_AFLAGS += -DBUILD_VDSO
+KBUILD_CFLAGS += -DBUILD_VDSO -DDISABLE_BRANCH_PROFILING
+
+KBUILD_AFLAGS_32 := $(filter-out -m64,$(KBUILD_AFLAGS))
+KBUILD_AFLAGS_32 += -m31 -s
+
+KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS))
+KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin
+
+LDFLAGS_vdso32.so.dbg += -fPIC -shared -nostdlib -soname=linux-vdso32.so.1 \
+ --hash-style=both --build-id=sha1 -melf_s390 -T
+
+$(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
+$(targets:%=$(obj)/%.dbg): KBUILD_AFLAGS = $(KBUILD_AFLAGS_32)
+
+obj-y += vdso32_wrapper.o
+CPPFLAGS_vdso32.lds += -P -C -U$(ARCH)
+
+# Disable gcov profiling, ubsan and kasan for VDSO code
+GCOV_PROFILE := n
+UBSAN_SANITIZE := n
+KASAN_SANITIZE := n
+
+# Force dependency (incbin is bad)
+$(obj)/vdso32_wrapper.o : $(obj)/vdso32.so
+
+$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE
+ $(call if_changed,ld)
+
+# strip rule for the .so file
+$(obj)/%.so: OBJCOPYFLAGS := -S
+$(obj)/%.so: $(obj)/%.so.dbg FORCE
+ $(call if_changed,objcopy)
+
+$(obj-vdso32): %-32.o: %.S FORCE
+ $(call if_changed_dep,vdso32as)
+
+# actual build commands
+quiet_cmd_vdso32as = VDSO32A $@
+ cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $<
+quiet_cmd_vdso32cc = VDSO32C $@
+ cmd_vdso32cc = $(CC) $(c_flags) -c -o $@ $<
+
+# install commands for the unstripped file
+quiet_cmd_vdso_install = INSTALL $@
+ cmd_vdso_install = cp $(obj)/$@.dbg $(MODLIB)/vdso/$@
+
+vdso32.so: $(obj)/vdso32.so.dbg
+ @mkdir -p $(MODLIB)/vdso
+ $(call cmd,vdso_install)
+
+vdso_install: vdso32.so
+
+# Generate VDSO offsets using helper script
+gen-vdsosym := $(srctree)/$(src)/gen_vdso_offsets.sh
+quiet_cmd_vdsosym = VDSOSYM $@
+ cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@
+
+include/generated/vdso32-offsets.h: $(obj)/vdso32.so.dbg FORCE
+ $(call if_changed,vdsosym)
--- /dev/null
+++ b/arch/s390/kernel/vdso32/gen_vdso_offsets.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+
+#
+# Match symbols in the DSO that look like VDSO_*; produce a header file
+# of constant offsets into the shared object.
+#
+# Doing this inside the Makefile will break the $(filter-out) function,
+# causing Kbuild to rebuild the vdso-offsets header file every time.
+#
+# Inspired by arm64 version.
+#
+
+LC_ALL=C
+sed -n 's/\([0-9a-f]*\) . __kernel_compat_\(.*\)/\#define vdso32_offset_\2\t0x\1/p'
--- /dev/null
+++ b/arch/s390/kernel/vdso32/note.S
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * This supplies .note.* sections to go into the PT_NOTE inside the vDSO text.
+ * Here we can supply some information useful to userland.
+ */
+
+#include <linux/uts.h>
+#include <linux/version.h>
+#include <linux/elfnote.h>
+
+ELFNOTE_START(Linux, 0, "a")
+ .long LINUX_VERSION_CODE
+ELFNOTE_END
--- /dev/null
+++ b/arch/s390/kernel/vdso32/vdso32.lds.S
@@ -0,0 +1,141 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * This is the infamous ld script for the 64 bits vdso
+ * library
+ */
+
+#include <asm/page.h>
+#include <asm/vdso.h>
+
+OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390")
+OUTPUT_ARCH(s390:31-bit)
+ENTRY(_start)
+
+SECTIONS
+{
+ PROVIDE(_vdso_data = . - __VVAR_PAGES * PAGE_SIZE);
+#ifdef CONFIG_TIME_NS
+ PROVIDE(_timens_data = _vdso_data + PAGE_SIZE);
+#endif
+ . = VDSO_LBASE + SIZEOF_HEADERS;
+
+ .hash : { *(.hash) } :text
+ .gnu.hash : { *(.gnu.hash) }
+ .dynsym : { *(.dynsym) }
+ .dynstr : { *(.dynstr) }
+ .gnu.version : { *(.gnu.version) }
+ .gnu.version_d : { *(.gnu.version_d) }
+ .gnu.version_r : { *(.gnu.version_r) }
+
+ .note : { *(.note.*) } :text :note
+
+ . = ALIGN(16);
+ .text : {
+ *(.text .stub .text.* .gnu.linkonce.t.*)
+ } :text
+ PROVIDE(__etext = .);
+ PROVIDE(_etext = .);
+ PROVIDE(etext = .);
+
+ /*
+ * Other stuff is appended to the text segment:
+ */
+ .rodata : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
+ .rodata1 : { *(.rodata1) }
+
+ .dynamic : { *(.dynamic) } :text :dynamic
+
+ .eh_frame_hdr : { *(.eh_frame_hdr) } :text :eh_frame_hdr
+ .eh_frame : { KEEP (*(.eh_frame)) } :text
+ .gcc_except_table : { *(.gcc_except_table .gcc_except_table.*) }
+
+ .rela.dyn ALIGN(8) : { *(.rela.dyn) }
+ .got ALIGN(8) : { *(.got .toc) }
+
+ _end = .;
+ PROVIDE(end = .);
+
+ /*
+ * Stabs debugging sections are here too.
+ */
+ .stab 0 : { *(.stab) }
+ .stabstr 0 : { *(.stabstr) }
+ .stab.excl 0 : { *(.stab.excl) }
+ .stab.exclstr 0 : { *(.stab.exclstr) }
+ .stab.index 0 : { *(.stab.index) }
+ .stab.indexstr 0 : { *(.stab.indexstr) }
+ .comment 0 : { *(.comment) }
+
+ /*
+ * DWARF debug sections.
+ * Symbols in the DWARF debugging sections are relative to the
+ * beginning of the section so we begin them at 0.
+ */
+ /* DWARF 1 */
+ .debug 0 : { *(.debug) }
+ .line 0 : { *(.line) }
+ /* GNU DWARF 1 extensions */
+ .debug_srcinfo 0 : { *(.debug_srcinfo) }
+ .debug_sfnames 0 : { *(.debug_sfnames) }
+ /* DWARF 1.1 and DWARF 2 */
+ .debug_aranges 0 : { *(.debug_aranges) }
+ .debug_pubnames 0 : { *(.debug_pubnames) }
+ /* DWARF 2 */
+ .debug_info 0 : { *(.debug_info .gnu.linkonce.wi.*) }
+ .debug_abbrev 0 : { *(.debug_abbrev) }
+ .debug_line 0 : { *(.debug_line) }
+ .debug_frame 0 : { *(.debug_frame) }
+ .debug_str 0 : { *(.debug_str) }
+ .debug_loc 0 : { *(.debug_loc) }
+ .debug_macinfo 0 : { *(.debug_macinfo) }
+ /* SGI/MIPS DWARF 2 extensions */
+ .debug_weaknames 0 : { *(.debug_weaknames) }
+ .debug_funcnames 0 : { *(.debug_funcnames) }
+ .debug_typenames 0 : { *(.debug_typenames) }
+ .debug_varnames 0 : { *(.debug_varnames) }
+ /* DWARF 3 */
+ .debug_pubtypes 0 : { *(.debug_pubtypes) }
+ .debug_ranges 0 : { *(.debug_ranges) }
+ .gnu.attributes 0 : { KEEP (*(.gnu.attributes)) }
+
+ /DISCARD/ : {
+ *(.note.GNU-stack)
+ *(.branch_lt)
+ *(.data .data.* .gnu.linkonce.d.* .sdata*)
+ *(.bss .sbss .dynbss .dynsbss)
+ }
+}
+
+/*
+ * Very old versions of ld do not recognize this name token; use the constant.
+ */
+#define PT_GNU_EH_FRAME 0x6474e550
+
+/*
+ * We must supply the ELF program headers explicitly to get just one
+ * PT_LOAD segment, and set the flags explicitly to make segments read-only.
+ */
+PHDRS
+{
+ text PT_LOAD FILEHDR PHDRS FLAGS(5); /* PF_R|PF_X */
+ dynamic PT_DYNAMIC FLAGS(4); /* PF_R */
+ note PT_NOTE FLAGS(4); /* PF_R */
+ eh_frame_hdr PT_GNU_EH_FRAME;
+}
+
+/*
+ * This controls what symbols we export from the DSO.
+ */
+VERSION
+{
+ VDSO_VERSION_STRING {
+ global:
+ /*
+ * Has to be there for the kernel to find
+ */
+ __kernel_compat_restart_syscall;
+ __kernel_compat_rt_sigreturn;
+ __kernel_compat_sigreturn;
+ local: *;
+ };
+}
--- /dev/null
+++ b/arch/s390/kernel/vdso32/vdso32_wrapper.S
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#include <linux/init.h>
+#include <linux/linkage.h>
+#include <asm/page.h>
+
+ __PAGE_ALIGNED_DATA
+
+ .globl vdso32_start, vdso32_end
+ .balign PAGE_SIZE
+vdso32_start:
+ .incbin "arch/s390/kernel/vdso32/vdso32.so"
+ .balign PAGE_SIZE
+vdso32_end:
+
+ .previous
--- /dev/null
+++ b/arch/s390/kernel/vdso32/vdso_user_wrapper.S
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#include <asm/unistd.h>
+#include <asm/dwarf.h>
+
+.macro vdso_syscall func,syscall
+ .globl __kernel_compat_\func
+ .type __kernel_compat_\func,@function
+ .align 8
+__kernel_compat_\func:
+ CFI_STARTPROC
+ svc \syscall
+ /* Make sure we notice when a syscall returns, which shouldn't happen */
+ .word 0
+ CFI_ENDPROC
+ .size __kernel_compat_\func,.-__kernel_compat_\func
+.endm
+
+vdso_syscall restart_syscall,__NR_restart_syscall
+vdso_syscall sigreturn,__NR_sigreturn
+vdso_syscall rt_sigreturn,__NR_rt_sigreturn
--- a/arch/s390/kernel/vdso64/Makefile
+++ b/arch/s390/kernel/vdso64/Makefile
@@ -74,3 +74,11 @@ vdso64.so: $(obj)/vdso64.so.dbg
$(call cmd,vdso_install)
vdso_install: vdso64.so
+
+# Generate VDSO offsets using helper script
+gen-vdsosym := $(srctree)/$(src)/gen_vdso_offsets.sh
+quiet_cmd_vdsosym = VDSOSYM $@
+ cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@
+
+include/generated/vdso64-offsets.h: $(obj)/vdso64.so.dbg FORCE
+ $(call if_changed,vdsosym)
--- /dev/null
+++ b/arch/s390/kernel/vdso64/gen_vdso_offsets.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+
+#
+# Match symbols in the DSO that look like VDSO_*; produce a header file
+# of constant offsets into the shared object.
+#
+# Doing this inside the Makefile will break the $(filter-out) function,
+# causing Kbuild to rebuild the vdso-offsets header file every time.
+#
+# Inspired by arm64 version.
+#
+
+LC_ALL=C
+sed -n 's/\([0-9a-f]*\) . __kernel_\(.*\)/\#define vdso64_offset_\2\t0x\1/p'
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 258/266] s390/signal: switch to using vdso for sigreturn and syscall restart
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 257/266] s390/vdso: add minimal compat vdso Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 259/266] dm writecache: write at least 4k when committing Greg Kroah-Hartman
` (11 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Heiko Carstens,
Vasily Gorbik, stable
From: Sven Schnelle <svens@linux.ibm.com>
commit df29a7440c4b5c65765c8f60396b3b13063e24e9 upstream.
with generic entry, there's a bug when it comes to restarting of signals.
The failing sequence is:
a) a signal is coming in, and no handler is registered, so the lower
part of arch_do_signal_or_restart() in arch/s390/kernel/signal.c
sets PIF_SYSCALL_RESTART.
b) a second signal gets pending while the kernel is still in the exit
loop, and for that one, a handler exists.
c) The first part of arch_do_signal_or_restart() is called. That part
calls handle_signal(), which sets up stack + registers for handling
the signal.
d) __do_syscall() in arch/s390/kernel/syscall.c checks for
PIF_SYSCALL_RESTART right before leaving to userspace. If it is set,
it restart's the syscall. However, the registers are already setup
for handling a signal from c). The syscall is now restarted with the
wrong arguments.
Change the code to:
- use vdso for syscall_restart() instead of PIF_SYSCALL_RESTART because
we cannot rewind and go back to userspace on s390 because the system call
number might be encoded in the svc instruction.
- for all other syscalls we rewind the PSW and return to userspace.
Cc: <stable@kernel.org> # v5.12+ d57778feb987: s390/vdso: always enable vdso
Cc: <stable@kernel.org> # v5.12+ 686341f2548b: s390/vdso64: add sigreturn,rt_sigreturn and restart_syscall
Cc: <stable@kernel.org> # v5.12+ 43e1f76b0b69: s390/vdso: rename VDSO64_LBASE to VDSO_LBASE
Cc: <stable@kernel.org> # v5.12+ 779df2248739: s390/vdso: add minimal compat vdso
Cc: <stable@kernel.org> # v5.12+
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/compat_signal.c | 13 +++----------
arch/s390/kernel/process.c | 6 ++++++
arch/s390/kernel/signal.c | 39 ++++++++++++++++++---------------------
arch/s390/kernel/syscall.c | 4 ++++
4 files changed, 31 insertions(+), 31 deletions(-)
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -28,6 +28,7 @@
#include <linux/uaccess.h>
#include <asm/lowcore.h>
#include <asm/switch_to.h>
+#include <asm/vdso.h>
#include "compat_linux.h"
#include "compat_ptrace.h"
#include "entry.h"
@@ -118,7 +119,6 @@ static int restore_sigregs32(struct pt_r
fpregs_load((_s390_fp_regs *) &user_sregs.fpregs, ¤t->thread.fpu);
clear_pt_regs_flag(regs, PIF_SYSCALL); /* No longer in a system call */
- clear_pt_regs_flag(regs, PIF_SYSCALL_RESTART);
return 0;
}
@@ -304,11 +304,7 @@ static int setup_frame32(struct ksignal
restorer = (unsigned long __force)
ksig->ka.sa.sa_restorer | PSW32_ADDR_AMODE;
} else {
- /* Signal frames without vectors registers are short ! */
- __u16 __user *svc = (void __user *) frame + frame_size - 2;
- if (__put_user(S390_SYSCALL_OPCODE | __NR_sigreturn, svc))
- return -EFAULT;
- restorer = (unsigned long __force) svc | PSW32_ADDR_AMODE;
+ restorer = VDSO32_SYMBOL(current, sigreturn);
}
/* Set up registers for signal handler */
@@ -371,10 +367,7 @@ static int setup_rt_frame32(struct ksign
restorer = (unsigned long __force)
ksig->ka.sa.sa_restorer | PSW32_ADDR_AMODE;
} else {
- __u16 __user *svc = &frame->svc_insn;
- if (__put_user(S390_SYSCALL_OPCODE | __NR_rt_sigreturn, svc))
- return -EFAULT;
- restorer = (unsigned long __force) svc | PSW32_ADDR_AMODE;
+ restorer = VDSO32_SYMBOL(current, rt_sigreturn);
}
/* Create siginfo on the signal stack */
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -166,6 +166,12 @@ int copy_thread(unsigned long clone_flag
p->thread.acrs[1] = (unsigned int)tls;
}
}
+ /*
+ * s390 stores the svc return address in arch_data when calling
+ * sigreturn()/restart_syscall() via vdso. 1 means no valid address
+ * stored.
+ */
+ p->restart_block.arch_data = 1;
return 0;
}
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -32,6 +32,7 @@
#include <linux/uaccess.h>
#include <asm/lowcore.h>
#include <asm/switch_to.h>
+#include <asm/vdso.h>
#include "entry.h"
/*
@@ -171,7 +172,6 @@ static int restore_sigregs(struct pt_reg
fpregs_load(&user_sregs.fpregs, ¤t->thread.fpu);
clear_pt_regs_flag(regs, PIF_SYSCALL); /* No longer in a system call */
- clear_pt_regs_flag(regs, PIF_SYSCALL_RESTART);
return 0;
}
@@ -334,15 +334,10 @@ static int setup_frame(int sig, struct k
/* Set up to return from userspace. If provided, use a stub
already in userspace. */
- if (ka->sa.sa_flags & SA_RESTORER) {
+ if (ka->sa.sa_flags & SA_RESTORER)
restorer = (unsigned long) ka->sa.sa_restorer;
- } else {
- /* Signal frame without vector registers are short ! */
- __u16 __user *svc = (void __user *) frame + frame_size - 2;
- if (__put_user(S390_SYSCALL_OPCODE | __NR_sigreturn, svc))
- return -EFAULT;
- restorer = (unsigned long) svc;
- }
+ else
+ restorer = VDSO64_SYMBOL(current, sigreturn);
/* Set up registers for signal handler */
regs->gprs[14] = restorer;
@@ -397,14 +392,10 @@ static int setup_rt_frame(struct ksignal
/* Set up to return from userspace. If provided, use a stub
already in userspace. */
- if (ksig->ka.sa.sa_flags & SA_RESTORER) {
+ if (ksig->ka.sa.sa_flags & SA_RESTORER)
restorer = (unsigned long) ksig->ka.sa.sa_restorer;
- } else {
- __u16 __user *svc = &frame->svc_insn;
- if (__put_user(S390_SYSCALL_OPCODE | __NR_rt_sigreturn, svc))
- return -EFAULT;
- restorer = (unsigned long) svc;
- }
+ else
+ restorer = VDSO64_SYMBOL(current, rt_sigreturn);
/* Create siginfo on the signal stack */
if (copy_siginfo_to_user(&frame->info, &ksig->info))
@@ -501,7 +492,7 @@ void arch_do_signal_or_restart(struct pt
}
/* No longer in a system call */
clear_pt_regs_flag(regs, PIF_SYSCALL);
- clear_pt_regs_flag(regs, PIF_SYSCALL_RESTART);
+
rseq_signal_deliver(&ksig, regs);
if (is_compat_task())
handle_signal32(&ksig, oldset, regs);
@@ -517,14 +508,20 @@ void arch_do_signal_or_restart(struct pt
switch (regs->gprs[2]) {
case -ERESTART_RESTARTBLOCK:
/* Restart with sys_restart_syscall */
- regs->int_code = __NR_restart_syscall;
- fallthrough;
+ regs->gprs[2] = regs->orig_gpr2;
+ current->restart_block.arch_data = regs->psw.addr;
+ if (is_compat_task())
+ regs->psw.addr = VDSO32_SYMBOL(current, restart_syscall);
+ else
+ regs->psw.addr = VDSO64_SYMBOL(current, restart_syscall);
+ if (test_thread_flag(TIF_SINGLE_STEP))
+ clear_thread_flag(TIF_PER_TRAP);
+ break;
case -ERESTARTNOHAND:
case -ERESTARTSYS:
case -ERESTARTNOINTR:
- /* Restart system call with magic TIF bit. */
regs->gprs[2] = regs->orig_gpr2;
- set_pt_regs_flag(regs, PIF_SYSCALL_RESTART);
+ regs->psw.addr = __rewind_psw(regs->psw, regs->int_code >> 16);
if (test_thread_flag(TIF_SINGLE_STEP))
clear_thread_flag(TIF_PER_TRAP);
break;
--- a/arch/s390/kernel/syscall.c
+++ b/arch/s390/kernel/syscall.c
@@ -121,6 +121,10 @@ void do_syscall(struct pt_regs *regs)
regs->gprs[2] = nr;
+ if (nr == __NR_restart_syscall && !(current->restart_block.arch_data & 1)) {
+ regs->psw.addr = current->restart_block.arch_data;
+ current->restart_block.arch_data = 1;
+ }
nr = syscall_enter_from_user_mode_work(regs, nr);
/*
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 259/266] dm writecache: write at least 4k when committing
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 258/266] s390/signal: switch to using vdso for sigreturn and syscall restart Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 260/266] pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() Greg Kroah-Hartman
` (10 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer
From: Mikulas Patocka <mpatocka@redhat.com>
commit 867de40c4c23e6d7f89f9ce4272a5d1b1484c122 upstream.
SSDs perform badly with sub-4k writes (because they perfrorm
read-modify-write internally), so make sure writecache writes at least
4k when committing.
Fixes: 991bd8d7bc78 ("dm writecache: commit just one block, not a full page")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-writecache.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-writecache.c
+++ b/drivers/md/dm-writecache.c
@@ -532,7 +532,11 @@ static void ssd_commit_superblock(struct
region.bdev = wc->ssd_dev->bdev;
region.sector = 0;
- region.count = wc->block_size >> SECTOR_SHIFT;
+ region.count = max(4096U, wc->block_size) >> SECTOR_SHIFT;
+
+ if (unlikely(region.sector + region.count > wc->metadata_sectors))
+ region.count = wc->metadata_sectors - region.sector;
+
region.sector += wc->start_sector;
req.bi_op = REQ_OP_WRITE;
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 260/266] pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 259/266] dm writecache: write at least 4k when committing Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 261/266] drm/ast: Remove reference to struct drm_device.pdev Greg Kroah-Hartman
` (9 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zou Wei, Linus Walleij
From: Zou Wei <zou_wei@huawei.com>
commit 884af72c90016cfccd5717439c86b48702cbf184 upstream.
Add the missing unlock before return from function mcp23s08_irq()
in the error handling case.
v1-->v2:
remove the "return IRQ_HANDLED" line
Fixes: 897120d41e7a ("pinctrl: mcp23s08: fix race condition in irq handler")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Link: https://lore.kernel.org/r/1623134048-56051-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/pinctrl-mcp23s08.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -353,7 +353,7 @@ static irqreturn_t mcp23s08_irq(int irq,
if (intf == 0) {
/* There is no interrupt pending */
- return IRQ_HANDLED;
+ goto unlock;
}
if (mcp_read(mcp, MCP_INTCAP, &intcap))
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 261/266] drm/ast: Remove reference to struct drm_device.pdev
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 260/266] pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 262/266] ext4: fix possible UAF when remounting r/o a mmp-protected file system Greg Kroah-Hartman
` (8 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Zimmermann, Michael J. Ruhl,
KuoHsiang Chou, kernel test robot, Dave Airlie, dri-devel
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 0ecb51824e838372e01330752503ddf9c0430ef7 upstream.
Using struct drm_device.pdev is deprecated. Upcast with to_pci_dev()
from struct drm_device.dev to get the PCI device structure.
v9:
* fix remaining pdev references
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Fixes: ba4e0339a6a3 ("drm/ast: Fixed CVE for DP501")
Cc: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
Cc: kernel test robot <lkp@intel.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Dave Airlie <airlied@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Link: https://patchwork.freedesktop.org/patch/msgid/20210429105101.25667-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ast/ast_main.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -411,7 +411,6 @@ struct ast_private *ast_device_create(co
return ast;
dev = &ast->base;
- dev->pdev = pdev;
pci_set_drvdata(pdev, dev);
ast->regs = pcim_iomap(pdev, 1, 0);
@@ -453,8 +452,8 @@ struct ast_private *ast_device_create(co
/* map reserved buffer */
ast->dp501_fw_buf = NULL;
- if (dev->vram_mm->vram_size < pci_resource_len(dev->pdev, 0)) {
- ast->dp501_fw_buf = pci_iomap_range(dev->pdev, 0, dev->vram_mm->vram_size, 0);
+ if (dev->vram_mm->vram_size < pci_resource_len(pdev, 0)) {
+ ast->dp501_fw_buf = pci_iomap_range(pdev, 0, dev->vram_mm->vram_size, 0);
if (!ast->dp501_fw_buf)
drm_info(dev, "failed to map reserved buffer!\n");
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 262/266] ext4: fix possible UAF when remounting r/o a mmp-protected file system
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 261/266] drm/ast: Remove reference to struct drm_device.pdev Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 263/266] jfs: fix GPF in diFree Greg Kroah-Hartman
` (7 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ye Bin, Theodore Tso, Jan Kara
From: Theodore Ts'o <tytso@mit.edu>
commit 61bb4a1c417e5b95d9edb4f887f131de32e419cb upstream.
After commit 618f003199c6 ("ext4: fix memory leak in
ext4_fill_super"), after the file system is remounted read-only, there
is a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to
point at freed memory, which the call to ext4_stop_mmpd() can trip
over.
Fix this by only allowing kmmpd() to exit when it is stopped via
ext4_stop_mmpd().
Link: https://lore.kernel.org/r/20210707002433.3719773-1-tytso@mit.edu
Reported-by: Ye Bin <yebin10@huawei.com>
Bug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mmp.c | 31 +++++++++++++++----------------
fs/ext4/super.c | 6 +++++-
2 files changed, 20 insertions(+), 17 deletions(-)
--- a/fs/ext4/mmp.c
+++ b/fs/ext4/mmp.c
@@ -156,7 +156,12 @@ static int kmmpd(void *data)
memcpy(mmp->mmp_nodename, init_utsname()->nodename,
sizeof(mmp->mmp_nodename));
- while (!kthread_should_stop()) {
+ while (!kthread_should_stop() && !sb_rdonly(sb)) {
+ if (!ext4_has_feature_mmp(sb)) {
+ ext4_warning(sb, "kmmpd being stopped since MMP feature"
+ " has been disabled.");
+ goto wait_to_exit;
+ }
if (++seq > EXT4_MMP_SEQ_MAX)
seq = 1;
@@ -177,16 +182,6 @@ static int kmmpd(void *data)
failed_writes++;
}
- if (!(le32_to_cpu(es->s_feature_incompat) &
- EXT4_FEATURE_INCOMPAT_MMP)) {
- ext4_warning(sb, "kmmpd being stopped since MMP feature"
- " has been disabled.");
- goto exit_thread;
- }
-
- if (sb_rdonly(sb))
- break;
-
diff = jiffies - last_update_time;
if (diff < mmp_update_interval * HZ)
schedule_timeout_interruptible(mmp_update_interval *
@@ -207,7 +202,7 @@ static int kmmpd(void *data)
ext4_error_err(sb, -retval,
"error reading MMP data: %d",
retval);
- goto exit_thread;
+ goto wait_to_exit;
}
mmp_check = (struct mmp_struct *)(bh_check->b_data);
@@ -221,7 +216,7 @@ static int kmmpd(void *data)
ext4_error_err(sb, EBUSY, "abort");
put_bh(bh_check);
retval = -EBUSY;
- goto exit_thread;
+ goto wait_to_exit;
}
put_bh(bh_check);
}
@@ -244,7 +239,13 @@ static int kmmpd(void *data)
retval = write_mmp_block(sb, bh);
-exit_thread:
+wait_to_exit:
+ while (!kthread_should_stop()) {
+ set_current_state(TASK_INTERRUPTIBLE);
+ if (!kthread_should_stop())
+ schedule();
+ }
+ set_current_state(TASK_RUNNING);
return retval;
}
@@ -391,5 +392,3 @@ failed:
brelse(bh);
return 1;
}
-
-
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5996,7 +5996,6 @@ static int ext4_remount(struct super_blo
*/
ext4_mark_recovery_complete(sb, es);
}
- ext4_stop_mmpd(sbi);
} else {
/* Make sure we can mount this feature set readwrite */
if (ext4_has_feature_readonly(sb) ||
@@ -6110,6 +6109,9 @@ static int ext4_remount(struct super_blo
if (!test_opt(sb, BLOCK_VALIDITY) && sbi->s_system_blks)
ext4_release_system_zone(sb);
+ if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
+ ext4_stop_mmpd(sbi);
+
/*
* Some options can be enabled by ext4 and/or by VFS mount flag
* either way we need to make sure it matches in both *flags and
@@ -6143,6 +6145,8 @@ restore_opts:
for (i = 0; i < EXT4_MAXQUOTAS; i++)
kfree(to_free[i]);
#endif
+ if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
+ ext4_stop_mmpd(sbi);
kfree(orig_data);
return err;
}
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 263/266] jfs: fix GPF in diFree
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 262/266] ext4: fix possible UAF when remounting r/o a mmp-protected file system Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 264/266] media: v4l2-core: explicitly clear ioctl input data Greg Kroah-Hartman
` (6 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Dave Kleikamp,
syzbot+0a89a7b56db04c21a656
From: Pavel Skripkin <paskripkin@gmail.com>
commit 9d574f985fe33efd6911f4d752de6f485a1ea732 upstream.
Avoid passing inode with
JFS_SBI(inode->i_sb)->ipimap == NULL to
diFree()[1]. GFP will appear:
struct inode *ipimap = JFS_SBI(ip->i_sb)->ipimap;
struct inomap *imap = JFS_IP(ipimap)->i_imap;
JFS_IP() will return invalid pointer when ipimap == NULL
Call Trace:
diFree+0x13d/0x2dc0 fs/jfs/jfs_imap.c:853 [1]
jfs_evict_inode+0x2c9/0x370 fs/jfs/inode.c:154
evict+0x2ed/0x750 fs/inode.c:578
iput_final fs/inode.c:1654 [inline]
iput.part.0+0x3fe/0x820 fs/inode.c:1680
iput+0x58/0x70 fs/inode.c:1670
Reported-and-tested-by: syzbot+0a89a7b56db04c21a656@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jfs/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -151,7 +151,8 @@ void jfs_evict_inode(struct inode *inode
if (test_cflag(COMMIT_Freewmap, inode))
jfs_free_zero_link(inode);
- diFree(inode);
+ if (JFS_SBI(inode->i_sb)->ipimap)
+ diFree(inode);
/*
* Free the inode from the quota allocation.
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 264/266] media: v4l2-core: explicitly clear ioctl input data
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 263/266] jfs: fix GPF in diFree Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 265/266] smackfs: restrict bytes count in smk_set_cipso() Greg Kroah-Hartman
` (5 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Laurent Pinchart,
Hans Verkuil, Mauro Carvalho Chehab
From: Arnd Bergmann <arnd@arndb.de>
commit 7b53cca764f9b291b7907fcd39d9e66ad728ee0b upstream.
As seen from a recent syzbot bug report, mistakes in the compat ioctl
implementation can lead to uninitialized kernel stack data getting used
as input for driver ioctl handlers.
The reported bug is now fixed, but it's possible that other related
bugs are still present or get added in the future. As the drivers need
to check user input already, the possible impact is fairly low, but it
might still cause an information leak.
To be on the safe side, always clear the entire ioctl buffer before
calling the conversion handler functions that are meant to initialize
them.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-ioctl.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -3124,8 +3124,10 @@ static int video_get_user(void __user *a
if (copy_from_user(parg, (void __user *)arg, n))
err = -EFAULT;
} else if (in_compat_syscall()) {
+ memset(parg, 0, n);
err = v4l2_compat_get_user(arg, parg, cmd);
} else {
+ memset(parg, 0, n);
#if !defined(CONFIG_64BIT) && defined(CONFIG_COMPAT_32BIT_TIME)
switch (cmd) {
case VIDIOC_QUERYBUF_TIME32:
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 265/266] smackfs: restrict bytes count in smk_set_cipso()
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 264/266] media: v4l2-core: explicitly clear ioctl input data Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 18:40 ` [PATCH 5.13 266/266] f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances Greg Kroah-Hartman
` (4 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Tetsuo Handa, Casey Schaufler
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
commit 49ec114a6e62d8d320037ce71c1aaf9650b3cafd upstream.
Oops, I failed to update subject line.
>From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Mon, 12 Apr 2021 22:25:06 +0900
Subject: [PATCH 5.13 265/266] smackfs: restrict bytes count in smk_set_cipso()
Commit 7ef4c19d245f3dc2 ("smackfs: restrict bytes count in smackfs write
functions") missed that count > SMK_CIPSOMAX check applies to only
format == SMK_FIXED24_FMT case.
Reported-by: syzbot <syzbot+77c53db50c9fff774e8e@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/smack/smackfs.c | 2 ++
1 file changed, 2 insertions(+)
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -855,6 +855,8 @@ static ssize_t smk_set_cipso(struct file
if (format == SMK_FIXED24_FMT &&
(count < SMK_CIPSOMIN || count > SMK_CIPSOMAX))
return -EINVAL;
+ if (count > PAGE_SIZE)
+ return -EINVAL;
data = memdup_user_nul(buf, count);
if (IS_ERR(data))
^ permalink raw reply [flat|nested] 277+ messages in thread* [PATCH 5.13 266/266] f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 265/266] smackfs: restrict bytes count in smk_set_cipso() Greg Kroah-Hartman
@ 2021-07-15 18:40 ` Greg Kroah-Hartman
2021-07-15 21:40 ` [PATCH 5.13 000/266] 5.13.3-rc1 review Daniel Díaz
` (3 subsequent siblings)
269 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-15 18:40 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+9d90dad32dd9727ed084, Chao Yu,
Jaegeuk Kim
From: Chao Yu <yuchao0@huawei.com>
commit cad83c968c2ebe97905f900326988ed37146c347 upstream.
As syzbot reported, there is an use-after-free issue during f2fs recovery:
Use-after-free write at 0xffff88823bc16040 (in kfence-#10):
kmem_cache_destroy+0x1f/0x120 mm/slab_common.c:486
f2fs_recover_fsync_data+0x75b0/0x8380 fs/f2fs/recovery.c:869
f2fs_fill_super+0x9393/0xa420 fs/f2fs/super.c:3945
mount_bdev+0x26c/0x3a0 fs/super.c:1367
legacy_get_tree+0xea/0x180 fs/fs_context.c:592
vfs_get_tree+0x86/0x270 fs/super.c:1497
do_new_mount fs/namespace.c:2905 [inline]
path_mount+0x196f/0x2be0 fs/namespace.c:3235
do_mount fs/namespace.c:3248 [inline]
__do_sys_mount fs/namespace.c:3456 [inline]
__se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3433
do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47
entry_SYSCALL_64_after_hwframe+0x44/0xae
The root cause is multi f2fs filesystem instances can race on accessing
global fsync_entry_slab pointer, result in use-after-free issue of slab
cache, fixes to init/destroy this slab cache only once during module
init/destroy procedure to avoid this issue.
Reported-by: syzbot+9d90dad32dd9727ed084@syzkaller.appspotmail.com
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/f2fs.h | 2 ++
fs/f2fs/recovery.c | 23 ++++++++++++++---------
fs/f2fs/super.c | 8 +++++++-
3 files changed, 23 insertions(+), 10 deletions(-)
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -3566,6 +3566,8 @@ void f2fs_destroy_garbage_collection_cac
*/
int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only);
bool f2fs_space_for_roll_forward(struct f2fs_sb_info *sbi);
+int __init f2fs_create_recovery_cache(void);
+void f2fs_destroy_recovery_cache(void);
/*
* debug.c
--- a/fs/f2fs/recovery.c
+++ b/fs/f2fs/recovery.c
@@ -788,13 +788,6 @@ int f2fs_recover_fsync_data(struct f2fs_
quota_enabled = f2fs_enable_quota_files(sbi, s_flags & SB_RDONLY);
#endif
- fsync_entry_slab = f2fs_kmem_cache_create("f2fs_fsync_inode_entry",
- sizeof(struct fsync_inode_entry));
- if (!fsync_entry_slab) {
- err = -ENOMEM;
- goto out;
- }
-
INIT_LIST_HEAD(&inode_list);
INIT_LIST_HEAD(&tmp_inode_list);
INIT_LIST_HEAD(&dir_list);
@@ -867,8 +860,6 @@ skip:
}
}
- kmem_cache_destroy(fsync_entry_slab);
-out:
#ifdef CONFIG_QUOTA
/* Turn quotas off */
if (quota_enabled)
@@ -878,3 +869,17 @@ out:
return ret ? ret : err;
}
+
+int __init f2fs_create_recovery_cache(void)
+{
+ fsync_entry_slab = f2fs_kmem_cache_create("f2fs_fsync_inode_entry",
+ sizeof(struct fsync_inode_entry));
+ if (!fsync_entry_slab)
+ return -ENOMEM;
+ return 0;
+}
+
+void f2fs_destroy_recovery_cache(void)
+{
+ kmem_cache_destroy(fsync_entry_slab);
+}
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4227,9 +4227,12 @@ static int __init init_f2fs_fs(void)
err = f2fs_create_checkpoint_caches();
if (err)
goto free_segment_manager_caches;
- err = f2fs_create_extent_cache();
+ err = f2fs_create_recovery_cache();
if (err)
goto free_checkpoint_caches;
+ err = f2fs_create_extent_cache();
+ if (err)
+ goto free_recovery_cache;
err = f2fs_create_garbage_collection_cache();
if (err)
goto free_extent_cache;
@@ -4278,6 +4281,8 @@ free_garbage_collection_cache:
f2fs_destroy_garbage_collection_cache();
free_extent_cache:
f2fs_destroy_extent_cache();
+free_recovery_cache:
+ f2fs_destroy_recovery_cache();
free_checkpoint_caches:
f2fs_destroy_checkpoint_caches();
free_segment_manager_caches:
@@ -4303,6 +4308,7 @@ static void __exit exit_f2fs_fs(void)
f2fs_exit_sysfs();
f2fs_destroy_garbage_collection_cache();
f2fs_destroy_extent_cache();
+ f2fs_destroy_recovery_cache();
f2fs_destroy_checkpoint_caches();
f2fs_destroy_segment_manager_caches();
f2fs_destroy_node_manager_caches();
^ permalink raw reply [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 000/266] 5.13.3-rc1 review
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2021-07-15 18:40 ` [PATCH 5.13 266/266] f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances Greg Kroah-Hartman
@ 2021-07-15 21:40 ` Daniel Díaz
2021-07-16 18:08 ` Greg Kroah-Hartman
2021-07-15 22:42 ` Florian Fainelli
` (2 subsequent siblings)
269 siblings, 1 reply; 277+ messages in thread
From: Daniel Díaz @ 2021-07-15 21:40 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
Shuah Khan, patches, lkft-triage, Pavel Machek, jonathanh,
f.fainelli, linux- stable, svens
Hello!
On Thu, 15 Jul 2021 at 14:09, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 5.13.3 release.
> There are 266 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 17 Jul 2021 18:21:07 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Build regressions have been found on this release candidate (and on 5.12-rc).
## Regressions (compared to v5.13.2)
* s390, build
- clang-10-allnoconfig
- clang-10-defconfig
- clang-10-tinyconfig
- clang-11-allnoconfig
- clang-11-defconfig
- clang-11-tinyconfig
- clang-12-allnoconfig
- clang-12-defconfig
- clang-12-tinyconfig
- gcc-8-allnoconfig
- gcc-8-defconfig
- gcc-8-tinyconfig
- gcc-9-allnoconfig
- gcc-9-defconfig
- gcc-9-tinyconfig
- gcc-10-allnoconfig
- gcc-10-defconfig
- gcc-10-tinyconfig
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
[...]
> Sven Schnelle <svens@linux.ibm.com>
> s390/signal: switch to using vdso for sigreturn and syscall restart
[...]
Our bisections pointed to this commit. Reverting it made the build pass again.
Greetings!
Daniel Díaz
daniel.diaz@linaro.org
^ permalink raw reply [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 000/266] 5.13.3-rc1 review
2021-07-15 21:40 ` [PATCH 5.13 000/266] 5.13.3-rc1 review Daniel Díaz
@ 2021-07-16 18:08 ` Greg Kroah-Hartman
0 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-16 18:08 UTC (permalink / raw)
To: Daniel Díaz
Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
Shuah Khan, patches, lkft-triage, Pavel Machek, jonathanh,
f.fainelli, linux- stable, svens
On Thu, Jul 15, 2021 at 04:40:55PM -0500, Daniel Díaz wrote:
> Hello!
>
> On Thu, 15 Jul 2021 at 14:09, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > This is the start of the stable review cycle for the 5.13.3 release.
> > There are 266 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat, 17 Jul 2021 18:21:07 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.3-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.13.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> Build regressions have been found on this release candidate (and on 5.12-rc).
>
> ## Regressions (compared to v5.13.2)
> * s390, build
> - clang-10-allnoconfig
> - clang-10-defconfig
> - clang-10-tinyconfig
> - clang-11-allnoconfig
> - clang-11-defconfig
> - clang-11-tinyconfig
> - clang-12-allnoconfig
> - clang-12-defconfig
> - clang-12-tinyconfig
> - gcc-8-allnoconfig
> - gcc-8-defconfig
> - gcc-8-tinyconfig
> - gcc-9-allnoconfig
> - gcc-9-defconfig
> - gcc-9-tinyconfig
> - gcc-10-allnoconfig
> - gcc-10-defconfig
> - gcc-10-tinyconfig
>
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
>
> [...]
> > Sven Schnelle <svens@linux.ibm.com>
> > s390/signal: switch to using vdso for sigreturn and syscall restart
> [...]
>
> Our bisections pointed to this commit. Reverting it made the build pass again.
>
Now dropped, thanks.
greg k-h
^ permalink raw reply [flat|nested] 277+ messages in thread
* Re: [PATCH 5.13 000/266] 5.13.3-rc1 review
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2021-07-15 21:40 ` [PATCH 5.13 000/266] 5.13.3-rc1 review Daniel Díaz
@ 2021-07-15 22:42 ` Florian Fainelli
2021-07-16 11:35 ` Jon Hunter
2021-07-16 15:26 ` Guenter Roeck
269 siblings, 0 replies; 277+ messages in thread
From: Florian Fainelli @ 2021-07-15 22:42 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
jonathanh, stable
On 7/15/21 11:35 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.13.3 release.
> There are 266 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 17 Jul 2021 18:21:07 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB, using 32-bit and 64-bit ARM kernels:
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
--
Florian
^ permalink raw reply [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 000/266] 5.13.3-rc1 review
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2021-07-15 22:42 ` Florian Fainelli
@ 2021-07-16 11:35 ` Jon Hunter
2021-07-16 15:26 ` Guenter Roeck
269 siblings, 0 replies; 277+ messages in thread
From: Jon Hunter @ 2021-07-16 11:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, stable, linux-tegra
On Thu, 15 Jul 2021 20:35:55 +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.13.3 release.
> There are 266 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 17 Jul 2021 18:21:07 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v5.13:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
110 tests: 110 pass, 0 fail
Linux version: 5.13.3-rc1-g7e5885df1870
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 000/266] 5.13.3-rc1 review
2021-07-15 18:35 [PATCH 5.13 000/266] 5.13.3-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2021-07-16 11:35 ` Jon Hunter
@ 2021-07-16 15:26 ` Guenter Roeck
2021-07-16 18:01 ` Greg Kroah-Hartman
269 siblings, 1 reply; 277+ messages in thread
From: Guenter Roeck @ 2021-07-16 15:26 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, lkft-triage, pavel, jonathanh,
f.fainelli, stable
On 7/15/21 11:35 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.13.3 release.
> There are 266 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 17 Jul 2021 18:21:07 +0000.
> Anything received after that time might be too late.
>
This one is a bit surprising.
Build reference: v5.13.2-267-g7e5885d
Compiler version: x86_64-linux-gcc (GCC) 11.1.0
Building i386:allyesconfig ... failed
--------------
Error log:
drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c: In function 'dcn20_update_clocks_update_dentist':
drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:154:47: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
Turns out that CONFIG_DRM_AMD_DC_DCN is only enabled with allyesconfig
for ARCH=i386 but not for ARCH=x86_64, and get_fifo_cal_average_level
is indeed not a member of struct stream_encoder_funcs in v5.13.y-queue.
This strongly suggests that commit a39c5ab96adc ("drm/amd/display: Cover
edge-case when changing DISPCLK WDIVIDER") either needs to be dropped
from v5.13.y, or it needs to be backported (and tested) properly.
Guenter
^ permalink raw reply [flat|nested] 277+ messages in thread* Re: [PATCH 5.13 000/266] 5.13.3-rc1 review
2021-07-16 15:26 ` Guenter Roeck
@ 2021-07-16 18:01 ` Greg Kroah-Hartman
0 siblings, 0 replies; 277+ messages in thread
From: Greg Kroah-Hartman @ 2021-07-16 18:01 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, stable
On Fri, Jul 16, 2021 at 08:26:32AM -0700, Guenter Roeck wrote:
> On 7/15/21 11:35 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.13.3 release.
> > There are 266 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat, 17 Jul 2021 18:21:07 +0000.
> > Anything received after that time might be too late.
> >
>
> This one is a bit surprising.
>
> Build reference: v5.13.2-267-g7e5885d
> Compiler version: x86_64-linux-gcc (GCC) 11.1.0
>
> Building i386:allyesconfig ... failed
> --------------
> Error log:
> drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c: In function 'dcn20_update_clocks_update_dentist':
> drivers/gpu/drm/amd/amdgpu/../display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c:154:47: error: 'const struct stream_encoder_funcs' has no member named 'get_fifo_cal_average_level'
>
> Turns out that CONFIG_DRM_AMD_DC_DCN is only enabled with allyesconfig
> for ARCH=i386 but not for ARCH=x86_64, and get_fifo_cal_average_level
> is indeed not a member of struct stream_encoder_funcs in v5.13.y-queue.
> This strongly suggests that commit a39c5ab96adc ("drm/amd/display: Cover
> edge-case when changing DISPCLK WDIVIDER") either needs to be dropped
> from v5.13.y, or it needs to be backported (and tested) properly.
I've now dropped this, thanks.
greg k-h
^ permalink raw reply [flat|nested] 277+ messages in thread